querying-aws-cloudwatch

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: analytics, athena, aws, logs, sql.

What it does

Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables. Covers VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, Network Firewall logs, EKS audit logs, Verified Access logs, SES logs, VPC Lattice logs, Step Functions logs, NLB access logs, and 20+ other AWS vended data sources. Applies when analyzing network traffic, investigating security incidents, querying exported logs with SQL, enabling S3 Tables integration, configuring log export, correlating logs with other data, or running Athena queries on the aws-cloudwatch table bucket. Trigger phrases: query logs with SQL, analyze logs in Athena, SQL on VPC flow logs, investigate network traffic, run SQL on exported logs, enable S3 Tables for CloudWatch, correlate logs, historical log analysis, set up log querying.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill querying-aws-cloudwatch

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/system-table-skills/querying-aws-cloudwatch ~/.claude/skills/querying-aws-cloudwatch

Safety box score

Grade C, moderate risk: 26 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill runs AWS CLI queries and configuration commands against CloudWatch Logs S3 Tables, Athena, Glue, Lake Formation, and related AWS services. Its main blast radius is cloud-side: it can enable log export integrations, broaden collection scope, and surface sensitive log contents in query results. It does not ship binaries or touch local files, but it depends on the user's AWS credentials and permissions.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly says "All commands below use the AWS CLI" and includes runnable commands like `aws observabilityadmin create-s3-table-integration` and `aws glue get-tables`, so it executes shell commands against live services.
Network access	2 (moderate)	The skill sends requests to multiple AWS services (S3 Tables, Observability Admin, Logs, Lake Formation, Glue, Athena) and retrieves remote log data and schemas over the network.
Filesystem reach	0 (none)	There are no commands that read, write, or delete local files, dotfiles, or system paths; the scope is cloud resources only.
Secrets & credentials	1 (low)	It warns that exported logs may contain sensitive material: "PII including IP addresses, user agents, request parameters, and authentication tokens," so queries can expose secret-like data from logs.
Privilege & persistence	0 (none)	It does not require sudo, install software globally, register services, or change local shell/OS settings; the permission changes it describes are cloud IAM/Lake Formation settings, not local privilege escalation.
Instruction hijack surface	0 (none)	There is no prompt-injection or hidden-instruction pattern here; the "MUST" statements are operational constraints for the workflow, not attempts to subvert safeguards or hide actions.
Irreversible actions	2 (moderate)	It can change AWS account state by creating integrations, associating sources, and granting Lake Formation permissions, including the broad wildcard association `--data-source '{"name": "", "type": ""}'`.
Transparency	0 (none)	The skill is plain markdown with visible AWS CLI/SQL snippets; there are no binaries, obfuscated blobs, or decoded-at-runtime payloads.

Before installing

Use a scratch or least-privilege AWS account first; the skill can create integrations and grant Lake Formation permissions.
Decide whether wildcard source association is acceptable; prefer specific data sources over `{"name":"*","type":"*"}`.
Verify your Athena workgroup output location and encryption before querying exported logs.
Confirm who should be able to read the tables, since the logs may contain tokens and other sensitive fields.

Rated 2026-10-20 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/system-table-skills/querying-aws-cloudwatch/SKILL.md
Branch: main
Updated: 2026-09-19

querying-aws-redshift — Enables Redshift system-table (SYS_*) log publishing to S3 Tables in Apache Iceberg format for both Provisioned clusters and Serverless namespaces.
querying-aws-s3 — Queries S3 object metadata, tracks bucket activity, audits object changes, searches annotations.
amazon-opensearch-service — Guides migration, provisioning, search, log-analytics, trace-analytics.
querying-data-lake — Execute and manage Athena SQL queries across default and federated catalogs (Glue, S3 Tables, Redshift).
aws-observability — Builds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail.
aurora-dsql — Provisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans.