CloudTrail / Client / list_queries

list_queries

CloudTrail.Client.list_queries(**kwargs)

Warning

CloudTrail Lake will no longer be open to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see CloudTrail Lake availability change.

Returns a list of queries and query statuses for the past seven days. You must specify an ARN value for EventDataStore. Optionally, to shorten the list of results, you can specify a time range, formatted as timestamps, by adding StartTime and EndTime parameters, and a QueryStatus value. Valid values for QueryStatus include QUEUED, RUNNING, FINISHED, FAILED, TIMED_OUT, or CANCELLED.

See also: AWS API Documentation

Request Syntax

response = client.list_queries(
    EventDataStore='string',
    NextToken='string',
    MaxResults=123,
    StartTime=datetime(2015, 1, 1),
    EndTime=datetime(2015, 1, 1),
    QueryStatus='QUEUED'|'RUNNING'|'FINISHED'|'FAILED'|'CANCELLED'|'TIMED_OUT'
)
Parameters:

  • EventDataStore (string) –

    [REQUIRED]

    The ARN (or the ID suffix of the ARN) of an event data store on which queries were run.

  • NextToken (string) – A token you can use to get the next page of results.

  • MaxResults (integer) – The maximum number of queries to show on a page.

  • StartTime (datetime) – Use with EndTime to bound a ListQueries request, and limit its results to only those queries run within a specified time period.

  • EndTime (datetime) – Use with StartTime to bound a ListQueries request, and limit its results to only those queries run within a specified time period.

  • QueryStatus (string) – The status of queries that you want to return in results. Valid values for QueryStatus include QUEUED, RUNNING, FINISHED, FAILED, TIMED_OUT, or CANCELLED.

Return type:

dict

Returns:

Response Syntax

{
    'Queries': [
        {
            'QueryId': 'string',
            'QueryStatus': 'QUEUED'|'RUNNING'|'FINISHED'|'FAILED'|'CANCELLED'|'TIMED_OUT',
            'CreationTime': datetime(2015, 1, 1)
        },
    ],
    'NextToken': 'string'
}

Response Structure

  • (dict) –

    • Queries (list) –

      Lists matching query results, and shows query ID, status, and creation time of each query.

      • (dict) –

        A SQL string of criteria about events that you want to collect in an event data store.

        • QueryId (string) –

          The ID of a query.

        • QueryStatus (string) –

          The status of the query. This can be QUEUED, RUNNING, FINISHED, FAILED, TIMED_OUT, or CANCELLED.

        • CreationTime (datetime) –

          The creation time of a query.

    • NextToken (string) –

      A token you can use to get the next page of results.

Exceptions

  • CloudTrail.Client.exceptions.EventDataStoreARNInvalidException

  • CloudTrail.Client.exceptions.EventDataStoreNotFoundException

  • CloudTrail.Client.exceptions.InactiveEventDataStoreException

  • CloudTrail.Client.exceptions.InvalidDateRangeException

  • CloudTrail.Client.exceptions.InvalidMaxResultsException

  • CloudTrail.Client.exceptions.InvalidNextTokenException

  • CloudTrail.Client.exceptions.InvalidParameterException

  • CloudTrail.Client.exceptions.InvalidQueryStatusException

  • CloudTrail.Client.exceptions.OperationNotPermittedException

  • CloudTrail.Client.exceptions.UnsupportedOperationException

  • CloudTrail.Client.exceptions.NoManagementAccountSLRExistsException