queries

Creates, updates, deletes, gets or lists a queries resource.

Overview

Name	queries
Type	Resource
Id	aws.cloudtrail.queries

Fields

The following fields are returned by SELECT queries:

list_queries

Name	Datatype	Description
next_token	string	A token you can use to get the next page of results. (pattern: <code>.*</code>)
queries	array	Lists matching query results, and shows query ID, status, and creation time of each query.

describe_query

Name	Datatype	Description
delivery_s3_uri	string	The URI for the S3 bucket where CloudTrail delivered query results, if applicable. (pattern: <code>s3:​//[a-z0-9][.-a-z0-9]{1,61}[a-z0-9](/.*)?</code>)
delivery_status	string	The delivery status. (SUCCESS, FAILED, FAILED_SIGNING_FILE, PENDING, RESOURCE_NOT_FOUND, ACCESS_DENIED, ACCESS_DENIED_SIGNING_FILE, CANCELLED, UNKNOWN)
error_message	string	The error message returned if a query failed. (pattern: <code>.*</code>)
event_data_store_owner_account_id	string	The account ID of the event data store owner. (pattern: <code>\d+</code>)
prompt	string	The prompt used for a generated query. For information about generated queries, see Create CloudTrail Lake queries from natural language prompts in the CloudTrail user guide. (pattern: <code>^[ -~\n]*$</code>)
query_id	string	The ID of the query. (pattern: <code>^[a-f0-9-]+$</code>)
query_statistics	object	Metadata about a query, including the number of events that were matched, the total number of events scanned, the query run time in milliseconds, and the query's creation time.
query_status	string	The status of a query. Values for QueryStatus include QUEUED, RUNNING, FINISHED, FAILED, TIMED_OUT, or CANCELLED (QUEUED, RUNNING, FINISHED, FAILED, CANCELLED, TIMED_OUT)
query_string	string	The SQL code of a query. (pattern: <code>(?s).*</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_queries	select	region		Returns a list of queries and query statuses for the past seven days. You must specify an ARN value for EventDataStore. Optionally, to shorten the list of results, you can specify a time range, formatted as timestamps, by adding StartTime and EndTime parameters, and a QueryStatus value. Valid values for QueryStatus include QUEUED, RUNNING, FINISHED, FAILED, TIMED_OUT, or CANCELLED.
describe_query	select	region		Returns metadata about a query, including query run time in milliseconds, number of events scanned and matched, and query status. If the query results were delivered to an S3 bucket, the response also provides the S3 URI and the delivery status. You must specify either QueryId or QueryAlias. Specifying the QueryAlias parameter returns information about the last query run for the alias. You can provide RefreshId along with QueryAlias to view the query results of a dashboard query for the specified RefreshId.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

list_queries

Returns a list of queries and query statuses for the past seven days. You must specify an ARN value for EventDataStore. Optionally, to shorten the list of results, you can specify a time range, formatted as timestamps, by adding StartTime and EndTime parameters, and a QueryStatus value. Valid values for QueryStatus include QUEUED, RUNNING, FINISHED, FAILED, TIMED_OUT, or CANCELLED.

SELECT
next_token,
queries
FROM aws.cloudtrail.queries
WHERE region = '{{ region }}' -- required
;

describe_query

Returns metadata about a query, including query run time in milliseconds, number of events scanned and matched, and query status. If the query results were delivered to an S3 bucket, the response also provides the S3 URI and the delivery status. You must specify either QueryId or QueryAlias. Specifying the QueryAlias parameter returns information about the last query run for the alias. You can provide RefreshId along with QueryAlias to view the query results of a dashboard query for the specified RefreshId.

SELECT
delivery_s3_uri,
delivery_status,
error_message,
event_data_store_owner_account_id,
prompt,
query_id,
query_statistics,
query_status,
query_string
FROM aws.cloudtrail.queries
WHERE region = '{{ region }}' -- required
;