querying-aws-cloudwatch
Installation
SKILL.md
Query AWS CloudWatch System Tables
Overview
Works best with the AWS MCP server for sandboxed execution and audit logging. All commands below use the AWS CLI and work in any environment with configured AWS credentials.
The CloudWatch Logs S3 Tables integration exports log data as Apache Iceberg tables in the AWS-managed aws-cloudwatch table bucket. This enables SQL analysis via Amazon Athena and correlation of log data with non-CloudWatch data (S3 metadata, business tables, etc.). Available at no additional storage charge beyond CloudWatch ingestion pricing.
Decision Tree
| User intent | Use this skill? | Alternative |
|---|---|---|
| Run SQL across large volumes of log data | Yes | — |
| Correlate logs with S3 metadata or other tables | Yes — join across catalogs | — |
| Quick log search / pattern matching | No | CloudWatch Logs Insights (faster for ad-hoc) |
| Real-time log streaming/tailing | No | CloudWatch Logs console or logs filter-log-events |
| Set up alarms on log patterns | No | CloudWatch Metric Filters / Alarms |
| Query historical logs before integration was enabled | No | CloudWatch Logs (no backfill in S3 Tables) |