AWS CloudWatch CLI Skill

This skill builds on the aws-cli skill's profile and region configuration — always pass --profile and --region explicitly on every command, using the same environment table.

Command Format

aws cloudwatch <command> --profile <profile> --region <region> [options]
aws logs <command> --profile <profile> --region <region> [options]

Available Commands

Read-only (safe, no confirmation needed)

Example — Logs Insights query

QUERY_ID=$(aws logs start-query \
  --profile <profile> --region <region> \
  --log-group-name <log-group> \
  --start-time $(( $(date -u +%s) - 3600 )) \
  --end-time $(date -u +%s) \
  --query-string 'fields @timestamp, @message | filter @message like /ERROR/ | limit 50' \
  --query "queryId" --output text)

aws logs get-query-results --profile <profile> --region <region> --query-id "$QUERY_ID"

Mutating operations (confirm with user before running)

Never run — requires explicit human approval

Rules

• Always specify --profile and --region explicitly, per the aws-cli skill's environment table — never rely on defaults.
• If the target environment is unclear, ask the user before running the command.
• NEVER run delete-* commands without explicit user instruction — these are irreversible.
• For filter-log-events/start-query, always bound the time range (--start-time/--end-time) — an unbounded query on a busy log group can be slow and return excessive data.
• If unsure which log group or alarm name is correct, list them first with a read-only call before querying or mutating.
• NEVER read or output any log content that looks like it contains secrets, tokens, or credentials — flag it to the user instead of displaying it verbatim.