querying-aws-cloudwatch

Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables. Covers VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, Network Firewall logs, EKS audit logs, Verified Access logs, SES logs, VPC Lattice logs, Step Functions logs, NLB access logs, and 20+ other AWS vended data sources. Applies when analyzing network traffic, investigating security incidents, querying exported logs with SQL, enabling S3 Tables integration, configuring log export, correlating logs with other data, or running Athena queries on the aws-cloudwatch table bucket. Trigger phrases: query logs with SQL, analyze logs in Athena, SQL on VPC flow logs, investigate network traffic, run SQL on exported logs, enable S3 Tables for CloudWatch, correlate logs, historical log analysis, set up log querying.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

80%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The content is highly actionable with executable commands, SQL, and IAM policies, and the workflow is clearly sequenced with mandatory validation steps. Its main weakness is progressive disclosure: large reference-grade material (the data-source catalog and JSON policy blocks) is inlined rather than moved into reference files, modestly hurting conciseness.

Suggestions

Move the three full inline JSON policy blocks (service role trust, permissions, KMS key policy) into a references/ file such as IAM.md and link to it from the Security Considerations section to reduce token cost.

Consider moving the 24-row supported-data-source table to a references/DATA_SOURCES.md and keeping a short representative subset inline, since the description already enumerates the major sources.

Add an explicit validate-then-retry feedback loop for the query workflow (e.g., if get-tables shows a schema mismatch, re-run get-tables and adjust the query) to lift workflow clarity from 4 to 5.

Dimension	Reasoning	Score
Conciseness	The body is largely efficient and assumes Claude's competence (no 'what a PDF is' style padding), but the 24-row data-source table and three full inline JSON policy blocks could be trimmed or moved to references to earn back tokens.	4 / 5
Actionability	Provides copy-paste-ready AWS CLI commands, executable SQL examples across several use cases (VPC Flow rejects, WAF blocks, cross-catalog join), and complete inline JSON IAM policies covering the common cases.	5 / 5
Workflow Clarity	Numbered Common Tasks sequence the flow clearly with a decision tree and troubleshooting table, and the query section enforces explicit validation ('MUST ALWAYS run get-tables', 'MUST confirm workgroup and output location', 'MUST inform user no backfill'); however the no-backfill and schema-vary warnings are mandatory statements rather than explicit validate-then-fix feedback loops.	4 / 5
Progressive Disclosure	No bundle files (references/scripts/assets) exist, yet all content—the 24-row data-source catalog, three full IAM/KMS JSON policy blocks, and the detailed setup—is inlined in SKILL.md rather than split into one-level-deep reference files, so structure is present but material that belongs elsewhere is inline.	3 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, comprehensive, and well-structured, explicitly answering both what the skill does and when to use it with a dedicated trigger-phrase list. It is third-person throughout and avoids vague fluff.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions ('Runs SQL queries', 'analyzing network traffic', 'investigating security incidents', 'correlating logs with other data', 'running Athena queries', 'enabling S3 Tables integration') plus a comprehensive enumeration of data sources, giving full coverage of what the skill does.	5 / 5
Completeness	Clearly answers 'what' ('Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables') and 'when' via both an 'Applies when...' clause and explicit 'Trigger phrases:', matching the anchor for explicit what-and-when with concrete triggers.	5 / 5
Trigger Term Quality	Includes explicit 'Trigger phrases:' with natural terms users would say ('query logs with SQL', 'analyze logs in Athena', 'SQL on VPC flow logs', 'investigate network traffic', 'set up log querying'), covering synonyms and concrete service names.	5 / 5
Distinctiveness Conflict Risk	Has a clear niche (SQL on CloudWatch Logs exported to S3 Tables via Athena) with distinct triggers and data-source names that would not reasonably fire for unrelated skills, minimizing conflict risk.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: aws/agent-toolkit-for-aws
Path: skills/specialized-skills/system-table-skills/querying-aws-cloudwatch/SKILL.md
Commit: d6ad2e4

Reviewed: about 2 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.