skills.rest
aws
awsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

querying-aws-s3

Queries S3 Metadata and Storage Lens system tables via Athena SQL for object auditing and storage analysis.

2.5k|282|Updated Apr 23, 2026
Search Tags:#sql#Iceberg#Athena#AWS S3#object audit#storage lens#s3 metadata
One-click install
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill querying-aws-s3
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: querying-aws-s3
Source: https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialized-skills/system-table-skills/querying-aws-s3
Command: npx skills add https://github.com/aws/agent-toolkit-for-aws --skill querying-aws-s3

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Auditing object changes, counting objects, and analyzing storage across large S3 buckets is slow and incomplete with raw S3 APIs like list-objects-v2, which paginate at 1000 objects per call and cannot reveal who uploaded or deleted an object.

Core Features & Use Cases

  • Journal Table Auditing: Track CREATE, DELETE, and annotation events with requester and source IP address for security investigations.
  • Inventory & Annotation Queries: Count objects, filter by storage class or tags, and search annotation payloads with SQL instead of per-object API calls.
  • Storage Lens Metrics: Analyze per-bucket storage distribution and activity metrics exported as Iceberg tables.
  • Use Case: A security engineer needs to find who deleted objects from a production bucket in the last 24 hours; the journal table answers this with one Athena query including requester and source IP.

Quick Start

Ask the agent to show all objects deleted from your S3 bucket in the last 24 hours including who deleted them.

Frequently Asked Questions about querying-aws-s3

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find out who deleted objects from an S3 bucket?▼

Query the S3 Metadata journal table in Athena filtering for record_type = 'DELETE'. The journal includes requester and source_ip_address columns, which raw S3 APIs like list-objects-v2 cannot provide.

How to count objects in a large S3 bucket efficiently?▼

Run SELECT COUNT(*) against the S3 Metadata inventory table in Athena, which returns results in seconds even for buckets with billions of objects. Using list-objects-v2 paginates at 1000 objects per call and is impractical at that scale.

Can I update S3 object annotations through the system tables?▼

No, the S3 Metadata tables are read-only and do not support INSERT, UPDATE, or DELETE. To write or update an annotation, use the direct put-object-annotation API instead.

Why does my Athena query return CATALOG_NOT_FOUND for S3 tables?▼

The S3 Tables federated catalog is not registered in AWS Glue. Enable the integration via the S3 console under Table buckets, or create the s3tablescatalog federated catalog with the aws glue create-catalog command.

Why is the S3 inventory table empty after enabling metadata?▼

The table is likely still in BACKFILLING status after initial enablement. Check the configuration status with get-bucket-metadata-configuration and wait for it to reach ACTIVE, which can take minutes to hours depending on object count.

Related Skills

Explore More Data & Analytics Skills→
mreferremreferre

querying-data-lake

Execute Athena SQL queries across federated data lake catalogs with safety checks.

Community
Advanced
LerianStudioLerianStudio
205

ops-security-audit

Automate infrastructure security audits with phased scanning and compliance mapping.

Official
Advanced
balsm-healthbalsm-health
2

detecting-s3-data-exfiltration-attempts

Detect AWS S3 data exfiltration attempts by analyzing CloudTrail logs.

Official
Advanced
sncollectivesncollective

garage-v2

Document Garage v2 S3-compatible object storage and admin API workflows.

Official
Advanced