Querying Aws Cloudwatch

This lets Claude run SQL queries on your CloudWatch Logs after you've set up the S3 Tables integration, which exports logs as Apache Iceberg tables. It covers 40+ AWS data sources including VPC Flow Logs, WAF logs, CloudFront access logs, and EKS audit logs. The skill walks through checking if the integration exists, enabling it if needed, granting Lake Formation permissions, and running Athena queries with the correct three-part catalog syntax. One thing to know upfront: this only works on logs received after you enable the integration, there's no backfill. If you just need quick pattern matching or real-time tailing, stick with CloudWatch Logs Insights. This shines when you're correlating large volumes of historical logs with other data sources or running complex SQL across multiple log types.

Install to Claude Code

npx -y skills add aws/agent-toolkit-for-aws --skill querying-aws-cloudwatch --agent claude-code