Skip to content

CloudTrail  >  Operations  >  generate_query

generate_query

Operation

generate_query async

generate_query(input: GenerateQueryInput, plugins: list[Plugin] | None = None) -> GenerateQueryOutput
Warning

CloudTrail Lake will no longer be open to new customers starting May 31, 2026. If you would like to use CloudTrail Lake, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see CloudTrail Lake availability change.

Generates a query from a natural language prompt. This operation uses generative artificial intelligence (generative AI) to produce a ready-to-use SQL query from the prompt.

The prompt can be a question or a statement about the event data in your event data store. For example, you can enter prompts like "What are my top errors in the past month?" and "Give me a list of users that used SNS."

The prompt must be in English. For information about limitations, permissions, and supported Regions, see Create CloudTrail Lake queries from natural language prompts in the CloudTrail user guide.

Note

Do not include any personally identifying, confidential, or sensitive information in your prompts.

This feature uses generative AI large language models (LLMs); we recommend double-checking the LLM response.

Parameters:

Name Type Description Default
input GenerateQueryInput

An instance of GenerateQueryInput.

required
plugins list[Plugin] | None

A list of callables that modify the configuration dynamically. Changes made by these plugins only apply for the duration of the operation execution and will not affect any other operation invocations.

None

Returns:

Type Description
GenerateQueryOutput

An instance of GenerateQueryOutput.

Input

GenerateQueryInput dataclass

Dataclass for GenerateQueryInput structure.

Attributes

event_data_stores class-attribute instance-attribute
event_data_stores: list[str] | None = None

The ARN (or ID suffix of the ARN) of the event data store that you want to query. You can only specify one event data store.

prompt class-attribute instance-attribute
prompt: str | None = None

The prompt that you want to use to generate the query. The prompt must be in English. For example prompts, see Example prompts in the CloudTrail user guide.

Output

GenerateQueryOutput dataclass

Dataclass for GenerateQueryOutput structure.

Attributes

event_data_store_owner_account_id class-attribute instance-attribute
event_data_store_owner_account_id: str | None = None

The account ID of the event data store owner.

query_alias class-attribute instance-attribute
query_alias: str | None = None

An alias that identifies the prompt. When you run the StartQuery operation, you can pass in either the QueryAlias or QueryStatement parameter.

query_statement class-attribute instance-attribute
query_statement: str | None = None

The SQL query statement generated from the prompt.

response_metadata class-attribute instance-attribute
response_metadata: ResponseMetadata = field(default=EMPTY_RESPONSE_METADATA, repr=False, compare=False)

Metadata about the response that produced this output. Use this to recover the request identifiers a service's support team needs in order to investigate a call. Members of the metadata are individually optional.