v0.8.0: Mod Variables, Tags & Syntax Highlighting

select
  region,
  instance_state as state,
  instance_type as type
from
  aws_ec2_instance;

+-----------+---------+-----------+
| region    | state   | type      |
+-----------+---------+-----------+
| eu-west-1 | running | t3.medium |
| eu-west-2 | running | m5a.large |
| us-east-1 | running | t3.large  |
+-----------+---------+-----------+
        

tl;dr

→ Variables & Query Parameters in Mods.
→ Tags, Tags, Tags!
→ Syntax highlighting in the CLI.
→ 12 new plugins and mods.
→ Even more goodies in the full release notes.

Variables & Query Parameters in Mods

Variables allow values to be passed to mods at runtime, for customization of queries, controls and more. Variables can be set via the .spvar files, CLI options and environment variables.

Query parameters are a safe way (no SQL injection here!) to pass values to queries. They are typically combined with variables to support a range of queries based on user input.

Here is a simple variable definition for instance_state. It is a string with a default value of stopped:

variable "instance_state" {
  type    = string
  default = "stopped"
}

Here is a query with a single parameter called state. Queries are compiled into Postgres prepared statements so they use the positional argument syntax of $1. Because state is the first param block, it will be automatically mapped to $1. The default value for state uses the variable defined above.

query "instances_in_state" {
  sql = "select instance_id, instance_state from aws_ec2_instance where instance_state = $1;"
  param "state" {
    default = var.instance_state
  }
}

We can run this query as normal (using default values):

$ steampipe query query.instances_in_state
+-------------+----------------+
| instance_id | instance_state |
+-------------+----------------+
| i-aaaa1111  | stopped        |
+-------------+----------------+

Or pass in the instance_state parameter to modify the query:

$ steampipe query query.instances_in_state --var=instance_state="running"
+-------------+----------------+
| instance_id | instance_state |
+-------------+----------------+
| i-bbbb2222  | running        |
+-------------+----------------+

This combination makes brings a huge amount of new flexibility to mods, check out the docs to learn about:

• Using Variables
• Passing Parameters

Tags, Tags, Tags!

We've published tagging control mods for AWS, Azure and GCP - leveraging the new variables so you can easily customize the checks to your local requirements.

Each mod has benchmarks for:

• Find untagged resources.
• Ensure mandatory tags are set (e.g. Owner).
• Find prohibited tags (e.g. Password).
• Detect when the tag limit is nearly reached.

Find untagged resources in your AWS account:

git clone https://github.com/turbot/steampipe-mod-aws-tags
cd steampipe-mod-aws-tags
steampipe check benchmark.untagged

Using variables, tagging controls can be easily customized to your needs. For example, check for mandatory tags relevant to your environment:

steampipe check benchmark.mandatory --var 'mandatory_tags=["Application", "Environment", "Department", "Owner"]'

Syntax highlighting

The Steampipe CLI now includes syntax highlighting, making queries even easier to read and edit:

New plugins and mods

Beyond the CLI, since our last release, we've added 6 new plugins:

• Azure Active Directory - query groups, service principals, users, etc
• GitLab - query projects, issues, branches, etc
• Google Directory - query users, domains, groups, etc
• Google Workspace - query calendar events, drive files, gmail messages, etc
• Linode - query instances, domains, users, etc
• Okta - query users, groups, applications, etc

We've also expanded our mods, including:

• Alibaba Cloud Thrifty mod
• AWS Tags mod
• Azure Tags mod
• DigitalOcean Thrifty mod
• GCP Labels mod
• Oracle Cloud Thrifty mod

Let’s get building!

Steampipe now delivers a full suite of tools to build, execute and share cloud configuration, compliance, and security frameworks using SQL, HCL and a little elbow grease! We would love your help to expand the open source documentation and control coverage for CIS, PCI, HIPAA, NIST… and the best way to get started is to join our new Slack workspace and raise your hand; we would love to talk to you!

For even more good stuff in v0.8.0, checkout the full release notes on GitHub.