CloudTrail / Client / start_query

start_query#

CloudTrail.Client.start_query(**kwargs)#

Starts a CloudTrail Lake query. Use the QueryStatement parameter to provide your SQL query, enclosed in single quotation marks. Use the optional DeliveryS3Uri parameter to deliver the query results to an S3 bucket.

StartQuery requires you specify either the QueryStatement parameter, or a QueryAlias and any QueryParameters. In the current release, the QueryAlias and QueryParameters parameters are used only for the queries that populate the CloudTrail Lake dashboards.

See also: AWS API Documentation

Request Syntax

response = client.start_query(
    QueryStatement='string',
    DeliveryS3Uri='string',
    QueryAlias='string',
    QueryParameters=[
        'string',
    ],
    EventDataStoreOwnerAccountId='string'
)
Parameters:

  • QueryStatement (string) – The SQL code of your query.

  • DeliveryS3Uri (string) – The URI for the S3 bucket where CloudTrail delivers the query results.

  • QueryAlias (string) – The alias that identifies a query template.

  • QueryParameters (list) –

    The query parameters for the specified QueryAlias.

    • (string) –

  • EventDataStoreOwnerAccountId (string) – The account ID of the event data store owner.

Return type:

dict

Returns:

Response Syntax

{
    'QueryId': 'string',
    'EventDataStoreOwnerAccountId': 'string'
}

Response Structure

  • (dict) –

    • QueryId (string) –

      The ID of the started query.

    • EventDataStoreOwnerAccountId (string) –

      The account ID of the event data store owner.

Exceptions