skills.rest
sakicodes
sakicodesCOMMUNITY
Explore all skills by this author →
GitHub

querying-aws-cloudwatch

Runs SQL queries on CloudWatch Logs exported as Iceberg tables in S3 Tables via Athena.

Updated Jul 1, 2026
Search Tags:#aws#sql#log analysis#iceberg#cloudwatch#athena#s3 tables
One-click install
npx skills add https://github.com/sakicodes/BuildFestHackathon26 --skill querying-aws-cloudwatch-sakicodes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: querying-aws-cloudwatch
Source: https://github.com/sakicodes/BuildFestHackathon26/tree/main/.agents/skills/querying-aws-cloudwatch
Command: npx skills add https://github.com/sakicodes/BuildFestHackathon26 --skill querying-aws-cloudwatch-sakicodes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? CloudWatch Logs are difficult to analyze at scale with ad-hoc search tools, and correlating log data with other datasets requires manual exports. This Skill enables SQL-based analysis of CloudWatch Logs exported as Apache Iceberg tables in S3 Tables, queryable through Amazon Athena. ## Core Features & Use Cases - SQL on Exported Logs: Query 24+ AWS vended data sources including VPC Flow Logs, WAF logs, CloudFront access logs, and EKS audit logs using standard Athena SQL. - Integration Setup & Verification: Create the S3 Tables integration, associate specific or wildcard data sources, and verify Lake Formation permissions. - Cross-Dataset Correlation: Join CloudWatch log tables with S3 metadata or business tables across catalogs for deeper investigations. - Use Case: A security engineer investigating rejected network traffic runs SQL against the amazon_vpc__flow namespace to find the top rejected connections by bytes, then correlates source IPs with S3 access records. ## Quick Start Ask the assistant to check whether the aws-cloudwatch table bucket exists in your region and list the available log namespaces for querying.

Frequently Asked Questions about querying-aws-cloudwatch

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I query CloudWatch Logs with SQL in Athena?▼

Enable the CloudWatch S3 Tables integration, which exports logs as Apache Iceberg tables in the aws-cloudwatch table bucket. Then query them in Athena using the s3tablescatalog/aws-cloudwatch catalog with the appropriate namespace and table name.

What AWS log types can I query through S3 Tables?▼

The integration supports 43+ AWS vended data sources including VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, EKS audit logs, and NLB access logs. Run list-namespaces on the aws-cloudwatch bucket to see what is available in your account.

Does the CloudWatch S3 Tables integration backfill historical logs?▼

No, the integration does not backfill. Only log events received after a data source is associated with the integration are delivered to S3 Tables, so historical logs remain accessible only through CloudWatch Logs.

Why does my Athena query fail with CATALOG_NOT_FOUND?▼

This error means S3 Tables is not registered as a federated catalog in AWS Glue. Enable the integration from the S3 console under Table buckets, then confirm the s3tablescatalog catalog exists before querying.

When should I use CloudWatch Logs Insights instead of SQL on S3 Tables?▼

Use CloudWatch Logs Insights for quick ad-hoc searches, pattern matching, and real-time investigation. Use SQL on S3 Tables when analyzing large log volumes, correlating logs with other datasets, or running complex joins and aggregations.

Related Skills

Explore More Software Engineering Skills→
dennisvinkdennisvink

querying-aws-cloudwatch

Runs SQL queries on CloudWatch logs exported as Iceberg tables in S3 Tables.

Community
Advanced
Mohamed-ElkahefMohamed-Elkahef

dashboard-creation

Build interactive analytics dashboards with Chart.js for business metrics and KPIs.

Community
Advanced
xalgordxalgord
954

implementing-cloud-trail-log-analysis

Analyze AWS CloudTrail logs with Athena and CloudWatch to detect unauthorized access and privilege escalation.

Community
Advanced
pwv-vcpwv-vc
6

aws-logs-query

Query AWS CloudWatch logs for staging and production environments.

Official
Intermediate