Steampipe — Query Cloud APIs Live with SQL

What it is

Steampipe is an open-source tool that exposes cloud and SaaS APIs as PostgreSQL foreign tables using a custom Foreign Data Wrapper. Instead of stitching together AWS CLI, kubectl, and GitHub scripts, operators run SQL queries and joins across providers to answer audit and inventory questions in seconds.

Steampipe targets cloud engineers, security teams, and SREs who need to query infrastructure state across multiple providers without writing custom API integration code.

How it saves time or tokens

Steampipe replaces dozens of provider-specific CLI commands and scripts with a single SQL interface. Cross-provider queries that would require custom glue code become simple SQL joins. The built-in Mods provide pre-packaged benchmark queries for CIS, PCI, and HIPAA compliance, saving weeks of audit preparation. Response caching keeps queries cheap and rate-limit friendly.

How to use

1. Install Steampipe:

brew install turbot/tap/steampipe

1. Add plugins for your cloud providers:

steampipe plugin install aws github kubernetes

1. Run ad-hoc queries:

steampipe query 'select name, region from aws_s3_bucket where versioning_enabled = false'

1. Or use the interactive shell:

steampipe query

Example

Cross-provider audit query joining AWS and GitHub data:

-- Find S3 buckets without encryption
SELECT name, region, server_side_encryption_configuration
FROM aws_s3_bucket
WHERE server_side_encryption_configuration IS NULL;

-- Cross-provider: find GitHub repos with AWS credentials in secrets
SELECT r.full_name, s.name as secret_name
FROM github_repository r
JOIN github_actions_secret s ON r.full_name = s.repository_full_name
WHERE s.name LIKE '%AWS%';

Running a CIS benchmark:

steampipe check benchmark.cis_v150

Related on TokRepo

• Database tools — SQL-based query and data tools
• Security tools — cloud security and compliance auditing

Common pitfalls

• Queries without WHERE clauses on large AWS accounts trigger hundreds of API calls; always filter by region or specific resource attributes
• Plugin authentication reuses existing cloud credentials (AWS profiles, kubeconfig); ensure your local credentials have read access to the resources you query
• The Postgres wire protocol mode (port 9193) is useful for BI tool integration but requires running steampipe service start as a background process