querying-aws-cloudwatch

Run SQL queries on CloudWatch Logs exported as Iceberg tables.

Updated Jun 18, 2026

Search Tags:#logs #sql #data-analysis #cloudwatch #athena #s3-tables

Ready to run

npx skills add https://github.com/AndreKurait/claude-marketplace-test --skill querying-aws-cloudwatch

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: querying-aws-cloudwatch
Source: https://github.com/AndreKurait/claude-marketplace-test/tree/main/skills/specialized-skills/system-table-skills/querying-aws-cloudwatch
Command: npx skills add https://github.com/AndreKurait/claude-marketplace-test --skill querying-aws-cloudwatch

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill enables SQL-based analysis of CloudWatch Logs data exported as Apache Iceberg tables in the aws-cloudwatch S3 bucket, empowering fast, structured querying and cross-source insights.

Core Features & Use Cases

Unified SQL analysis: Run SQL across multiple log sources including VPC Flow Logs, WAF logs, CloudFront access logs, and Route 53 resolver logs.
Cross-source correlation: Join CloudWatch data with non-CloudWatch metadata and other datasets stored in S3 Tables for enriched investigations.
Historical & investigative queries: Analyze long-term trends, identify security incidents, and perform ad-hoc investigations using Athena-compatible SQL.

Quick Start

Set up the AWS MCP server and begin querying the aws-cloudwatch Iceberg tables in Athena to validate connectivity.

Frequently Asked Questions about querying-aws-cloudwatch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I run SQL queries on CloudWatch Logs data exported to S3?▼

You can run SQL queries on CloudWatch Logs data by exporting them as Apache Iceberg tables to the aws-cloudwatch S3 bucket and querying them via Athena-compatible SQL. This enables structured analysis across VPC Flow Logs, WAF logs, and CloudFront logs.

Can I correlate VPC Flow Logs with WAF and CloudFront logs using SQL?▼

Yes, cross-source correlation is possible by joining CloudWatch data exported as Iceberg tables with non-CloudWatch metadata stored in S3 Tables. This allows you to investigate network events by querying VPC Flow Logs, WAF logs, and CloudFront logs together.

Do I need the AWS MCP server to query CloudWatch Logs exported as Iceberg tables?▼

Yes, the AWS MCP server is required to query these Iceberg tables. You also need AWS CLI access and access to the aws-cloudwatch S3 Tables namespace to discover schemas using get-tables before running your Athena SQL queries.

What AWS log sources are supported for SQL analysis in S3 Tables?▼

Supported AWS vended log sources include VPC Flow Logs, WAF logs, CloudFront access logs, and Route 53 resolver logs. These are exported as Iceberg tables with per-source schemas, enabling structured SQL analysis and historical investigations.

How do I discover table schemas before querying CloudWatch Logs in Athena?▼

You discover schemas by using the get-tables functionality provided by the AWS MCP server. This allows you to identify namespace-specific tables and their per-source schemas within the aws-cloudwatch S3 Tables namespace before executing queries.