Official

Premium

env zero source integration documentation

Name: CloudQuery env zero Integration
Author: CloudQuery

This plugin is in preview.

The CloudQuery env zero (env0) plugin extracts Infrastructure-as-Code platform data - organizations, projects, environments, deployments, modules, templates, cloud accounts, and more - and loads it into any supported CloudQuery destination (e.g. PostgreSQL, BigQuery, Snowflake, and more).

Publisher

cloudquery

Latest version

v3.0.0

Type

Source

Platforms

Date Published

Start Syncing

Overview Licenses

Overview #

envzero Source Plugin

The CloudQuery env zero plugin extracts Infrastructure-as-Code platform data from env zero - organizations, projects, environments, deployments, modules, templates, cloud accounts, and more - and loads it into any supported CloudQuery destination (e.g. PostgreSQL, BigQuery, Snowflake, and more).

Authentication #

The env zero source plugin authenticates using an API Key ID and API Key Secret pair. env zero verifies API requests via HTTP Basic authentication with the API Key ID as the username and the API Key Secret as the password.

You can create either an organization-scoped key (under Organization Settings > API Keys) or a personal key (under Personal Settings > API Keys). The key needs read access to the resources you want to sync.

Set both fields in the plugin spec:

spec:
  api_key_id: "${ENVZERO_API_KEY_ID}"
  api_key_secret: "${ENVZERO_API_KEY_SECRET}"

We recommend using environment variable expansion to avoid storing credentials in plain text.

Configuration #

This example syncs from env zero to a single destination. The (top level) source spec section is described in the Source Spec Reference.

kind: source
spec:
  name: "envzero"
  path: "cloudquery/envzero"
  registry: "cloudquery"
  version: "v3.0.0"
  tables: ["*"]
  destinations: ["postgresql"]
  spec:
    api_key_id: "${ENVZERO_API_KEY_ID}"
    api_key_secret: "${ENVZERO_API_KEY_SECRET}"

This example uses environment variable expansion to read the credentials from environment variables.

By default, the plugin syncs only the 100 most-recent deployments per environment (and, transitively, their resources) so that the first sync completes quickly. To sync the full deployment history, or to adjust the limit, use table_options:

    spec:
      api_key_id: "${ENVZERO_API_KEY_ID}"
      api_key_secret: "${ENVZERO_API_KEY_SECRET}"
      table_options:
        envzero_deployments:
          max_per_environment: 0 # 0 = full history; omit for the default of 100

The deployment cap applies to every full sync, not just the first. To keep syncs fast on the first run while still accumulating every new deployment over time, configure backend_options so subsequent syncs are incremental (and therefore uncapped). Without a backend, every sync is a full sync and envzero_deployments stays capped at max_per_environment on every run.

The recommended setup for most users combines a state backend with the default cap, optionally narrowed by a filter:

kind: source
spec:
  name: "envzero"
  path: "cloudquery/envzero"
  registry: "cloudquery"
  version: "v3.0.0"
  tables: ["*"]
  destinations: ["postgresql"]
  backend_options:
    table_name: "cq_state_envzero"
    connection: "@@plugins.postgresql.connection"
  spec:
    api_key_id: "${ENVZERO_API_KEY_ID}"
    api_key_secret: "${ENVZERO_API_KEY_SECRET}"
    table_options:
      envzero_deployments:
        deployment_types: ["deploy", "destroy"]

envzero Spec #

This is the (nested) spec used by the env zero source plugin.

api_key_id (string) (required)
The env zero API Key ID, used as the HTTP Basic auth username.
api_key_secret (string) (required)
The env zero API Key Secret, used as the HTTP Basic auth password.
host (string, optional, default: https://api.env0.com)
The base URL of the envzero API. Override this only for self-hosted or proxied env zero deployments.
organization_id (string, optional)
Restrict the sync to a single env zero organization by ID. If left empty, the plugin discovers every organization the API key can see and fans out across all of them.
project_ids ([]string, optional)
Restrict the sync to a subset of env zero projects by ID. Leave empty to sync all projects accessible to the API key.
concurrency (integer, optional, default: 500)
A best effort maximum number of Go routines to use. Lower this number to reduce memory usage.
scheduler (string, optional, default: dfs)
The scheduler to use when determining the priority of resources to sync. Supported values are dfs (depth-first search), round-robin, shuffle and shuffle-queue.
For more information on this, see performance tuning.
table_options (object, optional)
Per-table sync options. envzero_deployments defaults to the 100 most-recent deployments per environment (max_per_environment: 0 for full history); the cap applies to every full sync, so configure backend_options for incremental, uncapped syncs. See the envzero_deployments table docs for all options.

Example Queries #

List active environments by organization #

SELECT
    e.organization_id,
    e.project_id,
    e.name,
    e.status,
    e.workspace_name,
    e.created_at,
    e.updated_at
FROM envzero_environments e
WHERE e.is_archived IS FALSE
ORDER BY e.organization_id, e.updated_at DESC;

Most recent deployments per environment #

SELECT DISTINCT ON (d.environment_id)
    d.environment_id,
    d.id            AS deployment_id,
    d.type,
    d.status,
    d.started_at,
    d.finished_at,
    d.started_by_user->>'email' AS started_by
FROM envzero_deployments d
ORDER BY d.environment_id, d.started_at DESC;

Failed deployments in the last 7 days #

SELECT
    d.environment_id,
    d.type,
    d.status,
    d.started_at,
    d.failed_command,
    d.error
FROM envzero_deployments d
WHERE d.status IN ('FAILURE', 'TIMEOUT', 'INTERNAL_FAILURE')
  AND d.started_at > NOW() - INTERVAL '7 days'
ORDER BY d.started_at DESC;

Resource counts per environment #

SELECT
    e.name AS environment_name,
    e.organization_id,
    COUNT(r.*) AS resource_count
FROM envzero_environments e
LEFT JOIN envzero_deployments d ON d.environment_id = e.id
LEFT JOIN envzero_deployment_resources r ON r.deployment_id = d.id
GROUP BY e.id, e.name, e.organization_id
ORDER BY resource_count DESC NULLS LAST;

Drift summary across environments #

SELECT
    drift_status,
    COUNT(*) AS environment_count
FROM envzero_environments
GROUP BY drift_status
ORDER BY environment_count DESC;

Cloud accounts by provider #

SELECT
    provider,
    COUNT(*) AS account_count
FROM envzero_cloud_accounts
GROUP BY provider
ORDER BY account_count DESC;

Modules with their author #

SELECT
    m.module_name,
    m.module_provider,
    m.repository,
    m.organization_id,
    m.author->>'email' AS author_email
FROM envzero_modules m
ORDER BY m.organization_id, m.module_name;

Approval policies and where they are scoped #

SELECT
    p.id,
    p.name,
    p.organization_id,
    p.repository,
    p.path,
    p.created_at,
    p.updated_at
FROM envzero_approval_policies p
ORDER BY p.organization_id, p.name;

Teams per organization #

SELECT
    organization_id,
    COUNT(*) AS team_count
FROM envzero_organization_teams
GROUP BY organization_id
ORDER BY team_count DESC;

Templates by VCS connection #

SELECT
    t.organization_id,
    t.repository,
    COUNT(*) AS template_count
FROM envzero_templates t
GROUP BY t.organization_id, t.repository
ORDER BY template_count DESC;

Licenses #

The following tools / packages are used in this plugin:

Name	License
github.com/adrg/xdg	MIT
github.com/apache/arrow-go/v18	Apache-2.0
github.com/apache/arrow-go/v18	BSD-3-Clause
github.com/apache/arrow/go/v13	Apache-2.0
github.com/apache/arrow/go/v13	BSL-1.0
github.com/apache/arrow/go/v13	MIT
github.com/apache/arrow/go/v13	BSD-2-Clause
github.com/apache/arrow/go/v13	BSD-3-Clause
github.com/apache/arrow/go/v13	LicenseRef-C-Ares
github.com/apache/arrow/go/v13	OpenSSL
github.com/apache/arrow/go/v13	Zlib
github.com/apache/arrow/go/v13	NCSA
github.com/apapsch/go-jsonmerge/v2	MIT
github.com/aws/aws-sdk-go-v2	Apache-2.0
github.com/aws/aws-sdk-go-v2/config	Apache-2.0
github.com/aws/aws-sdk-go-v2/credentials	Apache-2.0
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	Apache-2.0
github.com/aws/aws-sdk-go-v2/internal/configsources	Apache-2.0
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	Apache-2.0
github.com/aws/aws-sdk-go-v2/internal/sync/singleflight	BSD-3-Clause
github.com/aws/aws-sdk-go-v2/internal/v4a	Apache-2.0
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	Apache-2.0
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	Apache-2.0
github.com/aws/aws-sdk-go-v2/service/licensemanager	Apache-2.0
github.com/aws/aws-sdk-go-v2/service/marketplacemetering	Apache-2.0
github.com/aws/aws-sdk-go-v2/service/signin	Apache-2.0
github.com/aws/aws-sdk-go-v2/service/sso	Apache-2.0
github.com/aws/aws-sdk-go-v2/service/ssooidc	Apache-2.0
github.com/aws/aws-sdk-go-v2/service/sts	Apache-2.0
github.com/aws/smithy-go	Apache-2.0
github.com/aws/smithy-go/internal/sync/singleflight	BSD-3-Clause
github.com/aws/smithy-go/transport/http/protocol/internal/json/internal/stdlib	BSD-3-Clause
github.com/bahlo/generic-list-go	BSD-3-Clause
github.com/buger/jsonparser	MIT
github.com/cenkalti/backoff/v5	MIT
github.com/cespare/xxhash/v2	MIT
github.com/cloudquery/cloudquery-api-go	MPL-2.0
github.com/cloudquery/codegen/jsonschema/docs	MPL-2.0
github.com/cloudquery/plugin-pb-go	MPL-2.0
github.com/cloudquery/plugin-sdk/v2/internal/glob	MIT
github.com/cloudquery/plugin-sdk/v2/schema	MIT
github.com/cloudquery/plugin-sdk/v2/types	MPL-2.0
github.com/cloudquery/plugin-sdk/v4	MPL-2.0
github.com/cloudquery/plugin-sdk/v4/glob	MIT
github.com/cloudquery/plugin-sdk/v4/scalar	MIT
github.com/davecgh/go-spew/spew	ISC
github.com/getsentry/sentry-go	MIT
github.com/ghodss/yaml	MIT
github.com/ghodss/yaml	BSD-3-Clause
github.com/go-logr/logr	Apache-2.0
github.com/go-logr/stdr	Apache-2.0
github.com/goccy/go-json	MIT
github.com/google/flatbuffers/go	Apache-2.0
github.com/google/uuid	BSD-3-Clause
github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors	Apache-2.0
github.com/grpc-ecosystem/grpc-gateway/v2	BSD-3-Clause
github.com/hashicorp/go-cleanhttp	MPL-2.0
github.com/hashicorp/go-retryablehttp	MPL-2.0
github.com/invopop/jsonschema	MIT
github.com/klauspost/compress	MIT
github.com/klauspost/compress	Apache-2.0
github.com/klauspost/compress	BSD-3-Clause
github.com/klauspost/compress/internal/snapref	BSD-3-Clause
github.com/klauspost/compress/zstd/internal/xxhash	MIT
github.com/mattn/go-colorable	MIT
github.com/mattn/go-isatty	MIT
github.com/oapi-codegen/oapi-codegen/v2/pkg/securityprovider	Apache-2.0
github.com/oapi-codegen/runtime	Apache-2.0
github.com/pb33f/ordered-map/v2	Apache-2.0
github.com/pierrec/lz4/v4	BSD-3-Clause
github.com/pmezard/go-difflib/difflib	BSD-3-Clause
github.com/rs/zerolog	MIT
github.com/samber/lo	MIT
github.com/santhosh-tekuri/jsonschema/v6	Apache-2.0
github.com/spf13/cobra	Apache-2.0
github.com/spf13/pflag	BSD-3-Clause
github.com/stretchr/testify	MIT
github.com/thoas/go-funk	MIT
github.com/zeebo/xxh3	BSD-2-Clause
go.opentelemetry.io/auto/sdk	Apache-2.0
go.opentelemetry.io/otel	Apache-2.0
go.opentelemetry.io/otel	BSD-3-Clause
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp	Apache-2.0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp	BSD-3-Clause
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	Apache-2.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp	BSD-3-Clause
go.opentelemetry.io/otel/exporters/otlp/otlptrace	Apache-2.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace	BSD-3-Clause
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	Apache-2.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp	BSD-3-Clause
go.opentelemetry.io/otel/log	Apache-2.0
go.opentelemetry.io/otel/log	BSD-3-Clause
go.opentelemetry.io/otel/metric	Apache-2.0
go.opentelemetry.io/otel/metric	BSD-3-Clause
go.opentelemetry.io/otel/sdk	Apache-2.0
go.opentelemetry.io/otel/sdk	BSD-3-Clause
go.opentelemetry.io/otel/sdk/log	Apache-2.0
go.opentelemetry.io/otel/sdk/log	BSD-3-Clause
go.opentelemetry.io/otel/sdk/metric	Apache-2.0
go.opentelemetry.io/otel/sdk/metric	BSD-3-Clause
go.opentelemetry.io/otel/trace	Apache-2.0
go.opentelemetry.io/otel/trace	BSD-3-Clause
go.opentelemetry.io/proto/otlp	Apache-2.0
go.yaml.in/yaml/v4	MIT
golang.org/x/exp	BSD-3-Clause
golang.org/x/net	BSD-3-Clause
golang.org/x/sync	BSD-3-Clause
golang.org/x/sys	BSD-3-Clause
golang.org/x/text	BSD-3-Clause
golang.org/x/xerrors	BSD-3-Clause
google.golang.org/genproto/googleapis/api/httpbody	Apache-2.0
google.golang.org/genproto/googleapis/rpc/status	Apache-2.0
google.golang.org/grpc	Apache-2.0
google.golang.org/protobuf	BSD-3-Clause
gopkg.in/yaml.v2	Apache-2.0
gopkg.in/yaml.v3	MIT

Loading plugin documentation