SQL

- ref: recent_logins
  action: core.sql.execute_query
  args:
    query: |
      SELECT user_email, last_login_at
      FROM user_logins
      WHERE last_login_at >= :cutoff
      ORDER BY last_login_at DESC
    bound_params:
      cutoff: ${{ TRIGGER.cutoff }}
    max_rows: 100

- ref: aggregate_results
  action: core.duckdb.execute_sql
  args:
    sql: |
      WITH findings(id, severity) AS (
        VALUES (1, 'high'), (2, 'low'), (3, 'high')
      )
      SELECT severity, count(*) AS count
      FROM findings
      GROUP BY severity
      ORDER BY count DESC

# Attach the amazon_s3 secret (static keys or AWS_ROLE_ARN for AssumeRole).
- ref: read_s3
  action: core.duckdb.execute_sql
  args:
    sql: |
      SELECT *
      FROM read_parquet('s3://my-bucket/findings/*.parquet')

# role_arn chains from the amazon_s3 credentials into a role in the
# bucket's account. region_name is the bucket's region and overrides the
# secret's AWS_REGION, so one secret can read buckets in several regions.
- ref: read_audit_logs
  action: core.duckdb.execute_sql
  args:
    role_arn: arn:aws:iam::123456789012:role/log-reader
    region_name: us-west-2
    sql: |
      SELECT action, count(*) AS events
      FROM read_json(
        's3://my-audit-logs/2026/01/01/*/*.json.gz',
        format = 'newline_delimited',
        compression = 'gzip'
      )
      GROUP BY action