New: 97,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Official agent skill

Querying AWS Cloudwatch

by aws in aws/agent-toolkit-for-aws

Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables.

OfficialApache-2.0Auto-check passedDatabases

Install Querying AWS Cloudwatch

skills CLI
$ npx skills add aws/agent-toolkit-for-aws --skill querying-aws-cloudwatch -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install aws/agent-toolkit-for-aws querying-aws-cloudwatch --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/specialized-skills/system-table-skills/querying-aws-cloudwatch .claude/skills/querying-aws-cloudwatch && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
querying-aws-cloudwatch
GitHub stars
2.8k
Token cost
~3.5k tokens
SKILL.md length
1,012 words
Files
1
Skills in repo
138
Repo updated
First seen
Licence
Apache-2.0

At a glance

Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables.

  • Works in 4 steps: Check If Configured → Enable / Configure → Verify Permissions for Querying → …
  • Phrases: query logs with SQL
  • SKILL.md covers Overview, Decision Tree, Supported Data Sources and Common Tasks, plus 4 more sections
  • Calls aws

What it does

Querying AWS Cloudwatch is an agent skill from aws/agent-toolkit-for-aws, published by the product's own GitHub organization. Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables. Covers VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, Network Firewall logs, EKS audit logs, Verified Access logs, SES logs, VPC Lattice logs, Step Functions logs, NLB access logs, and 20+ other AWS vended data sources. Applies when analyzing network traffic, investigating security incidents, querying exported logs with SQL, enabling S3 Tables integration, configuring log export, correlating logs…

Its SKILL.md is about 3.5k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Databases, covering SQL, File uploads and storage and GraphQL. It works with Amazon Web Services and SQL. The repository describes itself as: Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS. The licence is Apache-2.0.

When your agent uses it

  • Phrases: query logs with SQL
  • Analyze logs in Athena
  • SQL on VPC flow logs
  • Investigate network traffic

Example prompts

  • “/querying-aws-cloudwatch”

Workflow steps

4 steps, taken from the step headings in SKILL.md.

  1. Check If Configured
  2. Enable / Configure
  3. Verify Permissions for Querying
  4. Query

What it can do on your machine

Read from SKILL.md and the folder at commit bd49cc8. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • aws

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • docs.aws.amazon.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Querying AWS Cloudwatch loads about 3.5k tokens when it runs. Until then it costs about 213 tokens; SKILL.md has 1,012 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~213
When it runs · the whole SKILL.md, loaded when a task matches
~3.5k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from aws/agent-toolkit-for-aws at commit bd49cc8, republished under its Apache-2.0 licence (© aws). 1,012 words, ~3,469 tokens.

Download SKILL.mdSave it as .claude/skills/querying-aws-cloudwatch/SKILL.md (or your agent's skills folder).
name
querying-aws-cloudwatch
description
Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables. Covers VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, Network Firewall logs, EKS audit logs, Verified Access logs, SES logs, VPC Lattice logs, Step Functions logs, NLB access logs, and 20+ other AWS vended data sources. Applies when analyzing network traffic, investigating security incidents, querying exported logs with SQL, enabling S3 Tables integration, configuring log export, correlating logs with other data, or running Athena queries on the aws-cloudwatch table bucket. Trigger phrases: query logs with SQL, analyze logs in Athena, SQL on VPC flow logs, investigate network traffic, run SQL on exported logs, enable S3 Tables for CloudWatch, correlate logs, historical log analysis, set up log querying.
version
1
argument-hint
[query|data-source-name|'configure'|'status']

Query AWS CloudWatch System Tables

Overview

Works best with the AWS MCP server for sandboxed execution and audit logging. All commands below use the AWS CLI and work in any environment with configured AWS credentials.

The CloudWatch Logs S3 Tables integration exports log data as Apache Iceberg tables in the AWS-managed aws-cloudwatch table bucket. This enables SQL analysis via Amazon Athena and correlation of log data with non-CloudWatch data (S3 metadata, business tables, etc.). Available at no additional storage charge beyond CloudWatch ingestion pricing.

Decision Tree

User intentUse this skill?Alternative
Run SQL across large volumes of log dataYes—
Correlate logs with S3 metadata or other tablesYes — join across catalogs—
Quick log search / pattern matchingNoCloudWatch Logs Insights (faster for ad-hoc)
Real-time log streaming/tailingNoCloudWatch Logs console or logs filter-log-events
Set up alarms on log patternsNoCloudWatch Metric Filters / Alarms
Query historical logs before integration was enabledNoCloudWatch Logs (no backfill in S3 Tables)

Supported Data Sources

The following data sources are available through the S3 Tables integration. Each data source has a namespace pattern used in SQL queries. Not all AWS vended data sources may be available in all Regions; check the CloudWatch console Data Sources tab for current availability.

Data SourceNamespace patternCommon use case
VPC Flow Logsamazon_vpc__flowNetwork traffic analysis, rejected connections
WAF Logsaws_waf__logsBlocked requests, rule hit analysis
CloudFront Access Logsamazon_cloudfront__accessCDN traffic patterns, error rates
Route 53 Resolver Query Logsamazon_route53resolver__queryDNS query analysis
Network Firewall Logsaws_networkfirewall__logsFirewall rule hits, dropped traffic
EKS Audit Logsamazon_eks__auditKubernetes API audit trail
Verified Access Logsamazon_verifiedaccess__logsZero-trust access decisions
SES Mail Logsamazon_ses__mailEmail delivery/bounce tracking
VPC Lattice Access Logsamazon_vpclattice__accessService-to-service access patterns
Step Functions Logsaws_stepfunctions__logsWorkflow execution debugging
Global Accelerator Flow Logsaws_globalaccelerator__flowGlobal network traffic
NLB Access Logselastic_load_balancing__nlb_accessLoad balancer request tracing
Shield Logsaws_shield__logsDDoS mitigation events
Cognito Logsamazon_cognito__logsAuth/identity operations
ElastiCache Logsamazon_elasticache__logsRedis slow log, engine log
SageMaker Logsamazon_sagemaker__logsML training/inference events
WorkMail Audit Logsamazon_workmail__auditEmail security/compliance
Bedrock Agent Logsaws_bedrock_agent_core__logsAI agent invocations
Client VPN Logsaws_client_vpn__connectionsVPN connection tracking
Entity Resolution Logsaws_entity_resolution__logsRecord matching operations
MediaPackage Access Logsaws_elemental_mediapackage__accessStreaming delivery metrics
MediaTailor Logsaws_elemental_mediatailor__logsAd insertion events
Transfer Family Logsaws_transfer_family__logsSFTP/FTPS file transfer tracking
Site-to-Site VPN Logsaws_site_to_site_vpn__logsVPN tunnel diagnostics

Note: This table lists the 24 most commonly queried data sources. The integration supports 43+ AWS vended data sources in total. Use list-namespaces on the aws-cloudwatch bucket to discover all available data sources in your account. Namespace patterns follow the convention <service>__<type>.

Common Tasks

1. Check If Configured
bash
# Check if the aws-cloudwatch table bucket exists
aws s3tables list-table-buckets --region <REGION> \
  --query "tableBuckets[?name=='aws-cloudwatch']"
  • Empty result → integration not enabled. Guide user through setup.
  • Bucket exists but no namespaces → integration enabled but no log data yet (only captures events after association).

List available tables:

bash
aws s3tables list-namespaces --table-bucket-arn arn:aws:s3tables:<REGION>:<ACCOUNT>:bucket/aws-cloudwatch --region <REGION>

aws s3tables list-tables --table-bucket-arn arn:aws:s3tables:<REGION>:<ACCOUNT>:bucket/aws-cloudwatch --namespace <NAMESPACE> --region <REGION>
2. Enable / Configure

Create integration:

bash
aws observabilityadmin create-s3-table-integration \
  --region <REGION> \
  --encryption '{"SseAlgorithm": "aws:kms", "KmsKeyArn": "<KMS_KEY_ARN>"}' \
  --role-arn <SERVICE_ROLE_ARN>

Associate a specific data source (recommended):

bash
aws logs associate-source-to-s3-table-integration \
  --region <REGION> \
  --integration-arn <INTEGRATION_ARN> \
  --data-source '{"name": "<source-name>", "type": "<source-type>"}'

Associate all data sources (wildcard):

⚠️ Warning: Wildcard association delivers all current and future data sources to S3 Tables. Use specific associations for tighter control over what log data lands in queryable tables.

bash
aws logs associate-source-to-s3-table-integration \
  --region <REGION> \
  --integration-arn <INTEGRATION_ARN> \
  --data-source '{"name": "*", "type": "*"}'

For IAM requirements (service role trust policy, permissions policy, condition keys), see Security Considerations below.

3. Verify Permissions for Querying

Requires:

  • S3 Tables federated catalog registered in Glue (s3tablescatalog)
  • Lake Formation SELECT + DESCRIBE grants on the table (or IAM-only mode in supported regions)
  • Athena execution permissions

Grant access:

bash
aws lakeformation grant-permissions \
  --principal DataLakePrincipalIdentifier=<ROLE_ARN> \
  --resource '{"Table": {"CatalogId": "<ACCOUNT>:s3tablescatalog/aws-cloudwatch", "DatabaseName": "<NAMESPACE>", "Name": "<TABLE>"}}' \
  --permissions DESCRIBE SELECT \
  --region <REGION>
Show full SKILL.md (461 more words)Show less
4. Query

Query syntax:

sql
"s3tablescatalog/aws-cloudwatch"."<namespace>"."<table>"

Constraints:

  • You MUST ALWAYS run get-tables on the target namespace and include the command in your response before writing any SQL query — schemas vary by data source. Never skip this step even if you already know the likely schema. Run get-tables once on the target namespace (one call returns all tables + columns + types + descriptions):

    aws glue get-tables --catalog-id "<ACCOUNT>:s3tablescatalog/aws-cloudwatch" --database-name "<namespace>" --region <REGION>

  • You MUST confirm workgroup and output location before executing

  • You MUST inform user that only logs received after association are available (no backfill)

Example — VPC Flow Logs rejected traffic:

sql
SELECT srcaddr, dstaddr, dstport, protocol, packets, bytes
FROM "s3tablescatalog/aws-cloudwatch"."amazon_vpc__flow"."<table>"
WHERE action = 'REJECT'
ORDER BY bytes DESC
LIMIT 50;

Example — WAF blocked requests:

sql
SELECT timestamp, action, terminatingRuleId, httpSourceId
FROM "s3tablescatalog/aws-cloudwatch"."aws_waf__logs"."<table>"
WHERE action = 'BLOCK'
ORDER BY timestamp DESC
LIMIT 50;

Example — correlate VPC Flow Logs with S3 object metadata:

sql
SELECT f.srcaddr, f.dstaddr, f.bytes, j.key, j.record_type
FROM "s3tablescatalog/aws-cloudwatch"."amazon_vpc__flow"."<table>" f
JOIN "s3tablescatalog/aws-s3"."b_<bucket>"."journal" j
  ON f.srcaddr = j.source_ip_address
WHERE j.record_type = 'CREATE'
  AND f.action = 'ACCEPT';

Key Behaviors

  • No backfill — only new log events after association are delivered to S3 Tables
  • Retention follows log group — when log group retention expires, data is removed from the table
  • Deleting a log group removes its data from the S3 table
  • No additional storage charge — included in CloudWatch pricing
  • Schemas are per-data-source — always run get-tables on the target namespace before building complex queries

Troubleshooting

ErrorCauseFix
aws-cloudwatch bucket not foundIntegration not createdRun create-s3-table-integration
Bucket exists but no namespacesNo data sources associated, or no log traffic since associationAssociate sources; generate traffic
CATALOG_NOT_FOUND in AthenaS3 Tables not registered in GlueEnable integration: S3 console > Table buckets > Enable integration
AccessDenied on queryMissing Lake Formation grants or IAM permissionsSee Security Considerations below
Empty resultsLogs only flow after association; no backfillConfirm association exists and log source is actively generating data
Schema mismatch / column not foundLog type schema updated by AWSRun get-tables on the namespace to get current columns

Security Considerations

Service Role Trust Policy

The service role must allow logs.amazonaws.com to assume it. Always include aws:SourceAccount and aws:SourceArn condition keys to prevent confused deputy attacks:

json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "logs.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "<ACCOUNT>"
                },
                "ArnLike": {
                    "aws:SourceArn": ["arn:aws:logs:<REGION>:<ACCOUNT>:log-group:<LOG_GROUP_NAME>"]
                }
            }
        }
    ]
}
Service Role Permissions Policy
json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": ["logs:integrateWithS3Table"],
            "Resource": ["arn:aws:logs:<REGION>:<ACCOUNT>:log-group:<LOG_GROUP_NAME>"],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceAccount": "<ACCOUNT>"
                }
            }
        }
    ]
}
KMS Key Policy (for encrypted data)

If using a customer managed KMS key, grant both service principals access:

json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EnableSystemTablesKeyUsage",
            "Effect": "Allow",
            "Principal": {"Service": "systemtables.cloudwatch.amazonaws.com"},
            "Action": ["kms:DescribeKey", "kms:GenerateDataKey", "kms:Decrypt"],
            "Resource": "arn:aws:kms:<REGION>:<ACCOUNT>:key/<KEY_ID>",
            "Condition": {"StringEquals": {"aws:SourceAccount": "<ACCOUNT>"}}
        },
        {
            "Sid": "EnableS3TablesMaintenanceKeyUsage",
            "Effect": "Allow",
            "Principal": {"Service": "maintenance.s3tables.amazonaws.com"},
            "Action": ["kms:GenerateDataKey", "kms:Decrypt"],
            "Resource": "arn:aws:kms:<REGION>:<ACCOUNT>:key/<KEY_ID>",
            "Condition": {"StringLike": {"kms:EncryptionContext:aws:s3:arn": "<TABLE_OR_TABLE_BUCKET_ARN>/*"}}
        }
    ]
}
Data Sensitivity

Log data may contain PII including IP addresses, user agents, request parameters, and authentication tokens. Treat all exported log tables as sensitive by default.

Access Control Best Practices
  • Use Lake Formation column-level security to restrict access to sensitive columns (e.g., srcaddr, source_ip_address, httpRequest). Grant permissions to specific tables and columns rather than wildcards.
  • Configure SSE-KMS encryption on the Athena workgroup output bucket to protect query results at rest.
  • Prefer specific data source associations over wildcard (*/*) to limit which data sources are exported to queryable tables.
Audit Trail

Enable CloudTrail logging for Athena (StartQueryExecution, GetQueryResults) and Lake Formation (GrantPermissions, RevokePermissions) API calls to maintain an audit trail of who queried what data.

Additional Resources

© aws, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/specialized-skills/system-table-skills/querying-aws-cloudwatch of aws/agent-toolkit-for-aws.

Open the folder on GitHubat commit bd49cc8

Compare with similar skills

Querying AWS Cloudwatch next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Querying AWS Cloudwatch compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Querying AWS Cloudwatch this skillaws/agent-toolkit-for-aws2.8k—~3.5kAutomated safety check: PassApache-2.0
Ops Telemetry Queryboundless-xyz/boundless193—~3.8kAutomated safety check: PassApache-2.0
Azure Resource Manager SQL Dotnetmicrosoft/skills3.1k6 repos~2.6kAutomated safety check: PassMIT
Performing Cloud Forensics With AWS Cloudtrailmukul975/Anthropic-Cybersecurity-Skills34k—~845Automated safety check: PassApache-2.0
Performing Cloud Log Forensics With Athenamukul975/Anthropic-Cybersecurity-Skills34k—~3.7kAutomated safety check: PassApache-2.0
Chdb SQLvemetric/vemetric3941 repos~1.2kAutomated safety check: PassApache-2.0

Similar skills

  • Ops Telemetry Query

    boundless-xyz/boundless

    Internal — for Boundless team members only. An agent skill from boundless-xyz/boundless.

    193 GitHub stars~3.8k tokensUpdated 1 mo ago
    DatabasesAuto-check passed

  • Azure Resource Manager SQL Dotnet

    microsoft/skills

    Official

    Azure Resource Manager SDK for Azure SQL in .NET. An agent skill from microsoft/skills.

    3.1k GitHub starsUsed in 6 repos~2.6k tokens
    DevOps & CloudAuto-check passed

  • Performing Cloud Forensics With AWS Cloudtrail

    mukul975/Anthropic-Cybersecurity-Skills

    Investigate AWS account compromise by querying CloudTrail with boto3's LookupEvents or AWS Athena SQL over S3-delivered logs, filtering on suspicious user agents, source IPs, and event names to…

    34k GitHub stars~845 tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Performing Cloud Log Forensics With Athena

    mukul975/Anthropic-Cybersecurity-Skills

    Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs, and ALB logs for forensic investigation.

    34k GitHub stars~3.7k tokensUpdated 1 mo ago
    SecurityAuto-check passed

  • Chdb SQL

    vemetric/vemetric

    A skill your agent uses when the user wants to run SQL — especially analytical SQL — on local files (parquet/csv/json), URLs, S3 paths, or remote databases (Postgres, MySQL, MongoDB, ClickHouse…

    394 GitHub starsUsed in 1 repo~1.2k tokens
    DatabasesAuto-check passed

  • Rhctl

    saidake/rhctl

    Run and author rhctl CLI workflows and remote environment scripts under scripts/ (PostgreSQL, JetStream, Docker, Redis, MongoDB, AWS LocalStack, execute/upload/patch).

    106 GitHub stars~4k tokensUpdated yesterday
    DatabasesAuto-check: notes

More from aws/agent-toolkit-for-aws

All 138 skills in this repo

  • Agent Advisor

    aws/agent-toolkit-for-aws

    Official

    Entry point for AI-agent work on AWS: pick a runtime, plan a migration for existing workloads, and build an executable POC — one phased flow.

    2.8k GitHub stars~4.9k tokensUpdated today
    Auto-check passed

  • Agents Build

    aws/agent-toolkit-for-aws

    Official

    A skill your agent uses to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal.

    2.8k GitHub stars~2.3k tokensUpdated today
    Auto-check: notes

  • Launch With AWS

    aws/agent-toolkit-for-aws

    Official

    Migrates vibe-coded web applications to AWS. An agent skill from aws/agent-toolkit-for-aws.

    2.8k GitHub stars~3.2k tokensUpdated today
    Auto-check passed

  • Processing S3 Uploads With Step Functions

    aws/agent-toolkit-for-aws

    Official

    Deploy an event-driven workflow that routes S3 uploads to either Lambda or Fargate via Step Functions based on file size.

    2.8k GitHub stars~4k tokensUpdated today
    Auto-check passed

  • AWS Marketplace Metering

    aws/agent-toolkit-for-aws

    Official

    Deploys, queries, and debugs AWS Marketplace usage-based (PAYG) metering — the pipeline (ResolveCustomer, BatchMeterUsage, EventBridge via SAM) and querying/debugging metering records, statuses…

    2.8k GitHub stars~18k tokensUpdated today
    Auto-check passed

  • Agents Pay

    aws/agent-toolkit-for-aws

    Official

    A skill your agent uses when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying operator-defined spend limits.

    2.8k GitHub stars~6.5k tokensUpdated today
    Auto-check: notes

Works with

Categories

Questions about Querying AWS Cloudwatch

What does Querying AWS Cloudwatch do?

Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables. Querying AWS Cloudwatch is an agent skill from aws/agent-toolkit-for-aws, published by the product's own GitHub organization. Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables.

When should I use Querying AWS Cloudwatch?

Querying AWS Cloudwatch fits situations like: phrases: query logs with SQL; analyze logs in Athena; SQL on VPC flow logs; investigate network traffic.

How do I install Querying AWS Cloudwatch in Claude Code?

Run `npx skills add aws/agent-toolkit-for-aws --skill querying-aws-cloudwatch -a claude-code`. Or copy the skill folder (skills/specialized-skills/system-table-skills/querying-aws-cloudwatch in aws/agent-toolkit-for-aws) into .claude/skills/querying-aws-cloudwatch in your project. Claude Code loads it when a task matches its description.

How do I install Querying AWS Cloudwatch in Codex?

Run `npx skills add aws/agent-toolkit-for-aws --skill querying-aws-cloudwatch -a codex`. Or copy the skill folder (skills/specialized-skills/system-table-skills/querying-aws-cloudwatch in aws/agent-toolkit-for-aws) into .agents/skills/querying-aws-cloudwatch in your project. Codex loads it when a task matches its description.

Can I use Querying AWS Cloudwatch in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add aws/agent-toolkit-for-aws --skill querying-aws-cloudwatch -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/querying-aws-cloudwatch, .gemini/skills/querying-aws-cloudwatch, .github/skills/querying-aws-cloudwatch and .opencode/skills/querying-aws-cloudwatch in your project.

What does Querying AWS Cloudwatch need to run?

Going by SKILL.md and its folder, Querying AWS Cloudwatch needs the command-line tools its instructions call (aws).

Does Querying AWS Cloudwatch access the network?

SKILL.md names 1 domain. As links in the text: docs.aws.amazon.com. This is read from the text; nothing was executed.

Is Querying AWS Cloudwatch safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Querying AWS Cloudwatch use?

Querying AWS Cloudwatch is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Querying AWS Cloudwatch use?

About 3.5k tokens (SKILL.md is roughly 14k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Querying AWS Cloudwatch?

Skills that share tags, products or a category with Querying AWS Cloudwatch: Ops Telemetry Query (boundless-xyz/boundless, 193 stars), Azure Resource Manager SQL Dotnet (microsoft/skills, 3.1k stars), Performing Cloud Forensics With AWS Cloudtrail (mukul975/Anthropic-Cybersecurity-Skills, 34k stars) and Performing Cloud Log Forensics With Athena (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Querying AWS Cloudwatch?

aws (a GitHub organization, an official publisher) maintains it in aws/agent-toolkit-for-aws, which has 2,816 GitHub stars. The repository holds 138 skills in this directory. The repository was last updated on October 7, 2026.

Source: aws/agent-toolkit-for-aws on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.