skills.rest
dennisvink
dennisvinkCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

querying-aws-cloudwatch

Runs SQL queries on CloudWatch logs exported as Iceberg tables in S3 Tables.

Updated Sep 8, 2026
Search Tags:#aws#sql#log analysis#iceberg#cloudwatch#athena#s3 tables
One-click install
npx skills add https://github.com/dennisvink/yolomancer --skill querying-aws-cloudwatch-dennisvink
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: querying-aws-cloudwatch
Source: https://github.com/dennisvink/yolomancer/tree/main/skills/aws/specialized-skills/system-table-skills/querying-aws-cloudwatch
Command: npx skills add https://github.com/dennisvink/yolomancer --skill querying-aws-cloudwatch-dennisvink

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? CloudWatch log data is difficult to analyze at scale with ad-hoc search tools, and correlating logs with other datasets requires manual exports. This Skill enables SQL-based analysis of CloudWatch logs exported as Apache Iceberg tables in S3 Tables, queryable through Amazon Athena. ## Core Features & Use Cases - SQL on 24+ AWS log sources: Query VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, EKS audit logs, and more via Athena against the aws-cloudwatch table bucket. - Integration setup and verification: Check whether the S3 Tables integration exists, create it with KMS encryption, and associate specific or wildcard data sources. - Cross-dataset correlation: Join log tables with S3 metadata or business tables across catalogs for security investigations and traffic analysis. - Use Case: A security engineer investigating rejected network traffic runs SQL on the amazon_vpc__flow namespace to find the top rejected connections by bytes, then correlates source IPs with S3 object creation events. ## Quick Start Ask the assistant to check whether the CloudWatch S3 Tables integration is configured in your region and then run a SQL query against your VPC Flow Logs table.

Frequently Asked Questions about querying-aws-cloudwatch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query CloudWatch logs with SQL in Athena?▼

Enable the CloudWatch S3 Tables integration, associate your data sources, then query tables in Athena using the "s3tablescatalog/aws-cloudwatch"."<namespace>"."<table>" syntax. Always run aws glue get-tables on the target namespace first to get the current schema.

What AWS log sources can be exported to S3 Tables?▼

The integration supports 43+ AWS vended data sources including VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, EKS audit logs, Network Firewall logs, and NLB access logs. Use list-namespaces on the aws-cloudwatch bucket to discover available sources in your account.

When should I use S3 Tables instead of CloudWatch Logs Insights?▼

Use S3 Tables with Athena for SQL analysis across large log volumes and for correlating logs with other datasets. Use CloudWatch Logs Insights for quick ad-hoc searches, real-time tailing, or querying logs generated before the integration was enabled.

Why is my Athena query returning empty results from CloudWatch tables?▼

The integration does not backfill historical data; only log events received after association appear in S3 Tables. Confirm the data source association exists and that the log source is actively generating new events.

Why do I get AccessDenied when querying the aws-cloudwatch table bucket?▼

Querying requires Lake Formation SELECT and DESCRIBE grants on the table (or IAM-only mode in supported regions), plus Athena execution permissions. Grant permissions with aws lakeformation grant-permissions on the s3tablescatalog/aws-cloudwatch catalog.

Does exporting CloudWatch logs to S3 Tables cost extra?▼

There is no additional storage charge beyond standard CloudWatch ingestion pricing. Retention follows the log group, so expired or deleted log group data is also removed from the S3 table.

Related Skills

Explore More Data & Analytics Skills→
AndreKuraitAndreKurait

querying-aws-cloudwatch

Run SQL queries on CloudWatch Logs exported as Iceberg tables.

Community
Advanced
xalgordxalgord
954

performing-cloud-log-forensics-with-athena

Queries CloudTrail, VPC Flow Logs, S3, and ALB logs with AWS Athena for forensic investigation.

Community
Advanced
xalgordxalgord
954

detecting-s3-data-exfiltration-attempts

Detect S3 data exfiltration by analyzing CloudTrail data events, GuardDuty findings, and Macie alerts.

Community
Advanced
herren-officialherren-official

b2c-backend-cloudwatch

Search, query, and tail CloudWatch logs across ECS, Lambda, and RDS.

Official
Advanced