Amazon CloudWatch
Purpose
Investigate and operate AWS CloudWatch metrics, alarms, log groups, and dashboards through connected tools—using correct regions, dimensions, and time ranges.
When to Use
- User asks about CloudWatch alarms, metrics, dashboards, or Logs Insights.
- AWS incident triage where signals live in CloudWatch (EC2, Lambda, ECS, RDS, etc.).
- Creating or tuning alarms and metric filters when write access exists.
- Correlating AWS resource metrics with application logs in CloudWatch Logs.
When NOT to Use
- Non-AWS observability (Datadog, Grafana only) → datadog, grafana.
- Infrastructure provisioning → author-iac, aws-serverless.
- Skill repo authoring → create-skill / publish-skill.
Expected Outcome
- Alarm state, metric datapoints, or log query results from real API/tool output.
- Region, namespace, dimensions, and log group documented in the summary.
- Explicit gaps when credentials, region, or log group access is missing.
Inputs to Gather
- AWS region(s) and account context.
- Alarm name/ARN, metric namespace, dimensions, statistic, period.
- Log group(s) and Logs Insights time range.
- Resource identifiers (Lambda name, ASG, RDS instance, etc.).
Workflow
- Confirm CloudWatch tools and allowed regions.
- Pin timeframe (UTC) and region before any query.
- For alarms: describe alarm → history → underlying metric for window.
- For logs: Logs Insights query with narrow timebox; paginate as tools allow.
- For dashboard edits: fetch definition first; confirm with user on shared ops dashboards.
- Report alarm ARN, metric query, and log group in the summary.
Domain guidance
- Region and namespace — metrics are regional; namespace must match service (
AWS/Lambda, custom, etc.).
- Dimensions — include full dimension set (
FunctionName, ClusterName, …) or queries aggregate incorrectly.
- Alarm types — metric vs composite; check
InsufficientData vs ALARM vs OK.
- Logs Insights — start with fields/filters; bound time; watch scanned volume/cost.
- Tool fidelity — use integration tool names only; never fabricate datapoints or log events.
Typical tasks
| Task |
Approach |
| Alarm triage |
Describe alarm → recent state changes → metric for evaluation periods |
| Metric graph |
List metrics/dimensions → get metric data → highlight anomaly window |
| Log search |
Select log group(s) → Insights query → top patterns + sample lines (redacted) |
Examples
User: "Why is the Lambda errors alarm in us-east-1 firing?"
→ Describe alarm, pull Errors metric for FunctionName, compare threshold across evaluation periods, note concurrent Throttles if relevant.
User: "Find 5xx lines in /aws/lambda/checkout last 30 minutes."
→ Logs Insights on group with time bound, aggregate by @message pattern, return count + sanitized samples.
Tool Availability Rules
| Access |
Behavior |
| Full tool access |
Query and apply approved alarm/dashboard changes. |
| Read-only |
Investigate; output exact CLI/API steps for writes. |
| No integration |
Do not fabricate AWS metrics or log events. |
Related tool sets
Review / Decision / Execution Criteria
- Always state region and namespace in conclusions.
- Treat
InsufficientData as first-class—not equivalent to healthy.
- Confirm alarm threshold or actions changes that page on-call.
Output Format
- Question, region, and time window.
- Alarm/metric/log findings with ARNs or log group names.
- Dimensions and statistics used.
- Blockers (permissions, wrong region).
- Next steps.
Quality Bar
- Evidence-based; suitable for AWS on-call handoff.
- No spreadsheet/A1 patterns—CloudWatch is metrics, alarms, and logs only.
Safety and Boundaries
- Do not expose access keys or sensitive log payloads.
- Confirm destructive alarm actions or dashboard deletes.
- Do not fabricate alarm transitions or metric values.
Escalation / Dispatch Rules
- Broader AWS architecture → aws-serverless, author-iac.
- Multi-vendor dashboards → grafana if CloudWatch is datasource there.
- Post-incident → postmortem-authoring.
References
skills/old_skills.json (cloudwatch) — legacy catalog (Sheets boilerplate removed).skills/skill.instruction.md, skills/meta.instructions.md
1---2name: cloudwatch3description: Queries AWS CloudWatch metrics, alarms, logs, and dashboards via connected credentials. Use when investigating AWS alarms, metric graphs, Logs Insights, or CloudWatch dashboards.4---56# Amazon CloudWatch78## Purpose910Investigate and operate AWS CloudWatch metrics, alarms, log groups, and dashboards through connected tools—using correct regions, dimensions, and time ranges.1112## When to Use1314- User asks about CloudWatch alarms, metrics, dashboards, or Logs Insights.15- AWS incident triage where signals live in CloudWatch (EC2, Lambda, ECS, RDS, etc.).16- Creating or tuning alarms and metric filters when write access exists.17- Correlating AWS resource metrics with application logs in CloudWatch Logs.1819## When NOT to Use2021- Non-AWS observability (Datadog, Grafana only) → **datadog**, **grafana**.22- Infrastructure provisioning → **author-iac**, **aws-serverless**.23- Skill repo authoring → **create-skill** / **publish-skill**.2425## Expected Outcome2627- Alarm state, metric datapoints, or log query results from real API/tool output.28- Region, namespace, dimensions, and log group documented in the summary.29- Explicit gaps when credentials, region, or log group access is missing.3031## Inputs to Gather3233- AWS region(s) and account context.34- Alarm name/ARN, metric namespace, dimensions, statistic, period.35- Log group(s) and Logs Insights time range.36- Resource identifiers (Lambda name, ASG, RDS instance, etc.).3738## Workflow39401. Confirm CloudWatch tools and allowed regions.412. Pin timeframe (UTC) and region before any query.423. For alarms: describe alarm → history → underlying metric for window.434. For logs: Logs Insights query with narrow timebox; paginate as tools allow.445. For dashboard edits: fetch definition first; confirm with user on shared ops dashboards.456. Report alarm ARN, metric query, and log group in the summary.4647## Domain guidance48491. **Region and namespace** — metrics are regional; namespace must match service (`AWS/Lambda`, custom, etc.).502. **Dimensions** — include full dimension set (`FunctionName`, `ClusterName`, …) or queries aggregate incorrectly.513. **Alarm types** — metric vs composite; check `InsufficientData` vs `ALARM` vs `OK`.524. **Logs Insights** — start with fields/filters; bound time; watch scanned volume/cost.535. **Tool fidelity** — use integration tool names only; never fabricate datapoints or log events.5455### Typical tasks5657| Task | Approach |58|------|----------|59| Alarm triage | Describe alarm → recent state changes → metric for evaluation periods |60| Metric graph | List metrics/dimensions → get metric data → highlight anomaly window |61| Log search | Select log group(s) → Insights query → top patterns + sample lines (redacted) |6263### Examples6465**User:** "Why is the Lambda errors alarm in us-east-1 firing?"66→ Describe alarm, pull `Errors` metric for `FunctionName`, compare threshold across evaluation periods, note concurrent `Throttles` if relevant.6768**User:** "Find 5xx lines in `/aws/lambda/checkout` last 30 minutes."69→ Logs Insights on group with time bound, aggregate by `@message` pattern, return count + sanitized samples.7071## Tool Availability Rules7273| Access | Behavior |74|--------|----------|75| Full tool access | Query and apply approved alarm/dashboard changes. |76| Read-only | Investigate; output exact CLI/API steps for writes. |77| No integration | Do not fabricate AWS metrics or log events. |7879### Related tool sets8081- `cloudwatch`82- `custom-apis`8384## Review / Decision / Execution Criteria8586- Always state region and namespace in conclusions.87- Treat `InsufficientData` as first-class—not equivalent to healthy.88- Confirm alarm threshold or actions changes that page on-call.8990## Output Format91921. Question, region, and time window.932. Alarm/metric/log findings with ARNs or log group names.943. Dimensions and statistics used.954. Blockers (permissions, wrong region).965. Next steps.9798## Quality Bar99100- Evidence-based; suitable for AWS on-call handoff.101- No spreadsheet/A1 patterns—CloudWatch is metrics, alarms, and logs only.102103## Safety and Boundaries104105- Do not expose access keys or sensitive log payloads.106- Confirm destructive alarm actions or dashboard deletes.107- Do not fabricate alarm transitions or metric values.108109## Escalation / Dispatch Rules110111- Broader AWS architecture → **aws-serverless**, **author-iac**.112- Multi-vendor dashboards → **grafana** if CloudWatch is datasource there.113- Post-incident → **postmortem-authoring**.114115## References116117- `skills/old_skills.json` (`cloudwatch`) — legacy catalog (Sheets boilerplate removed).118- `skills/skill.instruction.md`, `skills/meta.instructions.md`
poly-gents