Agent skill · data analytics · github
aws-cloudwatch-investigation
Reusable investigation patterns for AWS CloudWatch: Logs Insights query templates, alarm-to-deployment correlation, blast-radius narrowing decision tree, and PromQL-style metric query patterns for structured incident triage.
Why this skill is useful
Provides specific AWS CloudWatch Logs Insights query patterns and correlation processes that the AI wouldn't reliably generate on its own.
What it needs
Requires aws account access. About 5k tokens when loaded. Last updated 2026-08-07. 37,534 stars on the source repository.
What this skill does
AWS CloudWatch Investigation Skill Reusable patterns for investigating production incidents using CloudWatch Logs, Metrics, and Alarms. These patterns are designed to be composed together during incident triage. --- Pattern 1: Logs Insights Query Templates Error Spike Detection Find the top errors in a time window, grouped by error type: P99 Latency Breakdown by Operation Identify which operations are driving latency spikes: Lambda Cold Start Detection Quantify cold start impact during an incident: Out-of-Memory (OOM) Detection Find Lambda functions or containers killed by memory pressure: For memory utilization trending before OOM: Timeout Detection Find invocations that hit the configured timeout: --- Pattern 2: Alarm History to Deploy-Event Correlation Process 1. Get alarm transition time — note the exact timestamp when the alarm entered ALARM state. 2. Query CloudTrail for deployment-related events in a window of [alarmtime - 30min, alarmtime]: 3. Correlation criteria — a deploy is "correlated" if: It targets the same service/resource as the alarm It completed within 15 minutes before the alarm transition The deployer identity matches a CI/CD role (not a human applying a hotfix) 4. Strengthening the correlation: Check if the same alarm was healthy in the previous deployment cycle Verify no other environmental changes (scaling events, config changes) in the same window Look for canary/synthetic monitor failures that started at the same time Output Format --- Pattern 3: Narrow the Blast Radius Decision Tree Use this tree to systematically scope an incident from broadest to most specific: Shared Dependency Investigation When blast radius spans multiple services, investigate in this order: 1. VPC/Networking — NAT Gateway ErrorPortAllocation, packet drops, DNS resolution failures 2. IAM/STS — ThrottlingException on AssumeRole, token vending latency 3. Downstream dependency — shared database, cache, or external API 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills github/aws-cloudwatch-investigation