Security Cipher
Home Blog About Us
Resources ▼
🗺️ Penetration Testing Roadmap 🌐 Web Application Security Checklist 🤖 OWASP Top 10 for LLM Applications 🧠 LLM AI Security Checklist 🛠️ Security Tools 🎯 Penetration Testing Tricks 📄 Secure Code Explain 📖 Vulnerability Explain ☁️ AWS Cloud Security Checklist
My Resume
Contact UsContact
← Security Tools View on GitHub

steampipe

Query cloud APIs, security posture and configuration using SQL.

Steampipe Logo

plugins   slack   maintained by

select * from cloud;

Steampipe is the zero-ETL way to query APIs and services. Use it to expose data sources to SQL.

SQL. It's been the data access standard for decades.

Live data. Query APIs in real-time.

Speed. Query APIs faster than you ever thought possible.

Concurrency. Query many data sources in parallel.

Single binary. Use it locally, deploy it in CI/CD pipelines.

Demo time!

steampipe demo

Documentation

See the documentation for:

  • Running queries
  • Managing Steampipe
  • CLI commands
  • Integrations
  • Developing plugins

Install Steampipe

Install Steampipe from the downloads page:

# MacOS
brew install turbot/tap/steampipe
# Linux or Windows (WSL2)
sudo /bin/sh -c "$(curl -fsSL https://steampipe.io/install/steampipe.sh)"

Install a plugin for your favorite service (e.g. AWS, Azure, GCP, GitHub, Kubernetes, Hacker News, etc):

steampipe plugin install hackernews

Query!

steampipe query
> select * from hackernews_new limit 10

Steampipe plugins

The Steampipe community has grown a suite of plugins that map APIs to database tables. Plugins are available for AWS, Azure, GCP, Kubernetes, GitHub, Microsoft 365, Salesforce, and many more.

There are more than 2000 tables in all, each clearly documented with copy/paste/run examples.

Steampipe distributions

Plugins are available in these distributions.

Steampipe CLI. Run queries that translate APIs to tables in the Postgres instance that's bundled with Steampipe.

Steampipe Postgres FDWs. Use native Postgres Foreign Data Wrappers to translate APIs to foreign tables.

Steampipe SQLite extensions. Use SQLite extensions to translate APIS to SQLite virtual tables.

Steampipe export tools. Use standalone binaries that export data from APIs, no database required.

Turbot Pipes. Use Turbot Pipes to run Steampipe in the cloud.

Developing

If you want to help develop the core Steampipe binary, these are the steps to build it.

Clone
git clone git@github.com:turbot/steampipe
Build
cd steampipe
make

The Steampipe binary lands in /usr/local/bin/steampipe directory unless you specify an alternate OUTPUT_DIR.

Check the version
$ steampipe --version
steampipe version 0.22.0
Install a plugin
$ steampipe plugin install steampipe
Run your first query

Try it!

steampipe query
> .inspect steampipe
+-----------------------------------+-----------------------------------+
| TABLE                             | DESCRIPTION                       |
+-----------------------------------+-----------------------------------+
| steampipe_registry_plugin         | Steampipe Registry Plugins        |
| steampipe_registry_plugin_version | Steampipe Registry Plugin Version |
+-----------------------------------+-----------------------------------+

> select * from steampipe_registry_plugin;

If you're interested in developing Steampipe plugins, see our documentation for plugin developers.

Turbot Pipes

Bring your team to Turbot Pipes to use Steampipe together in the cloud. In a Pipes workspace you can use Steampipe for data access, Powerpipe to visualize query results, and Flowpipe to automate workflow.

Open source and contributing

This repository is published under the AGPL 3.0 license. Please see our code of conduct. Contributors must sign our Contributor License Agreement as part of their first pull request. We look forward to collaborating with you!

Steampipe is a product produced from this open source software, exclusively by Turbot HQ, Inc. It is distributed under our commercial terms. Others are allowed to make their own distribution of the software, but cannot use any of the Turbot trademarks, cloud services, etc. You can learn more in our Open Source FAQ.

Get involved

Join #steampipe on Slack →

Press Escape to close the search panel.

Donate

Buy me a Coffee

Penetration Testing Services - Fiverr

Buy me a Coffee

Penetration Testing Services

penetration Testing Services

Web Application Security Quiz

Web Application Security Quiz

Daily Bug Bounty Writeups - Twitter

Daily Bug Bounty Writeups

Download our Latest Android Application

Guide for Penetration Testing

Daily Bug Bounty Writeups - Telegram

Daily Bug Bounty Writeups

Author

Piyush
Senior Product Security Engineer

Ethical Hacker || Penetration Tester || Gamer || Blogger || Application Security Engineer

READ ARTICLE

Donate

Buy me a Coffee

Recent Posts

  • Software Supply Chain Security in 2026: Packages, Pipelines, and Provenance
    Software Supply Chain Security in 2026: Packages, Pipelines, and Provenance
    August 10, 2026/
    0 Comments
  • I Ran Codex Security on a Shop API Lab: 14 Bugs, $1.64, Full Playbook
    I Ran Codex Security on a Shop API Lab: 14 Bugs, $1.64, Full Playbook
    August 3, 2026/
    0 Comments
  • How I Would Hack Your Startup in 24 Hours (Real-World Pentest Guide)
    How I Would Hack Your Startup in 24 Hours (Real-World Pentest Guide)
    July 27, 2026/
    0 Comments

Follow Us

SecurityCipher

Practical security guides, vulnerability deep-dives, and hands-on resources for bug bounty hunters and penetration testers.

Useful Links

  • Start Here
  • Cybersecurity Jobs
  • CVE Lookup
  • Bug Bounty Programs
  • Security Conferences
  • Payload Cheatsheets
  • Interview Prep
  • Report Templates
  • Blogs
  • About
  • Contact
  • RSS Feed

Recent Post

  • Software Supply Chain Security in 2026: Packages, Pipelines, and Provenance
  • I Ran Codex Security on a Shop API Lab: 14 Bugs, $1.64, Full Playbook
  • How I Would Hack Your Startup in 24 Hours (Real-World Pentest Guide)
© 2026 SecurityCipher. All rights reserved. Privacy Policies · Terms & Conditions