steampipe-plugin-sdk VS steampipe-plugin-aws

🔧 The CLI is written in Go, as well as the Steampipe Plugins connecting to various APIs like AWS, GitHub, Zoom, Reddit, and 130+ more. https://hub.steampipe.io/plugins

It's fully open source with a thriving community of users and contributors. As of today, there are 111 plugins (including AWS & Azure). We also have thousands of open source queries, security benchmarks, resource graphs and dashboards available out of the box as mods. See the Steampipe Hub for full docs and details.

Steampipe is free, open source. It's a CLI used to SQL query & report across all your cloud APIs & data sources (e.g. AWS, GitHub, Slack, Kubernetes, Terraform, etc) along with a dashboards-as-code capability to run automated security & compliance benchmarks. Allows you to simply query & report without the overhead for log ingestion, ETL or a DB.

For some background, the Steampipe CLI provides an open source, common SQL interface to query join and report from your cloud APIs (e.g. Azure, AWS, GitHub, AzureAD, M365, etc).

Not the author, but a big fan of steampipe. You can use this example as a starting point to write integrations with a number of other services that are supported by steampipe plugins.

Since Steampipe provides a common SQL interface across plugins, there could be interesting 'joins' that you can do for querying & reporting -- any interesting joins you would consider across SPO, M365 or other plugins?

The CLI is written primarily in Go, as well as its plugins (e.g. AWS, GitHub, Slack, Zoom, Reddit, etc): https://hub.steampipe.io/plugins. You can extend an existing plugin by adding new 'tables', or you can write your own plugin for your favorite cloud service.

be mindful of its AGPLv3 https://github.com/turbot/steampipe/blob/v0.21.8/LICENSE (AFAIK v0.4.3 is the last MIT release https://github.com/turbot/steampipe/blob/v0.4.3/LICENSE ) and the actual providers are Apache 2 <https://github.com/turbot/steampipe-plugin-aws/blob/v0.131.0...> (but I don't know if provider drift makes them compatible with 0.4 or not)

iasql seems to be AWS only, but good for them for taking this on:

It's a very similar approach querying any of the plugins (AWS, Azure, etc) as it's a common interface to query those APIs with SQL. The AWS plugin is one of the more widely used in the community, along with it's associated mods to visualize resources and compliance to security & ops benchmarks.

~$ steampipe plugin install aws aws [====================================================================] Done Installed plugin: aws@latest v0.78.0 Documentation: https://hub.steampipe.io/plugins/turbot/aws

Setting up CloudTrail is essential to understanding your users' AWS API activity: what happened, by whom and from where. One field in the event logs is source IP address. But that doesn't tell you where in the world those AWS API actions are coming from. In this post we'll show how to use Steampipe with the AWS and ipstack plugins to enrich your CloudTrail events with location information.

In my last post I showed how to install Steampipe and use it to instantly query your AWS APIs using SQL right in AWS CloudShell. For example here's a query that uses the Steampipe AWS plugin to query which AWS IAM users have MFA enabled:

It takes just a few seconds to install Steampipe itself, along with the AWS plugin that maps AWS API calls to Postgres tables.

Hint: We actually have some aws_cost_* tables in active development in this branch. Not ready for release yet, but we're excited about how they are coming together!