aws

AWS native API provider for StackQL.

info

For the AWS Cloud Control provider see the awscc provider.

Provider Summary

total services: 419
total resources: 6618

Installation

To pull the latest version of the aws provider, run the following command:

REGISTRY PULL aws;

To view previous provider versions or to pull a specific provider version, see here.

Authentication

This provider uses AWS credentials for authentication. Configure your credentials using one of the following methods:

Environment variables: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
AWS credentials file: ~/.aws/credentials
IAM roles for EC2 instances
AWS STS temporary credentials

For more information on AWS authentication, see the AWS documentation.

Regions

Resources are available in all AWS regions. Use the region parameter to specify the target region for your operations.

Example Queries

Try the following queries using stackql shell, or run them from a script or CI pipeline with stackql exec.

Identity check

Confirm which account and principal your credentials resolve to:

SELECT account, arn, user_id
FROM aws.sts.caller_identities
WHERE region = 'us-east-1';

Compute inventory

Instance counts by type in a region - a one-line capacity/spend sanity check:

SELECT instance_type, COUNT(*) AS num_instances
FROM aws.ec2.instances
WHERE region = 'us-east-1'
GROUP BY instance_type;

VPCs with their state and address space:

SELECT vpc_id, state, cidr_block, is_default
FROM aws.ec2.vpcs
WHERE region = 'us-east-1';

Storage estate

Buckets with their ARNs and age:

SELECT name, bucket_arn, creation_date
FROM aws.s3.buckets
WHERE region = 'us-east-1'
ORDER BY creation_date DESC;

Objects in a bucket - bucket and region alone route to the list operation:

SELECT key, size, last_modified
FROM aws.s3.objects
WHERE region = 'us-east-1' AND bucket = 'my-bucket';

Read and write S3 object content

Adding key to the WHERE clause routes to the object read, which projects the raw body as a single contents column (text objects only). Reading a Terraform state file straight out of S3:

SELECT contents FROM aws.s3.objects
WHERE region = 'us-east-1'
AND bucket = 'my-bucket'
AND key = 'env/terraform.tfstate';

INSERT creates an object, and since S3 PutObject is create-or-overwrite, REPLACE updates it in place:

-- create
INSERT INTO aws.s3.objects(region, bucket, key, contents)
SELECT 'us-east-1', 'my-bucket', 'app/config.json',
'{"log_level": "info"}';

-- overwrite
REPLACE aws.s3.objects
SET contents = '{"log_level": "warn"}'
WHERE region = 'us-east-1' AND bucket = 'my-bucket' AND key = 'app/config.json';

-- remove
DELETE FROM aws.s3.objects
WHERE region = 'us-east-1' AND bucket = 'my-bucket' AND key = 'app/config.json';

IAM users

Every user in the account (IAM is a global service - use us-east-1):

SELECT user_name, arn, create_date
FROM aws.iam.users
WHERE region = 'us-east-1';

Provision, mutate and tear down

Mutations use the same SQL grammar - INSERT creates a resource, UPDATE changes it and DELETE removes it. Structured request values are passed as JSON strings with wire-format (PascalCase) inner keys. A VPC end to end:

-- create, projecting the new id back
INSERT INTO aws.ec2.vpcs(region, CidrBlock)
SELECT 'us-east-1', '10.99.0.0/16'
RETURNING vpc_id, state, cidr_block;

-- enable DNS hostnames
UPDATE aws.ec2.vpc_attributes
SET EnableDnsHostnames = JSON('{"Value": true}')
WHERE region = 'us-east-1' AND vpc_id = 'vpc-00112233445566778';

-- remove it
DELETE FROM aws.ec2.vpcs
WHERE region = 'us-east-1' AND vpc_id = 'vpc-00112233445566778';

Lifecycle operations

State transitions (stop, start, reboot and similar) are invoked with EXEC, passing wire-cased parameters - one target id per statement:

EXEC aws.ec2.instances.stop_instances
  @region = 'us-east-1',
  @InstanceId = 'i-0123456789abcdef0';

EXEC aws.ec2.instances.start_instances
  @region = 'us-east-1',
  @InstanceId = 'i-0123456789abcdef0';

Services

accessanalyzer
account
account_access
acm
acm_pca
agent_registry
agent_registry_control
aiops
amp
amplify
amplifybackend
amplifyuibuilder
apigateway
apigatewaymanagementapi
apigatewayv2
appconfig
appconfigdata
appfabric
appflow
appintegrations
application_autoscaling
application_insights
application_signals
applicationcostprofiler
appmesh
apprunner
appstream
appsync
arc_region_switch
arc_zonal_shift
artifact
athena
auditmanager
autoscaling
autoscaling_plans
b2bi
backup
backup_gateway
backupsearch
batch
bcm_dashboards
bcm_data_exports
bcm_pricing_calculator
bcm_recommended_actions
bedrock
bedrock_agent
bedrock_agent_runtime
bedrock_agentcore
bedrock_agentcore_control
bedrock_data_automation
bedrock_data_automation_runtime
bedrock_runtime
billing
billingconductor
braket
budgets
ce
chatbot
chime
chime_sdk_identity
chime_sdk_media_pipelines
chime_sdk_meetings
chime_sdk_messaging
chime_sdk_voice
cleanrooms
cleanroomsml
cloud9
cloudcontrol
clouddirectory
cloudformation
cloudfront
cloudfront_keyvaluestore
cloudhsm
cloudhsmv2
cloudsearch
cloudsearchdomain
cloudtrail
cloudtrail_data
cloudwatch
codeartifact
codebuild
codecatalyst
codecommit
codeconnections
codedeploy
codeguru_reviewer
codeguru_security
codeguruprofiler
codepipeline
codestar_connections
codestar_notifications
cognito_identity
cognito_idp
cognito_sync
comprehend
comprehendmedical
compute_optimizer
compute_optimizer_automation
config
connect
connect_contact_lens
connectcampaigns
connectcampaignsv2
connectcases
connecthealth
connectparticipant
controlcatalog
controltower
cost_optimization_hub
cur
customer_profiles
databrew
dataexchange
datapipeline
datasync
datazone
dax
deadline
detective
devicefarm
devops_agent
devops_guru
directconnect
discovery
dlm
dms
docdb
docdb_elastic
drs
ds
ds_data
dsql
dynamodb
dynamodbstreams
ebs
ec2
ecr
ecr_public
ecs
efs
eks
elasticache
elasticbeanstalk
elb
elbv2
elementalinference
emr
emr_containers
emr_serverless
entityresolution
es
events
evs
finspace
finspace_data
firehose
fis
fms
forecast
frauddetector
freetier
fsx
gamelift
gameliftstreams
geo_maps
geo_places
glacier
globalaccelerator
glue
grafana
greengrass
greengrassv2
groundstation
guardduty
health
healthlake
iam
identitystore
imagebuilder
importexport
inspector
inspector2
interconnect
internetmonitor
invoicing
iot
iot_data
iot_jobs_data
iot_managed_integrations
iotdeviceadvisor
iotfleetwise
iotsecuretunneling
iotsitewise
iotthingsgraph
iottwinmaker
iotwireless
ivs
ivs_realtime
ivschat
kafka
kafkaconnect
kendra
kendra_ranking
keyspaces
keyspacesstreams
kinesis
kinesis_video_archived_media
kinesis_video_media
kinesis_video_signaling
kinesisanalytics

kinesisanalyticsv2
kinesisvideo
kms
lakeformation
lambda
lambda_core
lambda_microvms
launch_wizard
lex_models
lex_runtime
lexv2_models
lexv2_runtime
license_manager
license_manager_linux_subscriptions
license_manager_user_subscriptions
lightsail
location
logs
lookoutequipment
m2
machinelearning
macie2
mailmanager
managedblockchain
managedblockchain_query
marketplace_agreement
marketplace_catalog
marketplace_deployment
marketplace_discovery
marketplace_entitlement
marketplace_reporting
mediaconnect
mediaconvert
medialive
mediapackage
mediapackage_vod
mediapackagev2
mediastore
mediastore_data
mediatailor
medical_imaging
memorydb
meteringmarketplace
mgh
mgn
migration_hub_refactor_spaces
migrationhub_config
migrationhuborchestrator
migrationhubstrategy
mpa
mq
mturk
mwaa
mwaa_serverless
neptune
neptune_graph
neptunedata
network_firewall
networkflowmonitor
networkmanager
networkmonitor
notifications
notificationscontacts
nova_act
oam
observabilityadmin
odb
omics
opensearch
opensearchserverless
organizations
osis
outposts
partnercentral_account
partnercentral_benefits
partnercentral_channel
partnercentral_selling
payment_cryptography
pca_connector_ad
pca_connector_scep
pcs
personalize
personalize_events
personalize_runtime
pi
pinpoint
pinpoint_email
pinpoint_sms_voice
pinpoint_sms_voice_v2
pipes
polly
pricing
pricing_plan_manager
proton
qapps
qbusiness
qconnect
quicksight
ram
rbin
rds
redshift
redshift_data
redshift_serverless
rekognition
repostspace
resiliencehub
resiliencehubv2
resource_explorer_2
resource_groups
resourcegroupstaggingapi
rolesanywhere
route53
route53_recovery_cluster
route53_recovery_control_config
route53_recovery_readiness
route53domains
route53globalresolver
route53profiles
route53resolver
rtbfabric
rum
s3
s3control
s3files
s3outposts
s3tables
s3vectors
sagemaker
sagemaker_a2i_runtime
sagemaker_edge
sagemaker_featurestore_runtime
sagemaker_geospatial
sagemaker_metrics
sagemakerjobruntime
savingsplans
scheduler
schemas
sdb
secretsmanager
security_ir
securityagent
securityhub
securitylake
serverlessrepo
service_quotas
servicecatalog
servicecatalog_appregistry
servicediscovery
ses
sesv2
shield
signer
signer_data
signin
simpledbv2
sms_voice
snow_device_management
snowball
sns
socialmessaging
sqs
ssm
ssm_contacts
ssm_guiconnect
ssm_incidents
ssm_quicksetup
ssm_sap
sso
sso_admin
sso_oidc
stepfunctions
storagegateway
sts
supplychain
support
support_app
supportauthz
sustainability
swf
synthetics
taxsettings
textract
timestream_influxdb
timestream_query
timestream_write
tnb
transcribe
transfer
translate
trustedadvisor
uxc
verifiedpermissions
voice_id
vpc_lattice
waf
waf_regional
wafv2
wellarchitected
wickr
wisdom
workdocs
workmail
workmailmessageflow
workspaces
workspaces_instances
workspaces_thin_client
workspaces_web
xray

Installation​

Authentication​

Regions​

Example Queries​

Identity check​

Compute inventory​

Storage estate​

Read and write S3 object content​

IAM users​

Provision, mutate and tear down​

Lifecycle operations​

Services​