querying-aws-cloudwatch

SKILL.md

Query AWS CloudWatch System Tables

Overview

Works best with the AWS MCP server for sandboxed execution and audit logging. All commands below use the AWS CLI and work in any environment with configured AWS credentials.

The CloudWatch Logs S3 Tables integration exports log data as Apache Iceberg tables in the AWS-managed aws-cloudwatch table bucket. This enables SQL analysis via Amazon Athena and correlation of log data with non-CloudWatch data (S3 metadata, business tables, etc.). Available at no additional storage charge beyond CloudWatch ingestion pricing.

Decision Tree

User intent
Use this skill?
Alternative

Run SQL across large volumes of log data
Yes
—

Correlate logs with S3 metadata or other tables
Yes — join across catalogs
—

Quick log search / pattern matching
No
CloudWatch Logs Insights (faster for ad-hoc)

Real-time log streaming/tailing
No
CloudWatch Logs console or logs filter-log-events

Set up alarms on log patterns
No
CloudWatch Metric Filters / Alarms

Query historical logs before integration was enabled
No
CloudWatch Logs (no backfill in S3 Tables)