Skip to content

start_query

start_query(
    *,
    config_overrides: Optional[CloudTrailClientConfig] = None,
    query_statement: Optional[QueryStatement] = None,
    delivery_s3_uri: Optional[DeliveryS3Uri] = None,
    query_alias: Optional[QueryAlias] = None,
    query_parameters: Optional[QueryParameters] = None,
    event_data_store_owner_account_id: Optional[AccountId] = None,
) -> StartQueryResponse

CloudTrail Lake will no longer be open to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see CloudTrail Lake availability change.

Starts a CloudTrail Lake query. Use the QueryStatement parameter to provide your SQL query, enclosed in single quotation marks. Use the optional DeliveryS3Uri parameter to deliver the query results to an S3 bucket.

StartQuery requires you specify either the QueryStatement parameter, or a QueryAlias and any QueryParameters. In the current release, the QueryAlias and QueryParameters parameters are used only for the queries that populate the CloudTrail Lake dashboards.

Parameters:

  • query_statement (Optional[QueryStatement], default: None ) –

    The SQL code of your query.

  • delivery_s3_uri (Optional[DeliveryS3Uri], default: None ) –

    The URI for the S3 bucket where CloudTrail delivers the query results.

  • query_alias (Optional[QueryAlias], default: None ) –

    The alias that identifies a query template.

  • query_parameters (Optional[QueryParameters], default: None ) –

    The query parameters for the specified QueryAlias.

  • event_data_store_owner_account_id (Optional[AccountId], default: None ) –

    The account ID of the event data store owner.

Raises:

Source code in docs_src/capo_cloudtrail/_services/cloud_trail.py
def start_query(
    self,
    *,
    config_overrides: Optional[CloudTrailClientConfig] = None,
    query_statement: Optional[
        "capo_cloudtrail.types.query_statement.QueryStatement"
    ] = None,
    delivery_s3_uri: Optional[
        "capo_cloudtrail.types.delivery_s3_uri.DeliveryS3Uri"
    ] = None,
    query_alias: Optional["capo_cloudtrail.types.query_alias.QueryAlias"] = None,
    query_parameters: Optional[
        "capo_cloudtrail.types.query_parameters.QueryParameters"
    ] = None,
    event_data_store_owner_account_id: Optional[
        "capo_cloudtrail.types.account_id.AccountId"
    ] = None,
) -> "capo_cloudtrail.types.start_query_response.StartQueryResponse":
    """<important> <p>CloudTrail Lake will no longer be open to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see <a href="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-service-availability-change.html">CloudTrail Lake availability change</a>.</p> </important> <p>Starts a CloudTrail Lake query. Use the <code>QueryStatement</code> parameter to provide your SQL query, enclosed in single quotation marks. Use the optional <code>DeliveryS3Uri</code> parameter to deliver the query results to an S3 bucket.</p> <p> <code>StartQuery</code> requires you specify either the <code>QueryStatement</code> parameter, or a <code>QueryAlias</code> and any <code>QueryParameters</code>. In the current release, the <code>QueryAlias</code> and <code>QueryParameters</code> parameters are used only for the queries that populate the CloudTrail Lake dashboards.</p>

    Args:
        query_statement: <p>The SQL code of your query.</p>
        delivery_s3_uri: <p> The URI for the S3 bucket where CloudTrail delivers the query results. </p>
        query_alias: <p> The alias that identifies a query template. </p>
        query_parameters: <p> The query parameters for the specified <code>QueryAlias</code>. </p>
        event_data_store_owner_account_id: <p> The account ID of the event data store owner. </p>

    Raises:
        capo_cloudtrail.errors.event_data_store_arn_invalid_exception.EventDataStoreARNInvalidException: <p>The specified event data store ARN is not valid or does not map to an event data store in your account.</p>
        capo_cloudtrail.errors.event_data_store_not_found_exception.EventDataStoreNotFoundException: <p>The specified event data store was not found.</p>
        capo_cloudtrail.errors.inactive_event_data_store_exception.InactiveEventDataStoreException: <p>The event data store is inactive.</p>
        capo_cloudtrail.errors.insufficient_encryption_policy_exception.InsufficientEncryptionPolicyException: <p>For the <code>CreateTrail</code> <code>PutInsightSelectors</code>, <code>UpdateTrail</code>, <code>StartQuery</code>, and <code>StartImport</code> operations, this exception is thrown when the policy on the S3 bucket or KMS key does not have sufficient permissions for the operation.</p> <p>For all other operations, this exception is thrown when the policy for the KMS key does not have sufficient permissions for the operation.</p>
        capo_cloudtrail.errors.insufficient_s3_bucket_policy_exception.InsufficientS3BucketPolicyException: <p>This exception is thrown when the policy on the S3 bucket is not sufficient.</p>
        capo_cloudtrail.errors.invalid_parameter_exception.InvalidParameterException: <p>The request includes a parameter that is not valid.</p>
        capo_cloudtrail.errors.invalid_query_statement_exception.InvalidQueryStatementException: <p>The query that was submitted has validation errors, or uses incorrect syntax or unsupported keywords. For more information about writing a query, see <a href="https://docs.aws.amazon.com/awscloudtrail/latest/userguide/query-create-edit-query.html">Create or edit a query</a> in the <i>CloudTrail User Guide</i>.</p>
        capo_cloudtrail.errors.invalid_s3_bucket_name_exception.InvalidS3BucketNameException: <p>This exception is thrown when the provided S3 bucket name is not valid.</p>
        capo_cloudtrail.errors.invalid_s3_prefix_exception.InvalidS3PrefixException: <p>This exception is thrown when the provided S3 prefix is not valid.</p>
        capo_cloudtrail.errors.max_concurrent_queries_exception.MaxConcurrentQueriesException: <p>You are already running the maximum number of concurrent queries. The maximum number of concurrent queries is 10. Wait a minute for some queries to finish, and then run the query again.</p>
        capo_cloudtrail.errors.no_management_account_slr_exists_exception.NoManagementAccountSLRExistsException: <p> This exception is thrown when the management account does not have a service-linked role. </p>
        capo_cloudtrail.errors.operation_not_permitted_exception.OperationNotPermittedException: <p>This exception is thrown when the requested operation is not permitted.</p>
        capo_cloudtrail.errors.s3_bucket_does_not_exist_exception.S3BucketDoesNotExistException: <p>This exception is thrown when the specified S3 bucket does not exist.</p>
        capo_cloudtrail.errors.unsupported_operation_exception.UnsupportedOperationException: <p>This exception is thrown when the requested operation is not supported.</p>
        capo_cloudtrail.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_cloudtrail.types.start_query_request.StartQueryRequest]",
    ) -> OperationResponse[
        "capo_cloudtrail.types.start_query_response.StartQueryResponse"
    ]:
        import capo_cloudtrail._operations.cloud_trail_20131101.start_query

        output, http_response = (
            capo_cloudtrail._operations.cloud_trail_20131101.start_query.start_query(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("StartQuery")
    )
    input_: capo_cloudtrail.types.start_query_request.StartQueryRequest = {}
    if query_statement is not None:
        input_["query_statement"] = query_statement
    if delivery_s3_uri is not None:
        input_["delivery_s3_uri"] = delivery_s3_uri
    if query_alias is not None:
        input_["query_alias"] = query_alias
    if query_parameters is not None:
        input_["query_parameters"] = query_parameters
    if event_data_store_owner_account_id is not None:
        input_["event_data_store_owner_account_id"] = (
            event_data_store_owner_account_id
        )

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output