CloudTrail / Client / start_query

start_query

CloudTrail.Client.start_query(**kwargs)

Warning

CloudTrail Lake will no longer be open to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see CloudTrail Lake availability change.

Starts a CloudTrail Lake query. Use the QueryStatement parameter to provide your SQL query, enclosed in single quotation marks. Use the optional DeliveryS3Uri parameter to deliver the query results to an S3 bucket.

StartQuery requires you specify either the QueryStatement parameter, or a QueryAlias and any QueryParameters. In the current release, the QueryAlias and QueryParameters parameters are used only for the queries that populate the CloudTrail Lake dashboards.

See also: AWS API Documentation

Request Syntax

response = client.start_query(
    QueryStatement='string',
    DeliveryS3Uri='string',
    QueryAlias='string',
    QueryParameters=[
        'string',
    ],
    EventDataStoreOwnerAccountId='string'
)
Parameters:

  • QueryStatement (string) – The SQL code of your query.

  • DeliveryS3Uri (string) – The URI for the S3 bucket where CloudTrail delivers the query results.

  • QueryAlias (string) – The alias that identifies a query template.

  • QueryParameters (list) –

    The query parameters for the specified QueryAlias.

    • (string) –

  • EventDataStoreOwnerAccountId (string) – The account ID of the event data store owner.

Return type:

dict

Returns:

Response Syntax

{
    'QueryId': 'string',
    'EventDataStoreOwnerAccountId': 'string'
}

Response Structure

  • (dict) –

    • QueryId (string) –

      The ID of the started query.

    • EventDataStoreOwnerAccountId (string) –

      The account ID of the event data store owner.

Exceptions