querying-aws-redshift

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: athena, aws, logs, redshift, sql.

What it does

Enables Redshift system-table (SYS_*) log publishing to S3 Tables in Apache Iceberg format for both Provisioned clusters and Serverless namespaces, verifies publishing status, and queries the published logs via any Iceberg-compatible engine including Redshift and Athena. Covers system tables such as sys_query_history, sys_query_text, sys_connection_log, sys_query_detail, and sys_session_history. Applies when turning on S3 Tables log publishing for a cluster or namespace, confirming publishing status and locating the S3 Tables namespace, querying non-realtime data from Redshift system tables off-cluster at scale, or building dashboards for Redshift monitoring and auditing, especially for historical or high-volume system-table data beyond the in-cluster SYS_ view retention window. Trigger phrases: publish redshift system table log to s3 tables, enable-logging s3 tables, describe redshift logging status, query redshift system tables in athena or redshift, redshift log exports to iceberg.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill querying-aws-redshift

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/system-table-skills/querying-aws-redshift ~/.claude/skills/querying-aws-redshift

Safety box score

Grade D, elevated risk: 47 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill configures Redshift system-table publishing to S3 Tables and then queries those logs through Athena or Redshift, using AWS CLI calls to Redshift, IAM, Glue, Lake Formation, and Athena. The main risks are broad account/cluster privilege changes and exposure of sensitive query text, especially if Athena outputs or Lake Formation settings are misconfigured.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It relies on AWS CLI command execution throughout (`aws redshift enable-logging`, `aws iam create-role`, `aws lakeformation put-data-lake-settings`), so installing it grants the agent executable control over AWS APIs.
Network access	2 (moderate)	The skill contacts AWS services to publish/query data via Redshift, Glue, Athena, CloudWatch, and SNS, moving system-table data and query results across remote services.
Filesystem reach	0 (none)	No local filesystem writes/deletes or native scripts are shipped; the only file references are optional `file://` examples and markdown reference files.
Secrets & credentials	2 (moderate)	It explicitly warns that `query_text can contain credentials` and that Athena is a second copy of the same text via CloudTrail, so the skill can expose sensitive log data.
Privilege & persistence	3 (high)	It can create IAM roles, attach them to Redshift clusters, register Lake Formation resources, and call `put-data-lake-settings`, which rewrites account-wide data lake admin settings.
Instruction hijack surface	0 (none)	There are no instructions to ignore higher-level rules or to fetch and execute untrusted remote content; the markdown only gives AWS commands and quoted docs.
Irreversible actions	2 (moderate)	The skill can enable/disable logging and publishing state on live clusters and namespaces, but those actions are the skill's explicit purpose rather than arbitrary deployment behavior.
Transparency	0 (none)	All shipped files are plain markdown; there are no binaries, obfuscated blobs, or decoded-at-runtime installers.

Before installing

Read `references/permissions-setup.md` and decide who will run the Lake Formation setup steps.
If you will query with Athena, confirm the workgroup enforces SSE-KMS output (`EnforceWorkGroupConfiguration=true`).
Verify the KMS key policy includes both `systemtables.redshift.amazonaws.com` and `maintenance.s3tables.amazonaws.com`.
Test in a scratch Redshift cluster/namespace first, since the skill can attach IAM roles and change publishing state.

Rated 2026-10-20 by an automated review of 4 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/system-table-skills/querying-aws-redshift/SKILL.md
Branch: main
Updated: 2026-09-19

querying-aws-cloudwatch — Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables.
querying-aws-s3 — Queries S3 object metadata, tracks bucket activity, audits object changes, searches annotations.
amazon-opensearch-service — Guides migration, provisioning, search, log-analytics, trace-analytics.
querying-data-lake — Execute and manage Athena SQL queries across default and federated catalogs (Glue, S3 Tables, Redshift).
redshift-guide — Amazon Redshift is NOT PostgreSQL — corrects PostgreSQL-derived LLM mistakes; covers Redshift-specific SQL, DDL, COPY/UNLOAD, system views, metadata discovery.
aurora-dsql — Provisions and manages Aurora DSQL clusters, connects via psql or DSQL Connectors, manages schemas, runs queries, migrates from MySQL, diagnoses query plans.