Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Lacework Provider
  3. API Docs
  4. Query
lacework 2.0.6 published on Monday, Apr 14, 2025 by lacework
lacework/terraform-provider-lacework

lacework.Query

Explore with Pulumi AI

lacework logo
lacework 2.0.6 published on Monday, Apr 14, 2025 by lacework
lacework/terraform-provider-lacework

    To provide customizable specification of datasources, Lacework provides the Lacework Query Language (LQL). LQL is a human-readable text syntax for specifying selection, filtering, and manipulation of data. It overlaps with SQL in its syntax and what it allows.

    For more information, see the LQL Overview Documentation.

    Example Usage

    Query all EC2 instances with public IP addresses.

    import * as pulumi from "@pulumi/pulumi";
import * as lacework from "@pulumi/lacework";

const example = new lacework.Query("example", {
    query: `  {
      source {
          LW_CFG_AWS_EC2_INSTANCES
      }
      filter {
          value_exists(RESOURCE_CONFIG:PublicIpAddress)
      }
      return distinct {
          ACCOUNT_ALIAS,
          ACCOUNT_ID,
          ARN as RESOURCE_KEY,
          RESOURCE_REGION,
          RESOURCE_TYPE,
          SERVICE,
          case when RESOURCE_TYPE = 'ec2:instance' then 'HasPublicIp'
          end as COMPLIANCE_FAILURE_REASON
      }
  }

`,
    queryId: "TF_AWS_Config_EC2InstanceWithPublicIPAddress",
});

    import pulumi
import pulumi_lacework as lacework

example = lacework.Query("example",
    query="""  {
      source {
          LW_CFG_AWS_EC2_INSTANCES
      }
      filter {
          value_exists(RESOURCE_CONFIG:PublicIpAddress)
      }
      return distinct {
          ACCOUNT_ALIAS,
          ACCOUNT_ID,
          ARN as RESOURCE_KEY,
          RESOURCE_REGION,
          RESOURCE_TYPE,
          SERVICE,
          case when RESOURCE_TYPE = 'ec2:instance' then 'HasPublicIp'
          end as COMPLIANCE_FAILURE_REASON
      }
  }

""",
    query_id="TF_AWS_Config_EC2InstanceWithPublicIPAddress")

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/lacework/v2/lacework"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := lacework.NewQuery(ctx, "example", &lacework.QueryArgs{
			Query: pulumi.String(`  {
      source {
          LW_CFG_AWS_EC2_INSTANCES
      }
      filter {
          value_exists(RESOURCE_CONFIG:PublicIpAddress)
      }
      return distinct {
          ACCOUNT_ALIAS,
          ACCOUNT_ID,
          ARN as RESOURCE_KEY,
          RESOURCE_REGION,
          RESOURCE_TYPE,
          SERVICE,
          case when RESOURCE_TYPE = 'ec2:instance' then 'HasPublicIp'
          end as COMPLIANCE_FAILURE_REASON
      }
  }

`),
			QueryId: pulumi.String("TF_AWS_Config_EC2InstanceWithPublicIPAddress"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Lacework = Pulumi.Lacework;

return await Deployment.RunAsync(() => 
{
    var example = new Lacework.Query("example", new()
    {
        Query = @"  {
      source {
          LW_CFG_AWS_EC2_INSTANCES
      }
      filter {
          value_exists(RESOURCE_CONFIG:PublicIpAddress)
      }
      return distinct {
          ACCOUNT_ALIAS,
          ACCOUNT_ID,
          ARN as RESOURCE_KEY,
          RESOURCE_REGION,
          RESOURCE_TYPE,
          SERVICE,
          case when RESOURCE_TYPE = 'ec2:instance' then 'HasPublicIp'
          end as COMPLIANCE_FAILURE_REASON
      }
  }

",
        QueryId = "TF_AWS_Config_EC2InstanceWithPublicIPAddress",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.lacework.Query;
import com.pulumi.lacework.QueryArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Query("example", QueryArgs.builder()
            .query("""
  {
      source {
          LW_CFG_AWS_EC2_INSTANCES
      }
      filter {
          value_exists(RESOURCE_CONFIG:PublicIpAddress)
      }
      return distinct {
          ACCOUNT_ALIAS,
          ACCOUNT_ID,
          ARN as RESOURCE_KEY,
          RESOURCE_REGION,
          RESOURCE_TYPE,
          SERVICE,
          case when RESOURCE_TYPE = 'ec2:instance' then 'HasPublicIp'
          end as COMPLIANCE_FAILURE_REASON
      }
  }

            """)
            .queryId("TF_AWS_Config_EC2InstanceWithPublicIPAddress")
            .build());

    }
}

    resources:
  example:
    type: lacework:Query
    properties:
      query: |2+
          {
              source {
                  LW_CFG_AWS_EC2_INSTANCES
              }
              filter {
                  value_exists(RESOURCE_CONFIG:PublicIpAddress)
              }
              return distinct {
                  ACCOUNT_ALIAS,
                  ACCOUNT_ID,
                  ARN as RESOURCE_KEY,
                  RESOURCE_REGION,
                  RESOURCE_TYPE,
                  SERVICE,
                  case when RESOURCE_TYPE = 'ec2:instance' then 'HasPublicIp'
                  end as COMPLIANCE_FAILURE_REASON
              }
          }

      queryId: TF_AWS_Config_EC2InstanceWithPublicIPAddress

    Query CloudTrail events and filter only S3 buckets with ACL ‘public-read’, ‘public-read-write’ or ‘authenticated-read’.

    import * as pulumi from "@pulumi/pulumi";
import * as lacework from "@pulumi/lacework";

const example = new lacework.Query("example", {
    query: `  {
      source {
          CloudTrailRawEvents
      }
      filter {
          EVENT_SOURCE = 's3.amazonaws.com'
          and EVENT_NAME = 'CreateBucket'
          and EVENT:requestParameters."x-amz-acl"
          in ('public-read', 'public-read-write', 'authenticated-read')
          and ERROR_CODE is null
      }
      return distinct {
          INSERT_ID,
          INSERT_TIME,
          EVENT_TIME,
          EVENT
      }
  }

`,
    queryId: "TF_AWS_CTA_S3PublicACLCreated",
});

    import pulumi
import pulumi_lacework as lacework

example = lacework.Query("example",
    query="""  {
      source {
          CloudTrailRawEvents
      }
      filter {
          EVENT_SOURCE = 's3.amazonaws.com'
          and EVENT_NAME = 'CreateBucket'
          and EVENT:requestParameters."x-amz-acl"
          in ('public-read', 'public-read-write', 'authenticated-read')
          and ERROR_CODE is null
      }
      return distinct {
          INSERT_ID,
          INSERT_TIME,
          EVENT_TIME,
          EVENT
      }
  }

""",
    query_id="TF_AWS_CTA_S3PublicACLCreated")

    package main

import (
	"github.com/pulumi/pulumi-terraform-provider/sdks/go/lacework/v2/lacework"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := lacework.NewQuery(ctx, "example", &lacework.QueryArgs{
			Query: pulumi.String(`  {
      source {
          CloudTrailRawEvents
      }
      filter {
          EVENT_SOURCE = 's3.amazonaws.com'
          and EVENT_NAME = 'CreateBucket'
          and EVENT:requestParameters."x-amz-acl"
          in ('public-read', 'public-read-write', 'authenticated-read')
          and ERROR_CODE is null
      }
      return distinct {
          INSERT_ID,
          INSERT_TIME,
          EVENT_TIME,
          EVENT
      }
  }

`),
			QueryId: pulumi.String("TF_AWS_CTA_S3PublicACLCreated"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Lacework = Pulumi.Lacework;

return await Deployment.RunAsync(() => 
{
    var example = new Lacework.Query("example", new()
    {
        Query = @"  {
      source {
          CloudTrailRawEvents
      }
      filter {
          EVENT_SOURCE = 's3.amazonaws.com'
          and EVENT_NAME = 'CreateBucket'
          and EVENT:requestParameters.""x-amz-acl""
          in ('public-read', 'public-read-write', 'authenticated-read')
          and ERROR_CODE is null
      }
      return distinct {
          INSERT_ID,
          INSERT_TIME,
          EVENT_TIME,
          EVENT
      }
  }

",
        QueryId = "TF_AWS_CTA_S3PublicACLCreated",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.lacework.Query;
import com.pulumi.lacework.QueryArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Query("example", QueryArgs.builder()
            .query("""
  {
      source {
          CloudTrailRawEvents
      }
      filter {
          EVENT_SOURCE = 's3.amazonaws.com'
          and EVENT_NAME = 'CreateBucket'
          and EVENT:requestParameters."x-amz-acl"
          in ('public-read', 'public-read-write', 'authenticated-read')
          and ERROR_CODE is null
      }
      return distinct {
          INSERT_ID,
          INSERT_TIME,
          EVENT_TIME,
          EVENT
      }
  }

            """)
            .queryId("TF_AWS_CTA_S3PublicACLCreated")
            .build());

    }
}

    resources:
  example:
    type: lacework:Query
    properties:
      query: |2+
          {
              source {
                  CloudTrailRawEvents
              }
              filter {
                  EVENT_SOURCE = 's3.amazonaws.com'
                  and EVENT_NAME = 'CreateBucket'
                  and EVENT:requestParameters."x-amz-acl"
                  in ('public-read', 'public-read-write', 'authenticated-read')
                  and ERROR_CODE is null
              }
              return distinct {
                  INSERT_ID,
                  INSERT_TIME,
                  EVENT_TIME,
                  EVENT
              }
          }

      queryId: TF_AWS_CTA_S3PublicACLCreated

    Create Query Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Query(name: string, args: QueryArgs, opts?: CustomResourceOptions);
    @overload
def Query(resource_name: str,
          args: QueryArgs,
          opts: Optional[ResourceOptions] = None)

@overload
def Query(resource_name: str,
          opts: Optional[ResourceOptions] = None,
          query: Optional[str] = None,
          query_id: Optional[str] = None,
          lacework_query_id: Optional[str] = None)
    func NewQuery(ctx *Context, name string, args QueryArgs, opts ...ResourceOption) (*Query, error)
    public Query(string name, QueryArgs args, CustomResourceOptions? opts = null)
    public Query(String name, QueryArgs args)
public Query(String name, QueryArgs args, CustomResourceOptions options)

    type: lacework:Query
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args QueryArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args QueryArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args QueryArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args QueryArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args QueryArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var queryResource = new Lacework.Query("queryResource", new()
{
    Query = "string",
    QueryId = "string",
    LaceworkQueryId = "string",
});

    example, err := lacework.NewQuery(ctx, "queryResource", &lacework.QueryArgs{
	Query:           pulumi.String("string"),
	QueryId:         pulumi.String("string"),
	LaceworkQueryId: pulumi.String("string"),
})

    var queryResource = new Query("queryResource", QueryArgs.builder()
    .query("string")
    .queryId("string")
    .laceworkQueryId("string")
    .build());

    query_resource = lacework.Query("queryResource",
    query="string",
    query_id="string",
    lacework_query_id="string")

    const queryResource = new lacework.Query("queryResource", {
    query: "string",
    queryId: "string",
    laceworkQueryId: "string",
});

    type: lacework:Query
properties:
    laceworkQueryId: string
    query: string
    queryId: string

    Query Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Query resource accepts the following input properties:

    Query string
    The query string.
    QueryId string
    The query id.
    LaceworkQueryId string
    Query string
    The query string.
    QueryId string
    The query id.
    LaceworkQueryId string
    query String
    The query string.
    queryId String
    The query id.
    laceworkQueryId String
    query string
    The query string.
    queryId string
    The query id.
    laceworkQueryId string
    query str
    The query string.
    query_id str
    The query id.
    lacework_query_id str
    query String
    The query string.
    queryId String
    The query id.
    laceworkQueryId String

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Query resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Owner string
    ResultSchema string
    UpdatedBy string
    UpdatedTime string
    Id string
    The provider-assigned unique ID for this managed resource.
    Owner string
    ResultSchema string
    UpdatedBy string
    UpdatedTime string
    id String
    The provider-assigned unique ID for this managed resource.
    owner String
    resultSchema String
    updatedBy String
    updatedTime String
    id string
    The provider-assigned unique ID for this managed resource.
    owner string
    resultSchema string
    updatedBy string
    updatedTime string
    id str
    The provider-assigned unique ID for this managed resource.
    owner str
    result_schema str
    updated_by str
    updated_time str
    id String
    The provider-assigned unique ID for this managed resource.
    owner String
    resultSchema String
    updatedBy String
    updatedTime String

    Look up Existing Query Resource

    Get an existing Query resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: QueryState, opts?: CustomResourceOptions): Query
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        lacework_query_id: Optional[str] = None,
        owner: Optional[str] = None,
        query: Optional[str] = None,
        query_id: Optional[str] = None,
        result_schema: Optional[str] = None,
        updated_by: Optional[str] = None,
        updated_time: Optional[str] = None) -> Query
    func GetQuery(ctx *Context, name string, id IDInput, state *QueryState, opts ...ResourceOption) (*Query, error)
    public static Query Get(string name, Input<string> id, QueryState? state, CustomResourceOptions? opts = null)
    public static Query get(String name, Output<String> id, QueryState state, CustomResourceOptions options)
    resources:  _:    type: lacework:Query    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    LaceworkQueryId string
    Owner string
    Query string
    The query string.
    QueryId string
    The query id.
    ResultSchema string
    UpdatedBy string
    UpdatedTime string
    LaceworkQueryId string
    Owner string
    Query string
    The query string.
    QueryId string
    The query id.
    ResultSchema string
    UpdatedBy string
    UpdatedTime string
    laceworkQueryId String
    owner String
    query String
    The query string.
    queryId String
    The query id.
    resultSchema String
    updatedBy String
    updatedTime String
    laceworkQueryId string
    owner string
    query string
    The query string.
    queryId string
    The query id.
    resultSchema string
    updatedBy string
    updatedTime string
    lacework_query_id str
    owner str
    query str
    The query string.
    query_id str
    The query id.
    result_schema str
    updated_by str
    updated_time str
    laceworkQueryId String
    owner String
    query String
    The query string.
    queryId String
    The query id.
    resultSchema String
    updatedBy String
    updatedTime String

    Import

    A Lacework query can be imported using a QUERY_ID, e.g.

    $ pulumi import lacework:index/query:Query example YourLQLQueryID

    -> Note: To retrieve the QUERY_ID from existing queries in your account, use the Lacework CLI command lacework query list. To install this tool follow this documentation.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    lacework lacework/terraform-provider-lacework
    License
    Notes
    This Pulumi package is based on the lacework Terraform Provider.
    lacework logo
    lacework 2.0.6 published on Monday, Apr 14, 2025 by lacework
    lacework/terraform-provider-lacework