querying-aws-cloudwatch

Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables. Covers VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, Network Firewall logs, EKS audit logs, Verified Access logs, SES logs, VPC Lattice logs, Step Functions logs, NLB access logs, and 20+ other AWS vended data sources. Applies when analyzing network traffic, investigating security incidents, querying exported logs with SQL, enabling S3 Tables integration, configuring log export, correlating logs with other data, or running Athena queries on the aws-cloudwatch table bucket. Trigger phrases: query logs with SQL, analyze logs in Athena, SQL on VPC flow logs, investigate network traffic, run SQL on exported logs, enable S3 Tables for CloudWatch, correlate logs, historical log analysis, set up log querying.

Quality

96%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is highly actionable with executable commands, complete SQL examples, and explicit validation checkpoints across a clear sequenced workflow. Its main weakness is progressive disclosure: heavy reference content (the data-source table and IAM policy blocks) is inline rather than split into bundle reference files.

Suggestions

Move the 24-row Supported Data Sources table (or the full namespace catalog) into a references/ file such as DATA_SOURCES.md, keeping only the top examples and the discovery command inline in SKILL.md.

Move the full trust-policy, permissions-policy, and KMS-key-policy JSON blocks into a references/ file such as IAM_POLICIES.md, linking from the Security Considerations section to reduce inline weight.

Add a 'Prerequisites' checkpoint at the top of Common Tasks that verifies AWS credentials and Athena workgroup/output location before the configuration steps, making the entry condition explicit.

Dimension	Reasoning	Score
Conciseness	The body avoids explaining concepts Claude already knows and keeps every section as actionable reference material (CLI commands, SQL, IAM policy JSON, troubleshooting fixes); the long data-source table and policy blocks are reference content rather than padding, keeping it lean.	3 / 3
Actionability	Provides fully executable AWS CLI commands, complete copy-paste SQL examples including a cross-catalog JOIN, and full IAM/KMS policy JSON, matching the score-3 anchor of copy-paste-ready guidance.	3 / 3
Workflow Clarity	Common Tasks are clearly sequenced (check -> configure -> verify permissions -> query) with explicit validation checkpoints ('Empty result -> integration not enabled', MUST run get-tables before writing SQL, MUST confirm workgroup/output location), matching the score-3 anchor.	3 / 3
Progressive Disclosure	The skill is a single inline SKILL.md with no bundle files, and substantial reference material (a 24-row data-source table and three full IAM/KMS policy JSON blocks) that could live in separate reference files is kept inline; sections are well-organized with one-level external doc links, but content that should be split is not, matching the score-2 anchor.	2 / 3
	Total	11 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is third-person, concrete, and answers both what and when with an explicit trigger-phrase list. It is somewhat long due to the inline data-source enumeration, but every element earns its place by aiding specificity and distinctiveness.

Dimension	Reasoning	Score
Specificity	Names multiple concrete actions such as 'Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables', 'correlating logs with other data', and 'running Athena queries on the aws-cloudwatch table bucket', matching the score-3 anchor of listing multiple specific concrete actions.	3 / 3
Completeness	Clearly answers both what (runs SQL on CloudWatch logs exported as Iceberg tables in S3 Tables) and when ('Applies when analyzing network traffic, investigating security incidents...' plus a 'Trigger phrases:' list), matching the explicit-trigger anchor.	3 / 3
Trigger Term Quality	Provides explicit 'Trigger phrases' with natural phrasings users would say ('query logs with SQL', 'analyze logs in Athena', 'SQL on VPC flow logs', 'investigate network traffic'), giving good coverage of natural terms rather than jargon.	3 / 3
Distinctiveness Conflict Risk	Targets a clear niche (CloudWatch Logs -> S3 Tables -> Athena SQL) with distinct triggers like 'enable S3 Tables for CloudWatch' and 'aws-cloudwatch table bucket', making it unlikely to fire for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: aws/agent-toolkit-for-aws
Path: skills/specialized-skills/system-table-skills/querying-aws-cloudwatch/SKILL.md
Commit: 222ce56

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.