skills.rest
AndreKurait
AndreKuraitCOMMUNITY
Explore all skills by this author →
GitHub

querying-aws-cloudwatch

Run SQL queries on CloudWatch Logs exported as Iceberg tables.

Updated Jun 18, 2026
Search Tags:#logs#sql#data-analysis#cloudwatch#athena#s3-tables
One-click install
npx skills add https://github.com/AndreKurait/claude-marketplace-test --skill querying-aws-cloudwatch
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: querying-aws-cloudwatch
Source: https://github.com/AndreKurait/claude-marketplace-test/tree/main/skills/specialized-skills/system-table-skills/querying-aws-cloudwatch
Command: npx skills add https://github.com/AndreKurait/claude-marketplace-test --skill querying-aws-cloudwatch

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill enables SQL-based analysis of CloudWatch Logs data exported as Apache Iceberg tables in the aws-cloudwatch S3 bucket, empowering fast, structured querying and cross-source insights.

Core Features & Use Cases

  • Unified SQL analysis: Run SQL across multiple log sources including VPC Flow Logs, WAF logs, CloudFront access logs, and Route 53 resolver logs.
  • Cross-source correlation: Join CloudWatch data with non-CloudWatch metadata and other datasets stored in S3 Tables for enriched investigations.
  • Historical & investigative queries: Analyze long-term trends, identify security incidents, and perform ad-hoc investigations using Athena-compatible SQL.

Quick Start

Set up the AWS MCP server and begin querying the aws-cloudwatch Iceberg tables in Athena to validate connectivity.

Frequently Asked Questions about querying-aws-cloudwatch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run SQL queries on CloudWatch Logs data exported to S3?▼

You can run SQL queries on CloudWatch Logs data by exporting them as Apache Iceberg tables to the aws-cloudwatch S3 bucket and querying them via Athena-compatible SQL. This enables structured analysis across VPC Flow Logs, WAF logs, and CloudFront logs.

Can I correlate VPC Flow Logs with WAF and CloudFront logs using SQL?▼

Yes, cross-source correlation is possible by joining CloudWatch data exported as Iceberg tables with non-CloudWatch metadata stored in S3 Tables. This allows you to investigate network events by querying VPC Flow Logs, WAF logs, and CloudFront logs together.

Do I need the AWS MCP server to query CloudWatch Logs exported as Iceberg tables?▼

Yes, the AWS MCP server is required to query these Iceberg tables. You also need AWS CLI access and access to the aws-cloudwatch S3 Tables namespace to discover schemas using get-tables before running your Athena SQL queries.

What AWS log sources are supported for SQL analysis in S3 Tables?▼

Supported AWS vended log sources include VPC Flow Logs, WAF logs, CloudFront access logs, and Route 53 resolver logs. These are exported as Iceberg tables with per-source schemas, enabling structured SQL analysis and historical investigations.

How do I discover table schemas before querying CloudWatch Logs in Athena?▼

You discover schemas by using the get-tables functionality provided by the AWS MCP server. This allows you to identify namespace-specific tables and their per-source schemas within the aws-cloudwatch S3 Tables namespace before executing queries.

Related Skills

Explore More Data & Analytics Skills→
awsaws
2.3k

creating-data-lake-table

Create Iceberg tables in Amazon S3 Tables with schemas and partitioning.

Official
Advanced
hmzainjamilhmzainjamil
1

Security Monitoring

Automate security monitoring, threat detection, and incident response from enterprise logs.

Community
Advanced
mreferremreferre

creating-data-lake-table

Create managed Iceberg tables on Amazon S3 Tables with Glue catalog registration.

Community
Advanced
ryankoleanryankolean
3

cli-duckdb

Run in-process analytical SQL queries on CSV, Parquet, and JSON files.

Community
Advanced