Querying Aws Cloudwatch

This lets Claude run SQL queries on your CloudWatch Logs after you've set up the S3 Tables integration, which exports logs as Apache Iceberg tables. It covers 40+ AWS data sources including VPC Flow Logs, WAF logs, CloudFront access logs, and EKS audit logs. The skill walks through checking if the integration exists, enabling it if needed, granting Lake Formation permissions, and running Athena queries with the correct three-part catalog syntax. One thing to know upfront: this only works on logs received after you enable the integration, there's no backfill. If you just need quick pattern matching or real-time tailing, stick with CloudWatch Logs Insights. This shines when you're correlating large volumes of historical logs with other data sources or running complex SQL across multiple log types.

skills.sh installs: 5.9K
GitHub stars: 3.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aws/agent-toolkit-for-aws --skill querying-aws-cloudwatch --agent claude-code

Installs into .claude/skills of the current project.

Files

Query AWS CloudWatch System Tables

Overview

Works best with the AWS MCP server for sandboxed execution and audit logging. All commands below use the AWS CLI and work in any environment with configured AWS credentials.

The CloudWatch Logs S3 Tables integration exports log data as Apache Iceberg tables in the AWS-managed aws-cloudwatch table bucket. This enables SQL analysis via Amazon Athena and correlation of log data with non-CloudWatch data (S3 metadata, business tables, etc.). Available at no additional storage charge beyond CloudWatch ingestion pricing.