skills.rest
richardnroman
richardnromanCOMMUNITY
Explore all skills by this author →
GitHub

querying-aws-cloudwatch

Runs SQL queries on CloudWatch Logs exported as Iceberg tables in S3 Tables via Athena.

Updated Jul 21, 2026
Search Tags:#aws#sql#log analysis#iceberg#cloudwatch#athena#s3 tables
One-click install
npx skills add https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform --skill querying-aws-cloudwatch-richardnroman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: querying-aws-cloudwatch
Source: https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform/tree/main/.agents/skills/querying-aws-cloudwatch
Command: npx skills add https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform --skill querying-aws-cloudwatch-richardnroman

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? CloudWatch Logs are difficult to analyze at scale with ad-hoc tools, and correlating log data with other datasets requires manual exports. This Skill enables SQL-based analysis of CloudWatch log data exported as Apache Iceberg tables in S3 Tables, queryable through Amazon Athena. ## Core Features & Use Cases - SQL on Exported Logs: Query 24+ AWS vended data sources including VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, and EKS audit logs using standard SQL in Athena. - Integration Setup & Configuration: Create the S3 Tables integration, associate specific or wildcard data sources, and configure IAM service roles with confused-deputy protections. - Cross-Dataset Correlation: Join CloudWatch log tables with S3 metadata or business tables across catalogs for security investigations and traffic analysis. - Use Case: A security engineer investigating rejected network traffic runs SQL against the amazon_vpc__flow namespace to find the top rejected connections by bytes, then correlates source IPs with WAF blocked requests. ## Quick Start Ask the assistant to check whether the aws-cloudwatch table bucket exists in your region and list the available log namespaces for querying.

Frequently Asked Questions about querying-aws-cloudwatch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query CloudWatch logs with SQL in Athena?▼

Enable the CloudWatch S3 Tables integration, which exports log data as Apache Iceberg tables in the aws-cloudwatch table bucket. Then query them in Athena using the s3tablescatalog/aws-cloudwatch catalog with the appropriate namespace and table name.

What AWS log types can be exported to S3 Tables?▼

The integration supports 43+ AWS vended data sources including VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, EKS audit logs, Network Firewall logs, and SES logs. Use list-namespaces on the aws-cloudwatch bucket to discover available sources in your account.

Does the CloudWatch S3 Tables integration backfill historical logs?▼

No, the integration does not backfill historical data. Only log events received after a data source is associated with the integration are delivered to S3 Tables, so earlier logs remain accessible only through CloudWatch Logs.

Why does Athena return CATALOG_NOT_FOUND for aws-cloudwatch?▼

This error means S3 Tables is not registered as a federated catalog in Glue. Enable the integration from the S3 console under Table buckets, then verify the s3tablescatalog catalog exists before querying.

When should I use CloudWatch Logs Insights instead of S3 Tables?▼

Use CloudWatch Logs Insights for quick ad-hoc searches, pattern matching, and real-time log investigation. Use the S3 Tables integration when you need SQL joins across large log volumes or correlation with non-CloudWatch data like S3 metadata.

Why do I get AccessDenied when querying exported CloudWatch logs?▼

AccessDenied usually means missing Lake Formation grants or IAM permissions. Grant DESCRIBE and SELECT on the table via lakeformation grant-permissions, and confirm the Athena workgroup and output location are properly configured.

Related Skills

Explore More Software Engineering Skills→
mreferremreferre

setting-up-cloudtrail-multi-region

Configure multi-region AWS CloudTrail trails with S3 and CloudWatch Logs delivery.

Community
Advanced
Mohamed-ElkahefMohamed-Elkahef

dashboard-creation

Build interactive analytics dashboards with Chart.js for business metrics and KPIs.

Community
Advanced
githubgithub
38.5k

aws-cloudwatch-investigation

Provides CloudWatch Logs Insights queries and metric patterns for structured incident triage.

Official
Intermediate
herren-officialherren-official

b2c-backend-cloudwatch

Search, query, and tail CloudWatch logs across ECS, Lambda, and RDS.

Official
Advanced