[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-querying-aws-cloudwatch":3,"mdc--hcf6n2-key":38,"related-org-aws-querying-aws-cloudwatch":3967,"related-repo-aws-querying-aws-cloudwatch":4140},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":27,"repoUrl":28,"updatedAt":29,"license":30,"forks":31,"topics":32,"repo":33,"sourceUrl":36,"mdContent":37},"querying-aws-cloudwatch","query CloudWatch logs with SQL","Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables. Covers VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, Network Firewall logs, EKS audit logs, Verified Access logs, SES logs, VPC Lattice logs, Step Functions logs, NLB access logs, and 20+ other AWS vended data sources. Applies when analyzing network traffic, investigating security incidents, querying exported logs with SQL, enabling S3 Tables integration, configuring log export, correlating logs with other data, or running Athena queries on the aws-cloudwatch table bucket. Trigger phrases: query logs with SQL, analyze logs in Athena, SQL on VPC flow logs, investigate network traffic, run SQL on exported logs, enable S3 Tables for CloudWatch, correlate logs, historical log analysis, set up log querying.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22,25],{"name":13,"slug":14,"type":15},"Logs","logs","tag",{"name":17,"slug":18,"type":15},"Monitoring","monitoring",{"name":20,"slug":21,"type":15},"Cloud","cloud",{"name":23,"slug":24,"type":15},"SQL","sql",{"name":26,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-07-12T08:43:48.977064",null,157,[],{"repoUrl":28,"stars":27,"forks":31,"topics":34,"description":35},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fspecialized-skills\u002Fsystem-table-skills\u002Fquerying-aws-cloudwatch","---\nname: querying-aws-cloudwatch\ndescription: >-\n  Runs SQL queries on CloudWatch Logs data exported as Apache Iceberg tables in S3 Tables.\n  Covers VPC Flow Logs, WAF logs, CloudFront access logs, Route 53 resolver logs, Network\n  Firewall logs, EKS audit logs, Verified Access logs, SES logs, VPC Lattice logs, Step\n  Functions logs, NLB access logs, and 20+ other AWS vended data sources. Applies when\n  analyzing network traffic, investigating security incidents, querying exported logs with\n  SQL, enabling S3 Tables integration, configuring log export, correlating logs with other\n  data, or running Athena queries on the aws-cloudwatch table bucket. Trigger phrases: query\n  logs with SQL, analyze logs in Athena, SQL on VPC flow logs, investigate network traffic,\n  run SQL on exported logs, enable S3 Tables for CloudWatch, correlate logs, historical log\n  analysis, set up log querying.\nversion: 1\nargument-hint: \"[query|data-source-name|'configure'|'status']\"\n---\n\n# Query AWS CloudWatch System Tables\n\n## Overview\n\n**Works best with** the [AWS MCP server](https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002F) for sandboxed execution and audit logging. All commands below use the AWS CLI and work in any environment with configured AWS credentials.\n\nThe CloudWatch Logs S3 Tables integration exports log data as Apache Iceberg tables in the AWS-managed `aws-cloudwatch` table bucket. This enables SQL analysis via Amazon Athena and correlation of log data with non-CloudWatch data (S3 metadata, business tables, etc.). Available at no additional storage charge beyond CloudWatch ingestion pricing.\n\n## Decision Tree\n\n| User intent | Use this skill? | Alternative |\n|---|---|---|\n| Run SQL across large volumes of log data | **Yes** | — |\n| Correlate logs with S3 metadata or other tables | **Yes** — join across catalogs | — |\n| Quick log search \u002F pattern matching | **No** | CloudWatch Logs Insights (faster for ad-hoc) |\n| Real-time log streaming\u002Ftailing | **No** | CloudWatch Logs console or `logs filter-log-events` |\n| Set up alarms on log patterns | **No** | CloudWatch Metric Filters \u002F Alarms |\n| Query historical logs before integration was enabled | **No** | CloudWatch Logs (no backfill in S3 Tables) |\n\n## Supported Data Sources\n\nThe following data sources are available through the S3 Tables integration. Each data source has a namespace pattern used in SQL queries. Not all AWS vended data sources may be available in all Regions; check the CloudWatch console Data Sources tab for current availability.\n\n| Data Source | Namespace pattern | Common use case |\n|---|---|---|\n| VPC Flow Logs | `amazon_vpc__flow` | Network traffic analysis, rejected connections |\n| WAF Logs | `aws_waf__logs` | Blocked requests, rule hit analysis |\n| CloudFront Access Logs | `amazon_cloudfront__access` | CDN traffic patterns, error rates |\n| Route 53 Resolver Query Logs | `amazon_route53resolver__query` | DNS query analysis |\n| Network Firewall Logs | `aws_networkfirewall__logs` | Firewall rule hits, dropped traffic |\n| EKS Audit Logs | `amazon_eks__audit` | Kubernetes API audit trail |\n| Verified Access Logs | `amazon_verifiedaccess__logs` | Zero-trust access decisions |\n| SES Mail Logs | `amazon_ses__mail` | Email delivery\u002Fbounce tracking |\n| VPC Lattice Access Logs | `amazon_vpclattice__access` | Service-to-service access patterns |\n| Step Functions Logs | `aws_stepfunctions__logs` | Workflow execution debugging |\n| Global Accelerator Flow Logs | `aws_globalaccelerator__flow` | Global network traffic |\n| NLB Access Logs | `elastic_load_balancing__nlb_access` | Load balancer request tracing |\n| Shield Logs | `aws_shield__logs` | DDoS mitigation events |\n| Cognito Logs | `amazon_cognito__logs` | Auth\u002Fidentity operations |\n| ElastiCache Logs | `amazon_elasticache__logs` | Redis slow log, engine log |\n| SageMaker Logs | `amazon_sagemaker__logs` | ML training\u002Finference events |\n| WorkMail Audit Logs | `amazon_workmail__audit` | Email security\u002Fcompliance |\n| Bedrock Agent Logs | `aws_bedrock_agent_core__logs` | AI agent invocations |\n| Client VPN Logs | `aws_client_vpn__connections` | VPN connection tracking |\n| Entity Resolution Logs | `aws_entity_resolution__logs` | Record matching operations |\n| MediaPackage Access Logs | `aws_elemental_mediapackage__access` | Streaming delivery metrics |\n| MediaTailor Logs | `aws_elemental_mediatailor__logs` | Ad insertion events |\n| Transfer Family Logs | `aws_transfer_family__logs` | SFTP\u002FFTPS file transfer tracking |\n| Site-to-Site VPN Logs | `aws_site_to_site_vpn__logs` | VPN tunnel diagnostics |\n\n> **Note**: This table lists the 24 most commonly queried data sources. The integration supports 43+ AWS vended data sources in total. Use `list-namespaces` on the `aws-cloudwatch` bucket to discover all available data sources in your account. Namespace patterns follow the convention `\u003Cservice>__\u003Ctype>`.\n\n## Common Tasks\n\n### 1. Check If Configured\n\n```bash\n# Check if the aws-cloudwatch table bucket exists\naws s3tables list-table-buckets --region \u003CREGION> \\\n  --query \"tableBuckets[?name=='aws-cloudwatch']\"\n```\n\n- Empty result → integration not enabled. Guide user through setup.\n- Bucket exists but no namespaces → integration enabled but no log data yet (only captures events *after* association).\n\nList available tables:\n\n```bash\naws s3tables list-namespaces --table-bucket-arn arn:aws:s3tables:\u003CREGION>:\u003CACCOUNT>:bucket\u002Faws-cloudwatch --region \u003CREGION>\n\naws s3tables list-tables --table-bucket-arn arn:aws:s3tables:\u003CREGION>:\u003CACCOUNT>:bucket\u002Faws-cloudwatch --namespace \u003CNAMESPACE> --region \u003CREGION>\n```\n\n### 2. Enable \u002F Configure\n\n**Create integration:**\n\n```bash\naws observabilityadmin create-s3-table-integration \\\n  --region \u003CREGION> \\\n  --encryption '{\"SseAlgorithm\": \"aws:kms\", \"KmsKeyArn\": \"\u003CKMS_KEY_ARN>\"}' \\\n  --role-arn \u003CSERVICE_ROLE_ARN>\n```\n\n**Associate a specific data source (recommended):**\n\n```bash\naws logs associate-source-to-s3-table-integration \\\n  --region \u003CREGION> \\\n  --integration-arn \u003CINTEGRATION_ARN> \\\n  --data-source '{\"name\": \"\u003Csource-name>\", \"type\": \"\u003Csource-type>\"}'\n```\n\n**Associate all data sources (wildcard):**\n\n> ⚠️ **Warning**: Wildcard association delivers all current and future data sources to S3 Tables. Use specific associations for tighter control over what log data lands in queryable tables.\n\n```bash\naws logs associate-source-to-s3-table-integration \\\n  --region \u003CREGION> \\\n  --integration-arn \u003CINTEGRATION_ARN> \\\n  --data-source '{\"name\": \"*\", \"type\": \"*\"}'\n```\n\nFor IAM requirements (service role trust policy, permissions policy, condition keys), see [Security Considerations](#security-considerations) below.\n\n### 3. Verify Permissions for Querying\n\nRequires:\n\n- S3 Tables federated catalog registered in Glue (`s3tablescatalog`)\n- Lake Formation SELECT + DESCRIBE grants on the table (or IAM-only mode in supported regions)\n- Athena execution permissions\n\nGrant access:\n\n```bash\naws lakeformation grant-permissions \\\n  --principal DataLakePrincipalIdentifier=\u003CROLE_ARN> \\\n  --resource '{\"Table\": {\"CatalogId\": \"\u003CACCOUNT>:s3tablescatalog\u002Faws-cloudwatch\", \"DatabaseName\": \"\u003CNAMESPACE>\", \"Name\": \"\u003CTABLE>\"}}' \\\n  --permissions DESCRIBE SELECT \\\n  --region \u003CREGION>\n```\n\n### 4. Query\n\n**Query syntax:**\n\n```sql\n\"s3tablescatalog\u002Faws-cloudwatch\".\"\u003Cnamespace>\".\"\u003Ctable>\"\n```\n\n**Constraints:**\n\n- You MUST ALWAYS run get-tables on the target namespace and include the command in your response before writing any SQL query — schemas vary by data source. Never skip this step even if you already know the likely schema. Run `get-tables` once on the target namespace (one call returns all tables + columns + types + descriptions):\n\n  ```\n  aws glue get-tables --catalog-id \"\u003CACCOUNT>:s3tablescatalog\u002Faws-cloudwatch\" --database-name \"\u003Cnamespace>\" --region \u003CREGION>\n  ```\n\n- You MUST confirm workgroup and output location before executing\n- You MUST inform user that only logs received *after* association are available (no backfill)\n\n**Example — VPC Flow Logs rejected traffic:**\n\n```sql\nSELECT srcaddr, dstaddr, dstport, protocol, packets, bytes\nFROM \"s3tablescatalog\u002Faws-cloudwatch\".\"amazon_vpc__flow\".\"\u003Ctable>\"\nWHERE action = 'REJECT'\nORDER BY bytes DESC\nLIMIT 50;\n```\n\n**Example — WAF blocked requests:**\n\n```sql\nSELECT timestamp, action, terminatingRuleId, httpSourceId\nFROM \"s3tablescatalog\u002Faws-cloudwatch\".\"aws_waf__logs\".\"\u003Ctable>\"\nWHERE action = 'BLOCK'\nORDER BY timestamp DESC\nLIMIT 50;\n```\n\n**Example — correlate VPC Flow Logs with S3 object metadata:**\n\n```sql\nSELECT f.srcaddr, f.dstaddr, f.bytes, j.key, j.record_type\nFROM \"s3tablescatalog\u002Faws-cloudwatch\".\"amazon_vpc__flow\".\"\u003Ctable>\" f\nJOIN \"s3tablescatalog\u002Faws-s3\".\"b_\u003Cbucket>\".\"journal\" j\n  ON f.srcaddr = j.source_ip_address\nWHERE j.record_type = 'CREATE'\n  AND f.action = 'ACCEPT';\n```\n\n## Key Behaviors\n\n- **No backfill** — only new log events after association are delivered to S3 Tables\n- **Retention follows log group** — when log group retention expires, data is removed from the table\n- **Deleting a log group** removes its data from the S3 table\n- **No additional storage charge** — included in CloudWatch pricing\n- **Schemas are per-data-source** — always run `get-tables` on the target namespace before building complex queries\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|-------|-------|-----|\n| `aws-cloudwatch` bucket not found | Integration not created | Run `create-s3-table-integration` |\n| Bucket exists but no namespaces | No data sources associated, or no log traffic since association | Associate sources; generate traffic |\n| `CATALOG_NOT_FOUND` in Athena | S3 Tables not registered in Glue | Enable integration: S3 console > Table buckets > Enable integration |\n| `AccessDenied` on query | Missing Lake Formation grants or IAM permissions | See Security Considerations below |\n| Empty results | Logs only flow after association; no backfill | Confirm association exists and log source is actively generating data |\n| Schema mismatch \u002F column not found | Log type schema updated by AWS | Run `get-tables` on the namespace to get current columns |\n\n## Security Considerations\n\n### Service Role Trust Policy\n\nThe service role must allow `logs.amazonaws.com` to assume it. Always include `aws:SourceAccount` and `aws:SourceArn` condition keys to prevent confused deputy attacks:\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Service\": \"logs.amazonaws.com\"\n            },\n            \"Action\": \"sts:AssumeRole\",\n            \"Condition\": {\n                \"StringEquals\": {\n                    \"aws:SourceAccount\": \"\u003CACCOUNT>\"\n                },\n                \"ArnLike\": {\n                    \"aws:SourceArn\": [\"arn:aws:logs:\u003CREGION>:\u003CACCOUNT>:log-group:\u003CLOG_GROUP_NAME>\"]\n                }\n            }\n        }\n    ]\n}\n```\n\n### Service Role Permissions Policy\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\"logs:integrateWithS3Table\"],\n            \"Resource\": [\"arn:aws:logs:\u003CREGION>:\u003CACCOUNT>:log-group:\u003CLOG_GROUP_NAME>\"],\n            \"Condition\": {\n                \"StringEquals\": {\n                    \"aws:ResourceAccount\": \"\u003CACCOUNT>\"\n                }\n            }\n        }\n    ]\n}\n```\n\n### KMS Key Policy (for encrypted data)\n\nIf using a customer managed KMS key, grant both service principals access:\n\n```json\n{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"EnableSystemTablesKeyUsage\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\"Service\": \"systemtables.cloudwatch.amazonaws.com\"},\n            \"Action\": [\"kms:DescribeKey\", \"kms:GenerateDataKey\", \"kms:Decrypt\"],\n            \"Resource\": \"arn:aws:kms:\u003CREGION>:\u003CACCOUNT>:key\u002F\u003CKEY_ID>\",\n            \"Condition\": {\"StringEquals\": {\"aws:SourceAccount\": \"\u003CACCOUNT>\"}}\n        },\n        {\n            \"Sid\": \"EnableS3TablesMaintenanceKeyUsage\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\"Service\": \"maintenance.s3tables.amazonaws.com\"},\n            \"Action\": [\"kms:GenerateDataKey\", \"kms:Decrypt\"],\n            \"Resource\": \"arn:aws:kms:\u003CREGION>:\u003CACCOUNT>:key\u002F\u003CKEY_ID>\",\n            \"Condition\": {\"StringLike\": {\"kms:EncryptionContext:aws:s3:arn\": \"\u003CTABLE_OR_TABLE_BUCKET_ARN>\u002F*\"}}\n        }\n    ]\n}\n```\n\n### Data Sensitivity\n\nLog data may contain PII including IP addresses, user agents, request parameters, and authentication tokens. Treat all exported log tables as sensitive by default.\n\n### Access Control Best Practices\n\n- Use Lake Formation column-level security to restrict access to sensitive columns (e.g., `srcaddr`, `source_ip_address`, `httpRequest`). Grant permissions to specific tables and columns rather than wildcards.\n- Configure SSE-KMS encryption on the Athena workgroup output bucket to protect query results at rest.\n- Prefer specific data source associations over wildcard (`*\u002F*`) to limit which data sources are exported to queryable tables.\n\n### Audit Trail\n\nEnable CloudTrail logging for Athena (`StartQueryExecution`, `GetQueryResults`) and Lake Formation (`GrantPermissions`, `RevokePermissions`) API calls to maintain an audit trail of who queried what data.\n\n## Additional Resources\n\n- [CloudWatch Logs S3 Tables integration](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fs3-tables-integration.html)\n- [Supported AWS vended data sources](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002FAWS-logs-and-resource-types.html)\n- [IAM permissions for integration](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fs3-tables-integration.html#s3-tables-integration-iam-permissions)\n- [Integrating S3 Tables with analytics services](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002Fs3-tables-integrating-aws.html)\n- [Lake Formation permissions](https:\u002F\u002Fdocs.aws.amazon.com\u002Flake-formation\u002Flatest\u002Fdg\u002Fgranting-catalog-permissions.html)\n",{"data":39,"body":42},{"name":4,"description":6,"version":40,"argument-hint":41},1,"[query|data-source-name|'configure'|'status']",{"type":43,"children":44},"root",[45,54,61,84,98,104,266,272,277,832,869,875,882,980,1003,1008,1223,1229,1237,1346,1354,1460,1468,1483,1583,1596,1602,1607,1633,1638,1771,1777,1785,1800,1808,1850,1858,1905,1913,1959,1967,2023,2029,2089,2095,2259,2264,2270,2299,2742,2748,3056,3062,3067,3795,3801,3806,3812,3861,3867,3902,3908,3961],{"type":46,"tag":47,"props":48,"children":50},"element","h1",{"id":49},"query-aws-cloudwatch-system-tables",[51],{"type":52,"value":53},"text","Query AWS CloudWatch System Tables",{"type":46,"tag":55,"props":56,"children":58},"h2",{"id":57},"overview",[59],{"type":52,"value":60},"Overview",{"type":46,"tag":62,"props":63,"children":64},"p",{},[65,71,73,82],{"type":46,"tag":66,"props":67,"children":68},"strong",{},[69],{"type":52,"value":70},"Works best with",{"type":52,"value":72}," the ",{"type":46,"tag":74,"props":75,"children":79},"a",{"href":76,"rel":77},"https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002F",[78],"nofollow",[80],{"type":52,"value":81},"AWS MCP server",{"type":52,"value":83}," for sandboxed execution and audit logging. All commands below use the AWS CLI and work in any environment with configured AWS credentials.",{"type":46,"tag":62,"props":85,"children":86},{},[87,89,96],{"type":52,"value":88},"The CloudWatch Logs S3 Tables integration exports log data as Apache Iceberg tables in the AWS-managed ",{"type":46,"tag":90,"props":91,"children":93},"code",{"className":92},[],[94],{"type":52,"value":95},"aws-cloudwatch",{"type":52,"value":97}," table bucket. This enables SQL analysis via Amazon Athena and correlation of log data with non-CloudWatch data (S3 metadata, business tables, etc.). Available at no additional storage charge beyond CloudWatch ingestion pricing.",{"type":46,"tag":55,"props":99,"children":101},{"id":100},"decision-tree",[102],{"type":52,"value":103},"Decision Tree",{"type":46,"tag":105,"props":106,"children":107},"table",{},[108,132],{"type":46,"tag":109,"props":110,"children":111},"thead",{},[112],{"type":46,"tag":113,"props":114,"children":115},"tr",{},[116,122,127],{"type":46,"tag":117,"props":118,"children":119},"th",{},[120],{"type":52,"value":121},"User intent",{"type":46,"tag":117,"props":123,"children":124},{},[125],{"type":52,"value":126},"Use this skill?",{"type":46,"tag":117,"props":128,"children":129},{},[130],{"type":52,"value":131},"Alternative",{"type":46,"tag":133,"props":134,"children":135},"tbody",{},[136,158,179,200,226,246],{"type":46,"tag":113,"props":137,"children":138},{},[139,145,153],{"type":46,"tag":140,"props":141,"children":142},"td",{},[143],{"type":52,"value":144},"Run SQL across large volumes of log data",{"type":46,"tag":140,"props":146,"children":147},{},[148],{"type":46,"tag":66,"props":149,"children":150},{},[151],{"type":52,"value":152},"Yes",{"type":46,"tag":140,"props":154,"children":155},{},[156],{"type":52,"value":157},"—",{"type":46,"tag":113,"props":159,"children":160},{},[161,166,175],{"type":46,"tag":140,"props":162,"children":163},{},[164],{"type":52,"value":165},"Correlate logs with S3 metadata or other tables",{"type":46,"tag":140,"props":167,"children":168},{},[169,173],{"type":46,"tag":66,"props":170,"children":171},{},[172],{"type":52,"value":152},{"type":52,"value":174}," — join across catalogs",{"type":46,"tag":140,"props":176,"children":177},{},[178],{"type":52,"value":157},{"type":46,"tag":113,"props":180,"children":181},{},[182,187,195],{"type":46,"tag":140,"props":183,"children":184},{},[185],{"type":52,"value":186},"Quick log search \u002F pattern matching",{"type":46,"tag":140,"props":188,"children":189},{},[190],{"type":46,"tag":66,"props":191,"children":192},{},[193],{"type":52,"value":194},"No",{"type":46,"tag":140,"props":196,"children":197},{},[198],{"type":52,"value":199},"CloudWatch Logs Insights (faster for ad-hoc)",{"type":46,"tag":113,"props":201,"children":202},{},[203,208,215],{"type":46,"tag":140,"props":204,"children":205},{},[206],{"type":52,"value":207},"Real-time log streaming\u002Ftailing",{"type":46,"tag":140,"props":209,"children":210},{},[211],{"type":46,"tag":66,"props":212,"children":213},{},[214],{"type":52,"value":194},{"type":46,"tag":140,"props":216,"children":217},{},[218,220],{"type":52,"value":219},"CloudWatch Logs console or ",{"type":46,"tag":90,"props":221,"children":223},{"className":222},[],[224],{"type":52,"value":225},"logs filter-log-events",{"type":46,"tag":113,"props":227,"children":228},{},[229,234,241],{"type":46,"tag":140,"props":230,"children":231},{},[232],{"type":52,"value":233},"Set up alarms on log patterns",{"type":46,"tag":140,"props":235,"children":236},{},[237],{"type":46,"tag":66,"props":238,"children":239},{},[240],{"type":52,"value":194},{"type":46,"tag":140,"props":242,"children":243},{},[244],{"type":52,"value":245},"CloudWatch Metric Filters \u002F Alarms",{"type":46,"tag":113,"props":247,"children":248},{},[249,254,261],{"type":46,"tag":140,"props":250,"children":251},{},[252],{"type":52,"value":253},"Query historical logs before integration was enabled",{"type":46,"tag":140,"props":255,"children":256},{},[257],{"type":46,"tag":66,"props":258,"children":259},{},[260],{"type":52,"value":194},{"type":46,"tag":140,"props":262,"children":263},{},[264],{"type":52,"value":265},"CloudWatch Logs (no backfill in S3 Tables)",{"type":46,"tag":55,"props":267,"children":269},{"id":268},"supported-data-sources",[270],{"type":52,"value":271},"Supported Data Sources",{"type":46,"tag":62,"props":273,"children":274},{},[275],{"type":52,"value":276},"The following data sources are available through the S3 Tables integration. Each data source has a namespace pattern used in SQL queries. Not all AWS vended data sources may be available in all Regions; check the CloudWatch console Data Sources tab for current availability.",{"type":46,"tag":105,"props":278,"children":279},{},[280,301],{"type":46,"tag":109,"props":281,"children":282},{},[283],{"type":46,"tag":113,"props":284,"children":285},{},[286,291,296],{"type":46,"tag":117,"props":287,"children":288},{},[289],{"type":52,"value":290},"Data Source",{"type":46,"tag":117,"props":292,"children":293},{},[294],{"type":52,"value":295},"Namespace pattern",{"type":46,"tag":117,"props":297,"children":298},{},[299],{"type":52,"value":300},"Common use case",{"type":46,"tag":133,"props":302,"children":303},{},[304,326,348,370,392,414,436,458,480,502,524,546,568,590,612,634,656,678,700,722,744,766,788,810],{"type":46,"tag":113,"props":305,"children":306},{},[307,312,321],{"type":46,"tag":140,"props":308,"children":309},{},[310],{"type":52,"value":311},"VPC Flow Logs",{"type":46,"tag":140,"props":313,"children":314},{},[315],{"type":46,"tag":90,"props":316,"children":318},{"className":317},[],[319],{"type":52,"value":320},"amazon_vpc__flow",{"type":46,"tag":140,"props":322,"children":323},{},[324],{"type":52,"value":325},"Network traffic analysis, rejected connections",{"type":46,"tag":113,"props":327,"children":328},{},[329,334,343],{"type":46,"tag":140,"props":330,"children":331},{},[332],{"type":52,"value":333},"WAF Logs",{"type":46,"tag":140,"props":335,"children":336},{},[337],{"type":46,"tag":90,"props":338,"children":340},{"className":339},[],[341],{"type":52,"value":342},"aws_waf__logs",{"type":46,"tag":140,"props":344,"children":345},{},[346],{"type":52,"value":347},"Blocked requests, rule hit analysis",{"type":46,"tag":113,"props":349,"children":350},{},[351,356,365],{"type":46,"tag":140,"props":352,"children":353},{},[354],{"type":52,"value":355},"CloudFront Access Logs",{"type":46,"tag":140,"props":357,"children":358},{},[359],{"type":46,"tag":90,"props":360,"children":362},{"className":361},[],[363],{"type":52,"value":364},"amazon_cloudfront__access",{"type":46,"tag":140,"props":366,"children":367},{},[368],{"type":52,"value":369},"CDN traffic patterns, error rates",{"type":46,"tag":113,"props":371,"children":372},{},[373,378,387],{"type":46,"tag":140,"props":374,"children":375},{},[376],{"type":52,"value":377},"Route 53 Resolver Query Logs",{"type":46,"tag":140,"props":379,"children":380},{},[381],{"type":46,"tag":90,"props":382,"children":384},{"className":383},[],[385],{"type":52,"value":386},"amazon_route53resolver__query",{"type":46,"tag":140,"props":388,"children":389},{},[390],{"type":52,"value":391},"DNS query analysis",{"type":46,"tag":113,"props":393,"children":394},{},[395,400,409],{"type":46,"tag":140,"props":396,"children":397},{},[398],{"type":52,"value":399},"Network Firewall Logs",{"type":46,"tag":140,"props":401,"children":402},{},[403],{"type":46,"tag":90,"props":404,"children":406},{"className":405},[],[407],{"type":52,"value":408},"aws_networkfirewall__logs",{"type":46,"tag":140,"props":410,"children":411},{},[412],{"type":52,"value":413},"Firewall rule hits, dropped traffic",{"type":46,"tag":113,"props":415,"children":416},{},[417,422,431],{"type":46,"tag":140,"props":418,"children":419},{},[420],{"type":52,"value":421},"EKS Audit Logs",{"type":46,"tag":140,"props":423,"children":424},{},[425],{"type":46,"tag":90,"props":426,"children":428},{"className":427},[],[429],{"type":52,"value":430},"amazon_eks__audit",{"type":46,"tag":140,"props":432,"children":433},{},[434],{"type":52,"value":435},"Kubernetes API audit trail",{"type":46,"tag":113,"props":437,"children":438},{},[439,444,453],{"type":46,"tag":140,"props":440,"children":441},{},[442],{"type":52,"value":443},"Verified Access Logs",{"type":46,"tag":140,"props":445,"children":446},{},[447],{"type":46,"tag":90,"props":448,"children":450},{"className":449},[],[451],{"type":52,"value":452},"amazon_verifiedaccess__logs",{"type":46,"tag":140,"props":454,"children":455},{},[456],{"type":52,"value":457},"Zero-trust access decisions",{"type":46,"tag":113,"props":459,"children":460},{},[461,466,475],{"type":46,"tag":140,"props":462,"children":463},{},[464],{"type":52,"value":465},"SES Mail Logs",{"type":46,"tag":140,"props":467,"children":468},{},[469],{"type":46,"tag":90,"props":470,"children":472},{"className":471},[],[473],{"type":52,"value":474},"amazon_ses__mail",{"type":46,"tag":140,"props":476,"children":477},{},[478],{"type":52,"value":479},"Email delivery\u002Fbounce tracking",{"type":46,"tag":113,"props":481,"children":482},{},[483,488,497],{"type":46,"tag":140,"props":484,"children":485},{},[486],{"type":52,"value":487},"VPC Lattice Access Logs",{"type":46,"tag":140,"props":489,"children":490},{},[491],{"type":46,"tag":90,"props":492,"children":494},{"className":493},[],[495],{"type":52,"value":496},"amazon_vpclattice__access",{"type":46,"tag":140,"props":498,"children":499},{},[500],{"type":52,"value":501},"Service-to-service access patterns",{"type":46,"tag":113,"props":503,"children":504},{},[505,510,519],{"type":46,"tag":140,"props":506,"children":507},{},[508],{"type":52,"value":509},"Step Functions Logs",{"type":46,"tag":140,"props":511,"children":512},{},[513],{"type":46,"tag":90,"props":514,"children":516},{"className":515},[],[517],{"type":52,"value":518},"aws_stepfunctions__logs",{"type":46,"tag":140,"props":520,"children":521},{},[522],{"type":52,"value":523},"Workflow execution debugging",{"type":46,"tag":113,"props":525,"children":526},{},[527,532,541],{"type":46,"tag":140,"props":528,"children":529},{},[530],{"type":52,"value":531},"Global Accelerator Flow Logs",{"type":46,"tag":140,"props":533,"children":534},{},[535],{"type":46,"tag":90,"props":536,"children":538},{"className":537},[],[539],{"type":52,"value":540},"aws_globalaccelerator__flow",{"type":46,"tag":140,"props":542,"children":543},{},[544],{"type":52,"value":545},"Global network traffic",{"type":46,"tag":113,"props":547,"children":548},{},[549,554,563],{"type":46,"tag":140,"props":550,"children":551},{},[552],{"type":52,"value":553},"NLB Access Logs",{"type":46,"tag":140,"props":555,"children":556},{},[557],{"type":46,"tag":90,"props":558,"children":560},{"className":559},[],[561],{"type":52,"value":562},"elastic_load_balancing__nlb_access",{"type":46,"tag":140,"props":564,"children":565},{},[566],{"type":52,"value":567},"Load balancer request tracing",{"type":46,"tag":113,"props":569,"children":570},{},[571,576,585],{"type":46,"tag":140,"props":572,"children":573},{},[574],{"type":52,"value":575},"Shield Logs",{"type":46,"tag":140,"props":577,"children":578},{},[579],{"type":46,"tag":90,"props":580,"children":582},{"className":581},[],[583],{"type":52,"value":584},"aws_shield__logs",{"type":46,"tag":140,"props":586,"children":587},{},[588],{"type":52,"value":589},"DDoS mitigation events",{"type":46,"tag":113,"props":591,"children":592},{},[593,598,607],{"type":46,"tag":140,"props":594,"children":595},{},[596],{"type":52,"value":597},"Cognito Logs",{"type":46,"tag":140,"props":599,"children":600},{},[601],{"type":46,"tag":90,"props":602,"children":604},{"className":603},[],[605],{"type":52,"value":606},"amazon_cognito__logs",{"type":46,"tag":140,"props":608,"children":609},{},[610],{"type":52,"value":611},"Auth\u002Fidentity operations",{"type":46,"tag":113,"props":613,"children":614},{},[615,620,629],{"type":46,"tag":140,"props":616,"children":617},{},[618],{"type":52,"value":619},"ElastiCache Logs",{"type":46,"tag":140,"props":621,"children":622},{},[623],{"type":46,"tag":90,"props":624,"children":626},{"className":625},[],[627],{"type":52,"value":628},"amazon_elasticache__logs",{"type":46,"tag":140,"props":630,"children":631},{},[632],{"type":52,"value":633},"Redis slow log, engine log",{"type":46,"tag":113,"props":635,"children":636},{},[637,642,651],{"type":46,"tag":140,"props":638,"children":639},{},[640],{"type":52,"value":641},"SageMaker Logs",{"type":46,"tag":140,"props":643,"children":644},{},[645],{"type":46,"tag":90,"props":646,"children":648},{"className":647},[],[649],{"type":52,"value":650},"amazon_sagemaker__logs",{"type":46,"tag":140,"props":652,"children":653},{},[654],{"type":52,"value":655},"ML training\u002Finference events",{"type":46,"tag":113,"props":657,"children":658},{},[659,664,673],{"type":46,"tag":140,"props":660,"children":661},{},[662],{"type":52,"value":663},"WorkMail Audit Logs",{"type":46,"tag":140,"props":665,"children":666},{},[667],{"type":46,"tag":90,"props":668,"children":670},{"className":669},[],[671],{"type":52,"value":672},"amazon_workmail__audit",{"type":46,"tag":140,"props":674,"children":675},{},[676],{"type":52,"value":677},"Email security\u002Fcompliance",{"type":46,"tag":113,"props":679,"children":680},{},[681,686,695],{"type":46,"tag":140,"props":682,"children":683},{},[684],{"type":52,"value":685},"Bedrock Agent Logs",{"type":46,"tag":140,"props":687,"children":688},{},[689],{"type":46,"tag":90,"props":690,"children":692},{"className":691},[],[693],{"type":52,"value":694},"aws_bedrock_agent_core__logs",{"type":46,"tag":140,"props":696,"children":697},{},[698],{"type":52,"value":699},"AI agent invocations",{"type":46,"tag":113,"props":701,"children":702},{},[703,708,717],{"type":46,"tag":140,"props":704,"children":705},{},[706],{"type":52,"value":707},"Client VPN Logs",{"type":46,"tag":140,"props":709,"children":710},{},[711],{"type":46,"tag":90,"props":712,"children":714},{"className":713},[],[715],{"type":52,"value":716},"aws_client_vpn__connections",{"type":46,"tag":140,"props":718,"children":719},{},[720],{"type":52,"value":721},"VPN connection tracking",{"type":46,"tag":113,"props":723,"children":724},{},[725,730,739],{"type":46,"tag":140,"props":726,"children":727},{},[728],{"type":52,"value":729},"Entity Resolution Logs",{"type":46,"tag":140,"props":731,"children":732},{},[733],{"type":46,"tag":90,"props":734,"children":736},{"className":735},[],[737],{"type":52,"value":738},"aws_entity_resolution__logs",{"type":46,"tag":140,"props":740,"children":741},{},[742],{"type":52,"value":743},"Record matching operations",{"type":46,"tag":113,"props":745,"children":746},{},[747,752,761],{"type":46,"tag":140,"props":748,"children":749},{},[750],{"type":52,"value":751},"MediaPackage Access Logs",{"type":46,"tag":140,"props":753,"children":754},{},[755],{"type":46,"tag":90,"props":756,"children":758},{"className":757},[],[759],{"type":52,"value":760},"aws_elemental_mediapackage__access",{"type":46,"tag":140,"props":762,"children":763},{},[764],{"type":52,"value":765},"Streaming delivery metrics",{"type":46,"tag":113,"props":767,"children":768},{},[769,774,783],{"type":46,"tag":140,"props":770,"children":771},{},[772],{"type":52,"value":773},"MediaTailor Logs",{"type":46,"tag":140,"props":775,"children":776},{},[777],{"type":46,"tag":90,"props":778,"children":780},{"className":779},[],[781],{"type":52,"value":782},"aws_elemental_mediatailor__logs",{"type":46,"tag":140,"props":784,"children":785},{},[786],{"type":52,"value":787},"Ad insertion events",{"type":46,"tag":113,"props":789,"children":790},{},[791,796,805],{"type":46,"tag":140,"props":792,"children":793},{},[794],{"type":52,"value":795},"Transfer Family Logs",{"type":46,"tag":140,"props":797,"children":798},{},[799],{"type":46,"tag":90,"props":800,"children":802},{"className":801},[],[803],{"type":52,"value":804},"aws_transfer_family__logs",{"type":46,"tag":140,"props":806,"children":807},{},[808],{"type":52,"value":809},"SFTP\u002FFTPS file transfer tracking",{"type":46,"tag":113,"props":811,"children":812},{},[813,818,827],{"type":46,"tag":140,"props":814,"children":815},{},[816],{"type":52,"value":817},"Site-to-Site VPN Logs",{"type":46,"tag":140,"props":819,"children":820},{},[821],{"type":46,"tag":90,"props":822,"children":824},{"className":823},[],[825],{"type":52,"value":826},"aws_site_to_site_vpn__logs",{"type":46,"tag":140,"props":828,"children":829},{},[830],{"type":52,"value":831},"VPN tunnel diagnostics",{"type":46,"tag":833,"props":834,"children":835},"blockquote",{},[836],{"type":46,"tag":62,"props":837,"children":838},{},[839,844,846,852,854,859,861,867],{"type":46,"tag":66,"props":840,"children":841},{},[842],{"type":52,"value":843},"Note",{"type":52,"value":845},": This table lists the 24 most commonly queried data sources. The integration supports 43+ AWS vended data sources in total. Use ",{"type":46,"tag":90,"props":847,"children":849},{"className":848},[],[850],{"type":52,"value":851},"list-namespaces",{"type":52,"value":853}," on the ",{"type":46,"tag":90,"props":855,"children":857},{"className":856},[],[858],{"type":52,"value":95},{"type":52,"value":860}," bucket to discover all available data sources in your account. Namespace patterns follow the convention ",{"type":46,"tag":90,"props":862,"children":864},{"className":863},[],[865],{"type":52,"value":866},"\u003Cservice>__\u003Ctype>",{"type":52,"value":868},".",{"type":46,"tag":55,"props":870,"children":872},{"id":871},"common-tasks",[873],{"type":52,"value":874},"Common Tasks",{"type":46,"tag":876,"props":877,"children":879},"h3",{"id":878},"_1-check-if-configured",[880],{"type":52,"value":881},"1. Check If Configured",{"type":46,"tag":883,"props":884,"children":889},"pre",{"className":885,"code":886,"language":887,"meta":888,"style":888},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Check if the aws-cloudwatch table bucket exists\naws s3tables list-table-buckets --region \u003CREGION> \\\n  --query \"tableBuckets[?name=='aws-cloudwatch']\"\n","bash","",[890],{"type":46,"tag":90,"props":891,"children":892},{"__ignoreMap":888},[893,904,956],{"type":46,"tag":894,"props":895,"children":897},"span",{"class":896,"line":40},"line",[898],{"type":46,"tag":894,"props":899,"children":901},{"style":900},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[902],{"type":52,"value":903},"# Check if the aws-cloudwatch table bucket exists\n",{"type":46,"tag":894,"props":905,"children":907},{"class":896,"line":906},2,[908,913,919,924,929,935,940,946,951],{"type":46,"tag":894,"props":909,"children":911},{"style":910},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[912],{"type":52,"value":8},{"type":46,"tag":894,"props":914,"children":916},{"style":915},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[917],{"type":52,"value":918}," s3tables",{"type":46,"tag":894,"props":920,"children":921},{"style":915},[922],{"type":52,"value":923}," list-table-buckets",{"type":46,"tag":894,"props":925,"children":926},{"style":915},[927],{"type":52,"value":928}," --region",{"type":46,"tag":894,"props":930,"children":932},{"style":931},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[933],{"type":52,"value":934}," \u003C",{"type":46,"tag":894,"props":936,"children":937},{"style":915},[938],{"type":52,"value":939},"REGIO",{"type":46,"tag":894,"props":941,"children":943},{"style":942},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[944],{"type":52,"value":945},"N",{"type":46,"tag":894,"props":947,"children":948},{"style":931},[949],{"type":52,"value":950},">",{"type":46,"tag":894,"props":952,"children":953},{"style":942},[954],{"type":52,"value":955}," \\\n",{"type":46,"tag":894,"props":957,"children":959},{"class":896,"line":958},3,[960,965,970,975],{"type":46,"tag":894,"props":961,"children":962},{"style":915},[963],{"type":52,"value":964},"  --query",{"type":46,"tag":894,"props":966,"children":967},{"style":931},[968],{"type":52,"value":969}," \"",{"type":46,"tag":894,"props":971,"children":972},{"style":915},[973],{"type":52,"value":974},"tableBuckets[?name=='aws-cloudwatch']",{"type":46,"tag":894,"props":976,"children":977},{"style":931},[978],{"type":52,"value":979},"\"\n",{"type":46,"tag":981,"props":982,"children":983},"ul",{},[984,990],{"type":46,"tag":985,"props":986,"children":987},"li",{},[988],{"type":52,"value":989},"Empty result → integration not enabled. Guide user through setup.",{"type":46,"tag":985,"props":991,"children":992},{},[993,995,1001],{"type":52,"value":994},"Bucket exists but no namespaces → integration enabled but no log data yet (only captures events ",{"type":46,"tag":996,"props":997,"children":998},"em",{},[999],{"type":52,"value":1000},"after",{"type":52,"value":1002}," association).",{"type":46,"tag":62,"props":1004,"children":1005},{},[1006],{"type":52,"value":1007},"List available tables:",{"type":46,"tag":883,"props":1009,"children":1011},{"className":885,"code":1010,"language":887,"meta":888,"style":888},"aws s3tables list-namespaces --table-bucket-arn arn:aws:s3tables:\u003CREGION>:\u003CACCOUNT>:bucket\u002Faws-cloudwatch --region \u003CREGION>\n\naws s3tables list-tables --table-bucket-arn arn:aws:s3tables:\u003CREGION>:\u003CACCOUNT>:bucket\u002Faws-cloudwatch --namespace \u003CNAMESPACE> --region \u003CREGION>\n",[1012],{"type":46,"tag":90,"props":1013,"children":1014},{"__ignoreMap":888},[1015,1107,1116],{"type":46,"tag":894,"props":1016,"children":1017},{"class":896,"line":40},[1018,1022,1026,1031,1036,1041,1046,1050,1054,1058,1063,1067,1072,1077,1081,1086,1090,1094,1098,1102],{"type":46,"tag":894,"props":1019,"children":1020},{"style":910},[1021],{"type":52,"value":8},{"type":46,"tag":894,"props":1023,"children":1024},{"style":915},[1025],{"type":52,"value":918},{"type":46,"tag":894,"props":1027,"children":1028},{"style":915},[1029],{"type":52,"value":1030}," list-namespaces",{"type":46,"tag":894,"props":1032,"children":1033},{"style":915},[1034],{"type":52,"value":1035}," --table-bucket-arn",{"type":46,"tag":894,"props":1037,"children":1038},{"style":915},[1039],{"type":52,"value":1040}," arn:aws:s3tables:",{"type":46,"tag":894,"props":1042,"children":1043},{"style":931},[1044],{"type":52,"value":1045},"\u003C",{"type":46,"tag":894,"props":1047,"children":1048},{"style":915},[1049],{"type":52,"value":939},{"type":46,"tag":894,"props":1051,"children":1052},{"style":942},[1053],{"type":52,"value":945},{"type":46,"tag":894,"props":1055,"children":1056},{"style":931},[1057],{"type":52,"value":950},{"type":46,"tag":894,"props":1059,"children":1060},{"style":915},[1061],{"type":52,"value":1062},":",{"type":46,"tag":894,"props":1064,"children":1065},{"style":931},[1066],{"type":52,"value":1045},{"type":46,"tag":894,"props":1068,"children":1069},{"style":915},[1070],{"type":52,"value":1071},"ACCOUN",{"type":46,"tag":894,"props":1073,"children":1074},{"style":942},[1075],{"type":52,"value":1076},"T",{"type":46,"tag":894,"props":1078,"children":1079},{"style":931},[1080],{"type":52,"value":950},{"type":46,"tag":894,"props":1082,"children":1083},{"style":915},[1084],{"type":52,"value":1085},":bucket\u002Faws-cloudwatch",{"type":46,"tag":894,"props":1087,"children":1088},{"style":915},[1089],{"type":52,"value":928},{"type":46,"tag":894,"props":1091,"children":1092},{"style":931},[1093],{"type":52,"value":934},{"type":46,"tag":894,"props":1095,"children":1096},{"style":915},[1097],{"type":52,"value":939},{"type":46,"tag":894,"props":1099,"children":1100},{"style":942},[1101],{"type":52,"value":945},{"type":46,"tag":894,"props":1103,"children":1104},{"style":931},[1105],{"type":52,"value":1106},">\n",{"type":46,"tag":894,"props":1108,"children":1109},{"class":896,"line":906},[1110],{"type":46,"tag":894,"props":1111,"children":1113},{"emptyLinePlaceholder":1112},true,[1114],{"type":52,"value":1115},"\n",{"type":46,"tag":894,"props":1117,"children":1118},{"class":896,"line":958},[1119,1123,1127,1132,1136,1140,1144,1148,1152,1156,1160,1164,1168,1172,1176,1180,1185,1189,1194,1199,1203,1207,1211,1215,1219],{"type":46,"tag":894,"props":1120,"children":1121},{"style":910},[1122],{"type":52,"value":8},{"type":46,"tag":894,"props":1124,"children":1125},{"style":915},[1126],{"type":52,"value":918},{"type":46,"tag":894,"props":1128,"children":1129},{"style":915},[1130],{"type":52,"value":1131}," list-tables",{"type":46,"tag":894,"props":1133,"children":1134},{"style":915},[1135],{"type":52,"value":1035},{"type":46,"tag":894,"props":1137,"children":1138},{"style":915},[1139],{"type":52,"value":1040},{"type":46,"tag":894,"props":1141,"children":1142},{"style":931},[1143],{"type":52,"value":1045},{"type":46,"tag":894,"props":1145,"children":1146},{"style":915},[1147],{"type":52,"value":939},{"type":46,"tag":894,"props":1149,"children":1150},{"style":942},[1151],{"type":52,"value":945},{"type":46,"tag":894,"props":1153,"children":1154},{"style":931},[1155],{"type":52,"value":950},{"type":46,"tag":894,"props":1157,"children":1158},{"style":915},[1159],{"type":52,"value":1062},{"type":46,"tag":894,"props":1161,"children":1162},{"style":931},[1163],{"type":52,"value":1045},{"type":46,"tag":894,"props":1165,"children":1166},{"style":915},[1167],{"type":52,"value":1071},{"type":46,"tag":894,"props":1169,"children":1170},{"style":942},[1171],{"type":52,"value":1076},{"type":46,"tag":894,"props":1173,"children":1174},{"style":931},[1175],{"type":52,"value":950},{"type":46,"tag":894,"props":1177,"children":1178},{"style":915},[1179],{"type":52,"value":1085},{"type":46,"tag":894,"props":1181,"children":1182},{"style":915},[1183],{"type":52,"value":1184}," --namespace",{"type":46,"tag":894,"props":1186,"children":1187},{"style":931},[1188],{"type":52,"value":934},{"type":46,"tag":894,"props":1190,"children":1191},{"style":915},[1192],{"type":52,"value":1193},"NAMESPAC",{"type":46,"tag":894,"props":1195,"children":1196},{"style":942},[1197],{"type":52,"value":1198},"E",{"type":46,"tag":894,"props":1200,"children":1201},{"style":931},[1202],{"type":52,"value":950},{"type":46,"tag":894,"props":1204,"children":1205},{"style":915},[1206],{"type":52,"value":928},{"type":46,"tag":894,"props":1208,"children":1209},{"style":931},[1210],{"type":52,"value":934},{"type":46,"tag":894,"props":1212,"children":1213},{"style":915},[1214],{"type":52,"value":939},{"type":46,"tag":894,"props":1216,"children":1217},{"style":942},[1218],{"type":52,"value":945},{"type":46,"tag":894,"props":1220,"children":1221},{"style":931},[1222],{"type":52,"value":1106},{"type":46,"tag":876,"props":1224,"children":1226},{"id":1225},"_2-enable-configure",[1227],{"type":52,"value":1228},"2. Enable \u002F Configure",{"type":46,"tag":62,"props":1230,"children":1231},{},[1232],{"type":46,"tag":66,"props":1233,"children":1234},{},[1235],{"type":52,"value":1236},"Create integration:",{"type":46,"tag":883,"props":1238,"children":1240},{"className":885,"code":1239,"language":887,"meta":888,"style":888},"aws observabilityadmin create-s3-table-integration \\\n  --region \u003CREGION> \\\n  --encryption '{\"SseAlgorithm\": \"aws:kms\", \"KmsKeyArn\": \"\u003CKMS_KEY_ARN>\"}' \\\n  --role-arn \u003CSERVICE_ROLE_ARN>\n",[1241],{"type":46,"tag":90,"props":1242,"children":1243},{"__ignoreMap":888},[1244,1265,1293,1320],{"type":46,"tag":894,"props":1245,"children":1246},{"class":896,"line":40},[1247,1251,1256,1261],{"type":46,"tag":894,"props":1248,"children":1249},{"style":910},[1250],{"type":52,"value":8},{"type":46,"tag":894,"props":1252,"children":1253},{"style":915},[1254],{"type":52,"value":1255}," observabilityadmin",{"type":46,"tag":894,"props":1257,"children":1258},{"style":915},[1259],{"type":52,"value":1260}," create-s3-table-integration",{"type":46,"tag":894,"props":1262,"children":1263},{"style":942},[1264],{"type":52,"value":955},{"type":46,"tag":894,"props":1266,"children":1267},{"class":896,"line":906},[1268,1273,1277,1281,1285,1289],{"type":46,"tag":894,"props":1269,"children":1270},{"style":915},[1271],{"type":52,"value":1272},"  --region",{"type":46,"tag":894,"props":1274,"children":1275},{"style":931},[1276],{"type":52,"value":934},{"type":46,"tag":894,"props":1278,"children":1279},{"style":915},[1280],{"type":52,"value":939},{"type":46,"tag":894,"props":1282,"children":1283},{"style":942},[1284],{"type":52,"value":945},{"type":46,"tag":894,"props":1286,"children":1287},{"style":931},[1288],{"type":52,"value":950},{"type":46,"tag":894,"props":1290,"children":1291},{"style":942},[1292],{"type":52,"value":955},{"type":46,"tag":894,"props":1294,"children":1295},{"class":896,"line":958},[1296,1301,1306,1311,1316],{"type":46,"tag":894,"props":1297,"children":1298},{"style":915},[1299],{"type":52,"value":1300},"  --encryption",{"type":46,"tag":894,"props":1302,"children":1303},{"style":931},[1304],{"type":52,"value":1305}," '",{"type":46,"tag":894,"props":1307,"children":1308},{"style":915},[1309],{"type":52,"value":1310},"{\"SseAlgorithm\": \"aws:kms\", \"KmsKeyArn\": \"\u003CKMS_KEY_ARN>\"}",{"type":46,"tag":894,"props":1312,"children":1313},{"style":931},[1314],{"type":52,"value":1315},"'",{"type":46,"tag":894,"props":1317,"children":1318},{"style":942},[1319],{"type":52,"value":955},{"type":46,"tag":894,"props":1321,"children":1323},{"class":896,"line":1322},4,[1324,1329,1333,1338,1342],{"type":46,"tag":894,"props":1325,"children":1326},{"style":915},[1327],{"type":52,"value":1328},"  --role-arn",{"type":46,"tag":894,"props":1330,"children":1331},{"style":931},[1332],{"type":52,"value":934},{"type":46,"tag":894,"props":1334,"children":1335},{"style":915},[1336],{"type":52,"value":1337},"SERVICE_ROLE_AR",{"type":46,"tag":894,"props":1339,"children":1340},{"style":942},[1341],{"type":52,"value":945},{"type":46,"tag":894,"props":1343,"children":1344},{"style":931},[1345],{"type":52,"value":1106},{"type":46,"tag":62,"props":1347,"children":1348},{},[1349],{"type":46,"tag":66,"props":1350,"children":1351},{},[1352],{"type":52,"value":1353},"Associate a specific data source (recommended):",{"type":46,"tag":883,"props":1355,"children":1357},{"className":885,"code":1356,"language":887,"meta":888,"style":888},"aws logs associate-source-to-s3-table-integration \\\n  --region \u003CREGION> \\\n  --integration-arn \u003CINTEGRATION_ARN> \\\n  --data-source '{\"name\": \"\u003Csource-name>\", \"type\": \"\u003Csource-type>\"}'\n",[1358],{"type":46,"tag":90,"props":1359,"children":1360},{"__ignoreMap":888},[1361,1382,1409,1438],{"type":46,"tag":894,"props":1362,"children":1363},{"class":896,"line":40},[1364,1368,1373,1378],{"type":46,"tag":894,"props":1365,"children":1366},{"style":910},[1367],{"type":52,"value":8},{"type":46,"tag":894,"props":1369,"children":1370},{"style":915},[1371],{"type":52,"value":1372}," logs",{"type":46,"tag":894,"props":1374,"children":1375},{"style":915},[1376],{"type":52,"value":1377}," associate-source-to-s3-table-integration",{"type":46,"tag":894,"props":1379,"children":1380},{"style":942},[1381],{"type":52,"value":955},{"type":46,"tag":894,"props":1383,"children":1384},{"class":896,"line":906},[1385,1389,1393,1397,1401,1405],{"type":46,"tag":894,"props":1386,"children":1387},{"style":915},[1388],{"type":52,"value":1272},{"type":46,"tag":894,"props":1390,"children":1391},{"style":931},[1392],{"type":52,"value":934},{"type":46,"tag":894,"props":1394,"children":1395},{"style":915},[1396],{"type":52,"value":939},{"type":46,"tag":894,"props":1398,"children":1399},{"style":942},[1400],{"type":52,"value":945},{"type":46,"tag":894,"props":1402,"children":1403},{"style":931},[1404],{"type":52,"value":950},{"type":46,"tag":894,"props":1406,"children":1407},{"style":942},[1408],{"type":52,"value":955},{"type":46,"tag":894,"props":1410,"children":1411},{"class":896,"line":958},[1412,1417,1421,1426,1430,1434],{"type":46,"tag":894,"props":1413,"children":1414},{"style":915},[1415],{"type":52,"value":1416},"  --integration-arn",{"type":46,"tag":894,"props":1418,"children":1419},{"style":931},[1420],{"type":52,"value":934},{"type":46,"tag":894,"props":1422,"children":1423},{"style":915},[1424],{"type":52,"value":1425},"INTEGRATION_AR",{"type":46,"tag":894,"props":1427,"children":1428},{"style":942},[1429],{"type":52,"value":945},{"type":46,"tag":894,"props":1431,"children":1432},{"style":931},[1433],{"type":52,"value":950},{"type":46,"tag":894,"props":1435,"children":1436},{"style":942},[1437],{"type":52,"value":955},{"type":46,"tag":894,"props":1439,"children":1440},{"class":896,"line":1322},[1441,1446,1450,1455],{"type":46,"tag":894,"props":1442,"children":1443},{"style":915},[1444],{"type":52,"value":1445},"  --data-source",{"type":46,"tag":894,"props":1447,"children":1448},{"style":931},[1449],{"type":52,"value":1305},{"type":46,"tag":894,"props":1451,"children":1452},{"style":915},[1453],{"type":52,"value":1454},"{\"name\": \"\u003Csource-name>\", \"type\": \"\u003Csource-type>\"}",{"type":46,"tag":894,"props":1456,"children":1457},{"style":931},[1458],{"type":52,"value":1459},"'\n",{"type":46,"tag":62,"props":1461,"children":1462},{},[1463],{"type":46,"tag":66,"props":1464,"children":1465},{},[1466],{"type":52,"value":1467},"Associate all data sources (wildcard):",{"type":46,"tag":833,"props":1469,"children":1470},{},[1471],{"type":46,"tag":62,"props":1472,"children":1473},{},[1474,1476,1481],{"type":52,"value":1475},"⚠️ ",{"type":46,"tag":66,"props":1477,"children":1478},{},[1479],{"type":52,"value":1480},"Warning",{"type":52,"value":1482},": Wildcard association delivers all current and future data sources to S3 Tables. Use specific associations for tighter control over what log data lands in queryable tables.",{"type":46,"tag":883,"props":1484,"children":1486},{"className":885,"code":1485,"language":887,"meta":888,"style":888},"aws logs associate-source-to-s3-table-integration \\\n  --region \u003CREGION> \\\n  --integration-arn \u003CINTEGRATION_ARN> \\\n  --data-source '{\"name\": \"*\", \"type\": \"*\"}'\n",[1487],{"type":46,"tag":90,"props":1488,"children":1489},{"__ignoreMap":888},[1490,1509,1536,1563],{"type":46,"tag":894,"props":1491,"children":1492},{"class":896,"line":40},[1493,1497,1501,1505],{"type":46,"tag":894,"props":1494,"children":1495},{"style":910},[1496],{"type":52,"value":8},{"type":46,"tag":894,"props":1498,"children":1499},{"style":915},[1500],{"type":52,"value":1372},{"type":46,"tag":894,"props":1502,"children":1503},{"style":915},[1504],{"type":52,"value":1377},{"type":46,"tag":894,"props":1506,"children":1507},{"style":942},[1508],{"type":52,"value":955},{"type":46,"tag":894,"props":1510,"children":1511},{"class":896,"line":906},[1512,1516,1520,1524,1528,1532],{"type":46,"tag":894,"props":1513,"children":1514},{"style":915},[1515],{"type":52,"value":1272},{"type":46,"tag":894,"props":1517,"children":1518},{"style":931},[1519],{"type":52,"value":934},{"type":46,"tag":894,"props":1521,"children":1522},{"style":915},[1523],{"type":52,"value":939},{"type":46,"tag":894,"props":1525,"children":1526},{"style":942},[1527],{"type":52,"value":945},{"type":46,"tag":894,"props":1529,"children":1530},{"style":931},[1531],{"type":52,"value":950},{"type":46,"tag":894,"props":1533,"children":1534},{"style":942},[1535],{"type":52,"value":955},{"type":46,"tag":894,"props":1537,"children":1538},{"class":896,"line":958},[1539,1543,1547,1551,1555,1559],{"type":46,"tag":894,"props":1540,"children":1541},{"style":915},[1542],{"type":52,"value":1416},{"type":46,"tag":894,"props":1544,"children":1545},{"style":931},[1546],{"type":52,"value":934},{"type":46,"tag":894,"props":1548,"children":1549},{"style":915},[1550],{"type":52,"value":1425},{"type":46,"tag":894,"props":1552,"children":1553},{"style":942},[1554],{"type":52,"value":945},{"type":46,"tag":894,"props":1556,"children":1557},{"style":931},[1558],{"type":52,"value":950},{"type":46,"tag":894,"props":1560,"children":1561},{"style":942},[1562],{"type":52,"value":955},{"type":46,"tag":894,"props":1564,"children":1565},{"class":896,"line":1322},[1566,1570,1574,1579],{"type":46,"tag":894,"props":1567,"children":1568},{"style":915},[1569],{"type":52,"value":1445},{"type":46,"tag":894,"props":1571,"children":1572},{"style":931},[1573],{"type":52,"value":1305},{"type":46,"tag":894,"props":1575,"children":1576},{"style":915},[1577],{"type":52,"value":1578},"{\"name\": \"*\", \"type\": \"*\"}",{"type":46,"tag":894,"props":1580,"children":1581},{"style":931},[1582],{"type":52,"value":1459},{"type":46,"tag":62,"props":1584,"children":1585},{},[1586,1588,1594],{"type":52,"value":1587},"For IAM requirements (service role trust policy, permissions policy, condition keys), see ",{"type":46,"tag":74,"props":1589,"children":1591},{"href":1590},"#security-considerations",[1592],{"type":52,"value":1593},"Security Considerations",{"type":52,"value":1595}," below.",{"type":46,"tag":876,"props":1597,"children":1599},{"id":1598},"_3-verify-permissions-for-querying",[1600],{"type":52,"value":1601},"3. Verify Permissions for Querying",{"type":46,"tag":62,"props":1603,"children":1604},{},[1605],{"type":52,"value":1606},"Requires:",{"type":46,"tag":981,"props":1608,"children":1609},{},[1610,1623,1628],{"type":46,"tag":985,"props":1611,"children":1612},{},[1613,1615,1621],{"type":52,"value":1614},"S3 Tables federated catalog registered in Glue (",{"type":46,"tag":90,"props":1616,"children":1618},{"className":1617},[],[1619],{"type":52,"value":1620},"s3tablescatalog",{"type":52,"value":1622},")",{"type":46,"tag":985,"props":1624,"children":1625},{},[1626],{"type":52,"value":1627},"Lake Formation SELECT + DESCRIBE grants on the table (or IAM-only mode in supported regions)",{"type":46,"tag":985,"props":1629,"children":1630},{},[1631],{"type":52,"value":1632},"Athena execution permissions",{"type":46,"tag":62,"props":1634,"children":1635},{},[1636],{"type":52,"value":1637},"Grant access:",{"type":46,"tag":883,"props":1639,"children":1641},{"className":885,"code":1640,"language":887,"meta":888,"style":888},"aws lakeformation grant-permissions \\\n  --principal DataLakePrincipalIdentifier=\u003CROLE_ARN> \\\n  --resource '{\"Table\": {\"CatalogId\": \"\u003CACCOUNT>:s3tablescatalog\u002Faws-cloudwatch\", \"DatabaseName\": \"\u003CNAMESPACE>\", \"Name\": \"\u003CTABLE>\"}}' \\\n  --permissions DESCRIBE SELECT \\\n  --region \u003CREGION>\n",[1642],{"type":46,"tag":90,"props":1643,"children":1644},{"__ignoreMap":888},[1645,1666,1700,1725,1747],{"type":46,"tag":894,"props":1646,"children":1647},{"class":896,"line":40},[1648,1652,1657,1662],{"type":46,"tag":894,"props":1649,"children":1650},{"style":910},[1651],{"type":52,"value":8},{"type":46,"tag":894,"props":1653,"children":1654},{"style":915},[1655],{"type":52,"value":1656}," lakeformation",{"type":46,"tag":894,"props":1658,"children":1659},{"style":915},[1660],{"type":52,"value":1661}," grant-permissions",{"type":46,"tag":894,"props":1663,"children":1664},{"style":942},[1665],{"type":52,"value":955},{"type":46,"tag":894,"props":1667,"children":1668},{"class":896,"line":906},[1669,1674,1679,1683,1688,1692,1696],{"type":46,"tag":894,"props":1670,"children":1671},{"style":915},[1672],{"type":52,"value":1673},"  --principal",{"type":46,"tag":894,"props":1675,"children":1676},{"style":915},[1677],{"type":52,"value":1678}," DataLakePrincipalIdentifier=",{"type":46,"tag":894,"props":1680,"children":1681},{"style":931},[1682],{"type":52,"value":1045},{"type":46,"tag":894,"props":1684,"children":1685},{"style":915},[1686],{"type":52,"value":1687},"ROLE_AR",{"type":46,"tag":894,"props":1689,"children":1690},{"style":942},[1691],{"type":52,"value":945},{"type":46,"tag":894,"props":1693,"children":1694},{"style":931},[1695],{"type":52,"value":950},{"type":46,"tag":894,"props":1697,"children":1698},{"style":942},[1699],{"type":52,"value":955},{"type":46,"tag":894,"props":1701,"children":1702},{"class":896,"line":958},[1703,1708,1712,1717,1721],{"type":46,"tag":894,"props":1704,"children":1705},{"style":915},[1706],{"type":52,"value":1707},"  --resource",{"type":46,"tag":894,"props":1709,"children":1710},{"style":931},[1711],{"type":52,"value":1305},{"type":46,"tag":894,"props":1713,"children":1714},{"style":915},[1715],{"type":52,"value":1716},"{\"Table\": {\"CatalogId\": \"\u003CACCOUNT>:s3tablescatalog\u002Faws-cloudwatch\", \"DatabaseName\": \"\u003CNAMESPACE>\", \"Name\": \"\u003CTABLE>\"}}",{"type":46,"tag":894,"props":1718,"children":1719},{"style":931},[1720],{"type":52,"value":1315},{"type":46,"tag":894,"props":1722,"children":1723},{"style":942},[1724],{"type":52,"value":955},{"type":46,"tag":894,"props":1726,"children":1727},{"class":896,"line":1322},[1728,1733,1738,1743],{"type":46,"tag":894,"props":1729,"children":1730},{"style":915},[1731],{"type":52,"value":1732},"  --permissions",{"type":46,"tag":894,"props":1734,"children":1735},{"style":915},[1736],{"type":52,"value":1737}," DESCRIBE",{"type":46,"tag":894,"props":1739,"children":1740},{"style":915},[1741],{"type":52,"value":1742}," SELECT",{"type":46,"tag":894,"props":1744,"children":1745},{"style":942},[1746],{"type":52,"value":955},{"type":46,"tag":894,"props":1748,"children":1750},{"class":896,"line":1749},5,[1751,1755,1759,1763,1767],{"type":46,"tag":894,"props":1752,"children":1753},{"style":915},[1754],{"type":52,"value":1272},{"type":46,"tag":894,"props":1756,"children":1757},{"style":931},[1758],{"type":52,"value":934},{"type":46,"tag":894,"props":1760,"children":1761},{"style":915},[1762],{"type":52,"value":939},{"type":46,"tag":894,"props":1764,"children":1765},{"style":942},[1766],{"type":52,"value":945},{"type":46,"tag":894,"props":1768,"children":1769},{"style":931},[1770],{"type":52,"value":1106},{"type":46,"tag":876,"props":1772,"children":1774},{"id":1773},"_4-query",[1775],{"type":52,"value":1776},"4. Query",{"type":46,"tag":62,"props":1778,"children":1779},{},[1780],{"type":46,"tag":66,"props":1781,"children":1782},{},[1783],{"type":52,"value":1784},"Query syntax:",{"type":46,"tag":883,"props":1786,"children":1789},{"className":1787,"code":1788,"language":24,"meta":888,"style":888},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\"s3tablescatalog\u002Faws-cloudwatch\".\"\u003Cnamespace>\".\"\u003Ctable>\"\n",[1790],{"type":46,"tag":90,"props":1791,"children":1792},{"__ignoreMap":888},[1793],{"type":46,"tag":894,"props":1794,"children":1795},{"class":896,"line":40},[1796],{"type":46,"tag":894,"props":1797,"children":1798},{},[1799],{"type":52,"value":1788},{"type":46,"tag":62,"props":1801,"children":1802},{},[1803],{"type":46,"tag":66,"props":1804,"children":1805},{},[1806],{"type":52,"value":1807},"Constraints:",{"type":46,"tag":981,"props":1809,"children":1810},{},[1811,1834,1839],{"type":46,"tag":985,"props":1812,"children":1813},{},[1814,1816,1822,1824],{"type":52,"value":1815},"You MUST ALWAYS run get-tables on the target namespace and include the command in your response before writing any SQL query — schemas vary by data source. Never skip this step even if you already know the likely schema. Run ",{"type":46,"tag":90,"props":1817,"children":1819},{"className":1818},[],[1820],{"type":52,"value":1821},"get-tables",{"type":52,"value":1823}," once on the target namespace (one call returns all tables + columns + types + descriptions):",{"type":46,"tag":883,"props":1825,"children":1829},{"className":1826,"code":1828,"language":52},[1827],"language-text","aws glue get-tables --catalog-id \"\u003CACCOUNT>:s3tablescatalog\u002Faws-cloudwatch\" --database-name \"\u003Cnamespace>\" --region \u003CREGION>\n",[1830],{"type":46,"tag":90,"props":1831,"children":1832},{"__ignoreMap":888},[1833],{"type":52,"value":1828},{"type":46,"tag":985,"props":1835,"children":1836},{},[1837],{"type":52,"value":1838},"You MUST confirm workgroup and output location before executing",{"type":46,"tag":985,"props":1840,"children":1841},{},[1842,1844,1848],{"type":52,"value":1843},"You MUST inform user that only logs received ",{"type":46,"tag":996,"props":1845,"children":1846},{},[1847],{"type":52,"value":1000},{"type":52,"value":1849}," association are available (no backfill)",{"type":46,"tag":62,"props":1851,"children":1852},{},[1853],{"type":46,"tag":66,"props":1854,"children":1855},{},[1856],{"type":52,"value":1857},"Example — VPC Flow Logs rejected traffic:",{"type":46,"tag":883,"props":1859,"children":1861},{"className":1787,"code":1860,"language":24,"meta":888,"style":888},"SELECT srcaddr, dstaddr, dstport, protocol, packets, bytes\nFROM \"s3tablescatalog\u002Faws-cloudwatch\".\"amazon_vpc__flow\".\"\u003Ctable>\"\nWHERE action = 'REJECT'\nORDER BY bytes DESC\nLIMIT 50;\n",[1862],{"type":46,"tag":90,"props":1863,"children":1864},{"__ignoreMap":888},[1865,1873,1881,1889,1897],{"type":46,"tag":894,"props":1866,"children":1867},{"class":896,"line":40},[1868],{"type":46,"tag":894,"props":1869,"children":1870},{},[1871],{"type":52,"value":1872},"SELECT srcaddr, dstaddr, dstport, protocol, packets, bytes\n",{"type":46,"tag":894,"props":1874,"children":1875},{"class":896,"line":906},[1876],{"type":46,"tag":894,"props":1877,"children":1878},{},[1879],{"type":52,"value":1880},"FROM \"s3tablescatalog\u002Faws-cloudwatch\".\"amazon_vpc__flow\".\"\u003Ctable>\"\n",{"type":46,"tag":894,"props":1882,"children":1883},{"class":896,"line":958},[1884],{"type":46,"tag":894,"props":1885,"children":1886},{},[1887],{"type":52,"value":1888},"WHERE action = 'REJECT'\n",{"type":46,"tag":894,"props":1890,"children":1891},{"class":896,"line":1322},[1892],{"type":46,"tag":894,"props":1893,"children":1894},{},[1895],{"type":52,"value":1896},"ORDER BY bytes DESC\n",{"type":46,"tag":894,"props":1898,"children":1899},{"class":896,"line":1749},[1900],{"type":46,"tag":894,"props":1901,"children":1902},{},[1903],{"type":52,"value":1904},"LIMIT 50;\n",{"type":46,"tag":62,"props":1906,"children":1907},{},[1908],{"type":46,"tag":66,"props":1909,"children":1910},{},[1911],{"type":52,"value":1912},"Example — WAF blocked requests:",{"type":46,"tag":883,"props":1914,"children":1916},{"className":1787,"code":1915,"language":24,"meta":888,"style":888},"SELECT timestamp, action, terminatingRuleId, httpSourceId\nFROM \"s3tablescatalog\u002Faws-cloudwatch\".\"aws_waf__logs\".\"\u003Ctable>\"\nWHERE action = 'BLOCK'\nORDER BY timestamp DESC\nLIMIT 50;\n",[1917],{"type":46,"tag":90,"props":1918,"children":1919},{"__ignoreMap":888},[1920,1928,1936,1944,1952],{"type":46,"tag":894,"props":1921,"children":1922},{"class":896,"line":40},[1923],{"type":46,"tag":894,"props":1924,"children":1925},{},[1926],{"type":52,"value":1927},"SELECT timestamp, action, terminatingRuleId, httpSourceId\n",{"type":46,"tag":894,"props":1929,"children":1930},{"class":896,"line":906},[1931],{"type":46,"tag":894,"props":1932,"children":1933},{},[1934],{"type":52,"value":1935},"FROM \"s3tablescatalog\u002Faws-cloudwatch\".\"aws_waf__logs\".\"\u003Ctable>\"\n",{"type":46,"tag":894,"props":1937,"children":1938},{"class":896,"line":958},[1939],{"type":46,"tag":894,"props":1940,"children":1941},{},[1942],{"type":52,"value":1943},"WHERE action = 'BLOCK'\n",{"type":46,"tag":894,"props":1945,"children":1946},{"class":896,"line":1322},[1947],{"type":46,"tag":894,"props":1948,"children":1949},{},[1950],{"type":52,"value":1951},"ORDER BY timestamp DESC\n",{"type":46,"tag":894,"props":1953,"children":1954},{"class":896,"line":1749},[1955],{"type":46,"tag":894,"props":1956,"children":1957},{},[1958],{"type":52,"value":1904},{"type":46,"tag":62,"props":1960,"children":1961},{},[1962],{"type":46,"tag":66,"props":1963,"children":1964},{},[1965],{"type":52,"value":1966},"Example — correlate VPC Flow Logs with S3 object metadata:",{"type":46,"tag":883,"props":1968,"children":1970},{"className":1787,"code":1969,"language":24,"meta":888,"style":888},"SELECT f.srcaddr, f.dstaddr, f.bytes, j.key, j.record_type\nFROM \"s3tablescatalog\u002Faws-cloudwatch\".\"amazon_vpc__flow\".\"\u003Ctable>\" f\nJOIN \"s3tablescatalog\u002Faws-s3\".\"b_\u003Cbucket>\".\"journal\" j\n  ON f.srcaddr = j.source_ip_address\nWHERE j.record_type = 'CREATE'\n  AND f.action = 'ACCEPT';\n",[1971],{"type":46,"tag":90,"props":1972,"children":1973},{"__ignoreMap":888},[1974,1982,1990,1998,2006,2014],{"type":46,"tag":894,"props":1975,"children":1976},{"class":896,"line":40},[1977],{"type":46,"tag":894,"props":1978,"children":1979},{},[1980],{"type":52,"value":1981},"SELECT f.srcaddr, f.dstaddr, f.bytes, j.key, j.record_type\n",{"type":46,"tag":894,"props":1983,"children":1984},{"class":896,"line":906},[1985],{"type":46,"tag":894,"props":1986,"children":1987},{},[1988],{"type":52,"value":1989},"FROM \"s3tablescatalog\u002Faws-cloudwatch\".\"amazon_vpc__flow\".\"\u003Ctable>\" f\n",{"type":46,"tag":894,"props":1991,"children":1992},{"class":896,"line":958},[1993],{"type":46,"tag":894,"props":1994,"children":1995},{},[1996],{"type":52,"value":1997},"JOIN \"s3tablescatalog\u002Faws-s3\".\"b_\u003Cbucket>\".\"journal\" j\n",{"type":46,"tag":894,"props":1999,"children":2000},{"class":896,"line":1322},[2001],{"type":46,"tag":894,"props":2002,"children":2003},{},[2004],{"type":52,"value":2005},"  ON f.srcaddr = j.source_ip_address\n",{"type":46,"tag":894,"props":2007,"children":2008},{"class":896,"line":1749},[2009],{"type":46,"tag":894,"props":2010,"children":2011},{},[2012],{"type":52,"value":2013},"WHERE j.record_type = 'CREATE'\n",{"type":46,"tag":894,"props":2015,"children":2017},{"class":896,"line":2016},6,[2018],{"type":46,"tag":894,"props":2019,"children":2020},{},[2021],{"type":52,"value":2022},"  AND f.action = 'ACCEPT';\n",{"type":46,"tag":55,"props":2024,"children":2026},{"id":2025},"key-behaviors",[2027],{"type":52,"value":2028},"Key Behaviors",{"type":46,"tag":981,"props":2030,"children":2031},{},[2032,2042,2052,2062,2072],{"type":46,"tag":985,"props":2033,"children":2034},{},[2035,2040],{"type":46,"tag":66,"props":2036,"children":2037},{},[2038],{"type":52,"value":2039},"No backfill",{"type":52,"value":2041}," — only new log events after association are delivered to S3 Tables",{"type":46,"tag":985,"props":2043,"children":2044},{},[2045,2050],{"type":46,"tag":66,"props":2046,"children":2047},{},[2048],{"type":52,"value":2049},"Retention follows log group",{"type":52,"value":2051}," — when log group retention expires, data is removed from the table",{"type":46,"tag":985,"props":2053,"children":2054},{},[2055,2060],{"type":46,"tag":66,"props":2056,"children":2057},{},[2058],{"type":52,"value":2059},"Deleting a log group",{"type":52,"value":2061}," removes its data from the S3 table",{"type":46,"tag":985,"props":2063,"children":2064},{},[2065,2070],{"type":46,"tag":66,"props":2066,"children":2067},{},[2068],{"type":52,"value":2069},"No additional storage charge",{"type":52,"value":2071}," — included in CloudWatch pricing",{"type":46,"tag":985,"props":2073,"children":2074},{},[2075,2080,2082,2087],{"type":46,"tag":66,"props":2076,"children":2077},{},[2078],{"type":52,"value":2079},"Schemas are per-data-source",{"type":52,"value":2081}," — always run ",{"type":46,"tag":90,"props":2083,"children":2085},{"className":2084},[],[2086],{"type":52,"value":1821},{"type":52,"value":2088}," on the target namespace before building complex queries",{"type":46,"tag":55,"props":2090,"children":2092},{"id":2091},"troubleshooting",[2093],{"type":52,"value":2094},"Troubleshooting",{"type":46,"tag":105,"props":2096,"children":2097},{},[2098,2119],{"type":46,"tag":109,"props":2099,"children":2100},{},[2101],{"type":46,"tag":113,"props":2102,"children":2103},{},[2104,2109,2114],{"type":46,"tag":117,"props":2105,"children":2106},{},[2107],{"type":52,"value":2108},"Error",{"type":46,"tag":117,"props":2110,"children":2111},{},[2112],{"type":52,"value":2113},"Cause",{"type":46,"tag":117,"props":2115,"children":2116},{},[2117],{"type":52,"value":2118},"Fix",{"type":46,"tag":133,"props":2120,"children":2121},{},[2122,2151,2169,2193,2217,2235],{"type":46,"tag":113,"props":2123,"children":2124},{},[2125,2135,2140],{"type":46,"tag":140,"props":2126,"children":2127},{},[2128,2133],{"type":46,"tag":90,"props":2129,"children":2131},{"className":2130},[],[2132],{"type":52,"value":95},{"type":52,"value":2134}," bucket not found",{"type":46,"tag":140,"props":2136,"children":2137},{},[2138],{"type":52,"value":2139},"Integration not created",{"type":46,"tag":140,"props":2141,"children":2142},{},[2143,2145],{"type":52,"value":2144},"Run ",{"type":46,"tag":90,"props":2146,"children":2148},{"className":2147},[],[2149],{"type":52,"value":2150},"create-s3-table-integration",{"type":46,"tag":113,"props":2152,"children":2153},{},[2154,2159,2164],{"type":46,"tag":140,"props":2155,"children":2156},{},[2157],{"type":52,"value":2158},"Bucket exists but no namespaces",{"type":46,"tag":140,"props":2160,"children":2161},{},[2162],{"type":52,"value":2163},"No data sources associated, or no log traffic since association",{"type":46,"tag":140,"props":2165,"children":2166},{},[2167],{"type":52,"value":2168},"Associate sources; generate traffic",{"type":46,"tag":113,"props":2170,"children":2171},{},[2172,2183,2188],{"type":46,"tag":140,"props":2173,"children":2174},{},[2175,2181],{"type":46,"tag":90,"props":2176,"children":2178},{"className":2177},[],[2179],{"type":52,"value":2180},"CATALOG_NOT_FOUND",{"type":52,"value":2182}," in Athena",{"type":46,"tag":140,"props":2184,"children":2185},{},[2186],{"type":52,"value":2187},"S3 Tables not registered in Glue",{"type":46,"tag":140,"props":2189,"children":2190},{},[2191],{"type":52,"value":2192},"Enable integration: S3 console > Table buckets > Enable integration",{"type":46,"tag":113,"props":2194,"children":2195},{},[2196,2207,2212],{"type":46,"tag":140,"props":2197,"children":2198},{},[2199,2205],{"type":46,"tag":90,"props":2200,"children":2202},{"className":2201},[],[2203],{"type":52,"value":2204},"AccessDenied",{"type":52,"value":2206}," on query",{"type":46,"tag":140,"props":2208,"children":2209},{},[2210],{"type":52,"value":2211},"Missing Lake Formation grants or IAM permissions",{"type":46,"tag":140,"props":2213,"children":2214},{},[2215],{"type":52,"value":2216},"See Security Considerations below",{"type":46,"tag":113,"props":2218,"children":2219},{},[2220,2225,2230],{"type":46,"tag":140,"props":2221,"children":2222},{},[2223],{"type":52,"value":2224},"Empty results",{"type":46,"tag":140,"props":2226,"children":2227},{},[2228],{"type":52,"value":2229},"Logs only flow after association; no backfill",{"type":46,"tag":140,"props":2231,"children":2232},{},[2233],{"type":52,"value":2234},"Confirm association exists and log source is actively generating data",{"type":46,"tag":113,"props":2236,"children":2237},{},[2238,2243,2248],{"type":46,"tag":140,"props":2239,"children":2240},{},[2241],{"type":52,"value":2242},"Schema mismatch \u002F column not found",{"type":46,"tag":140,"props":2244,"children":2245},{},[2246],{"type":52,"value":2247},"Log type schema updated by AWS",{"type":46,"tag":140,"props":2249,"children":2250},{},[2251,2252,2257],{"type":52,"value":2144},{"type":46,"tag":90,"props":2253,"children":2255},{"className":2254},[],[2256],{"type":52,"value":1821},{"type":52,"value":2258}," on the namespace to get current columns",{"type":46,"tag":55,"props":2260,"children":2262},{"id":2261},"security-considerations",[2263],{"type":52,"value":1593},{"type":46,"tag":876,"props":2265,"children":2267},{"id":2266},"service-role-trust-policy",[2268],{"type":52,"value":2269},"Service Role Trust Policy",{"type":46,"tag":62,"props":2271,"children":2272},{},[2273,2275,2281,2283,2289,2291,2297],{"type":52,"value":2274},"The service role must allow ",{"type":46,"tag":90,"props":2276,"children":2278},{"className":2277},[],[2279],{"type":52,"value":2280},"logs.amazonaws.com",{"type":52,"value":2282}," to assume it. Always include ",{"type":46,"tag":90,"props":2284,"children":2286},{"className":2285},[],[2287],{"type":52,"value":2288},"aws:SourceAccount",{"type":52,"value":2290}," and ",{"type":46,"tag":90,"props":2292,"children":2294},{"className":2293},[],[2295],{"type":52,"value":2296},"aws:SourceArn",{"type":52,"value":2298}," condition keys to prevent confused deputy attacks:",{"type":46,"tag":883,"props":2300,"children":2304},{"className":2301,"code":2302,"language":2303,"meta":888,"style":888},"language-json shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Principal\": {\n                \"Service\": \"logs.amazonaws.com\"\n            },\n            \"Action\": \"sts:AssumeRole\",\n            \"Condition\": {\n                \"StringEquals\": {\n                    \"aws:SourceAccount\": \"\u003CACCOUNT>\"\n                },\n                \"ArnLike\": {\n                    \"aws:SourceArn\": [\"arn:aws:logs:\u003CREGION>:\u003CACCOUNT>:log-group:\u003CLOG_GROUP_NAME>\"]\n                }\n            }\n        }\n    ]\n}\n","json",[2305],{"type":46,"tag":90,"props":2306,"children":2307},{"__ignoreMap":888},[2308,2316,2357,2382,2390,2428,2453,2488,2497,2535,2560,2585,2620,2629,2654,2697,2706,2715,2724,2733],{"type":46,"tag":894,"props":2309,"children":2310},{"class":896,"line":40},[2311],{"type":46,"tag":894,"props":2312,"children":2313},{"style":931},[2314],{"type":52,"value":2315},"{\n",{"type":46,"tag":894,"props":2317,"children":2318},{"class":896,"line":906},[2319,2324,2330,2335,2339,2343,2348,2352],{"type":46,"tag":894,"props":2320,"children":2321},{"style":931},[2322],{"type":52,"value":2323},"    \"",{"type":46,"tag":894,"props":2325,"children":2327},{"style":2326},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[2328],{"type":52,"value":2329},"Version",{"type":46,"tag":894,"props":2331,"children":2332},{"style":931},[2333],{"type":52,"value":2334},"\"",{"type":46,"tag":894,"props":2336,"children":2337},{"style":931},[2338],{"type":52,"value":1062},{"type":46,"tag":894,"props":2340,"children":2341},{"style":931},[2342],{"type":52,"value":969},{"type":46,"tag":894,"props":2344,"children":2345},{"style":915},[2346],{"type":52,"value":2347},"2012-10-17",{"type":46,"tag":894,"props":2349,"children":2350},{"style":931},[2351],{"type":52,"value":2334},{"type":46,"tag":894,"props":2353,"children":2354},{"style":931},[2355],{"type":52,"value":2356},",\n",{"type":46,"tag":894,"props":2358,"children":2359},{"class":896,"line":958},[2360,2364,2369,2373,2377],{"type":46,"tag":894,"props":2361,"children":2362},{"style":931},[2363],{"type":52,"value":2323},{"type":46,"tag":894,"props":2365,"children":2366},{"style":2326},[2367],{"type":52,"value":2368},"Statement",{"type":46,"tag":894,"props":2370,"children":2371},{"style":931},[2372],{"type":52,"value":2334},{"type":46,"tag":894,"props":2374,"children":2375},{"style":931},[2376],{"type":52,"value":1062},{"type":46,"tag":894,"props":2378,"children":2379},{"style":931},[2380],{"type":52,"value":2381}," [\n",{"type":46,"tag":894,"props":2383,"children":2384},{"class":896,"line":1322},[2385],{"type":46,"tag":894,"props":2386,"children":2387},{"style":931},[2388],{"type":52,"value":2389},"        {\n",{"type":46,"tag":894,"props":2391,"children":2392},{"class":896,"line":1749},[2393,2398,2403,2407,2411,2415,2420,2424],{"type":46,"tag":894,"props":2394,"children":2395},{"style":931},[2396],{"type":52,"value":2397},"            \"",{"type":46,"tag":894,"props":2399,"children":2400},{"style":910},[2401],{"type":52,"value":2402},"Effect",{"type":46,"tag":894,"props":2404,"children":2405},{"style":931},[2406],{"type":52,"value":2334},{"type":46,"tag":894,"props":2408,"children":2409},{"style":931},[2410],{"type":52,"value":1062},{"type":46,"tag":894,"props":2412,"children":2413},{"style":931},[2414],{"type":52,"value":969},{"type":46,"tag":894,"props":2416,"children":2417},{"style":915},[2418],{"type":52,"value":2419},"Allow",{"type":46,"tag":894,"props":2421,"children":2422},{"style":931},[2423],{"type":52,"value":2334},{"type":46,"tag":894,"props":2425,"children":2426},{"style":931},[2427],{"type":52,"value":2356},{"type":46,"tag":894,"props":2429,"children":2430},{"class":896,"line":2016},[2431,2435,2440,2444,2448],{"type":46,"tag":894,"props":2432,"children":2433},{"style":931},[2434],{"type":52,"value":2397},{"type":46,"tag":894,"props":2436,"children":2437},{"style":910},[2438],{"type":52,"value":2439},"Principal",{"type":46,"tag":894,"props":2441,"children":2442},{"style":931},[2443],{"type":52,"value":2334},{"type":46,"tag":894,"props":2445,"children":2446},{"style":931},[2447],{"type":52,"value":1062},{"type":46,"tag":894,"props":2449,"children":2450},{"style":931},[2451],{"type":52,"value":2452}," {\n",{"type":46,"tag":894,"props":2454,"children":2456},{"class":896,"line":2455},7,[2457,2462,2468,2472,2476,2480,2484],{"type":46,"tag":894,"props":2458,"children":2459},{"style":931},[2460],{"type":52,"value":2461},"                \"",{"type":46,"tag":894,"props":2463,"children":2465},{"style":2464},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[2466],{"type":52,"value":2467},"Service",{"type":46,"tag":894,"props":2469,"children":2470},{"style":931},[2471],{"type":52,"value":2334},{"type":46,"tag":894,"props":2473,"children":2474},{"style":931},[2475],{"type":52,"value":1062},{"type":46,"tag":894,"props":2477,"children":2478},{"style":931},[2479],{"type":52,"value":969},{"type":46,"tag":894,"props":2481,"children":2482},{"style":915},[2483],{"type":52,"value":2280},{"type":46,"tag":894,"props":2485,"children":2486},{"style":931},[2487],{"type":52,"value":979},{"type":46,"tag":894,"props":2489,"children":2491},{"class":896,"line":2490},8,[2492],{"type":46,"tag":894,"props":2493,"children":2494},{"style":931},[2495],{"type":52,"value":2496},"            },\n",{"type":46,"tag":894,"props":2498,"children":2500},{"class":896,"line":2499},9,[2501,2505,2510,2514,2518,2522,2527,2531],{"type":46,"tag":894,"props":2502,"children":2503},{"style":931},[2504],{"type":52,"value":2397},{"type":46,"tag":894,"props":2506,"children":2507},{"style":910},[2508],{"type":52,"value":2509},"Action",{"type":46,"tag":894,"props":2511,"children":2512},{"style":931},[2513],{"type":52,"value":2334},{"type":46,"tag":894,"props":2515,"children":2516},{"style":931},[2517],{"type":52,"value":1062},{"type":46,"tag":894,"props":2519,"children":2520},{"style":931},[2521],{"type":52,"value":969},{"type":46,"tag":894,"props":2523,"children":2524},{"style":915},[2525],{"type":52,"value":2526},"sts:AssumeRole",{"type":46,"tag":894,"props":2528,"children":2529},{"style":931},[2530],{"type":52,"value":2334},{"type":46,"tag":894,"props":2532,"children":2533},{"style":931},[2534],{"type":52,"value":2356},{"type":46,"tag":894,"props":2536,"children":2538},{"class":896,"line":2537},10,[2539,2543,2548,2552,2556],{"type":46,"tag":894,"props":2540,"children":2541},{"style":931},[2542],{"type":52,"value":2397},{"type":46,"tag":894,"props":2544,"children":2545},{"style":910},[2546],{"type":52,"value":2547},"Condition",{"type":46,"tag":894,"props":2549,"children":2550},{"style":931},[2551],{"type":52,"value":2334},{"type":46,"tag":894,"props":2553,"children":2554},{"style":931},[2555],{"type":52,"value":1062},{"type":46,"tag":894,"props":2557,"children":2558},{"style":931},[2559],{"type":52,"value":2452},{"type":46,"tag":894,"props":2561,"children":2563},{"class":896,"line":2562},11,[2564,2568,2573,2577,2581],{"type":46,"tag":894,"props":2565,"children":2566},{"style":931},[2567],{"type":52,"value":2461},{"type":46,"tag":894,"props":2569,"children":2570},{"style":2464},[2571],{"type":52,"value":2572},"StringEquals",{"type":46,"tag":894,"props":2574,"children":2575},{"style":931},[2576],{"type":52,"value":2334},{"type":46,"tag":894,"props":2578,"children":2579},{"style":931},[2580],{"type":52,"value":1062},{"type":46,"tag":894,"props":2582,"children":2583},{"style":931},[2584],{"type":52,"value":2452},{"type":46,"tag":894,"props":2586,"children":2588},{"class":896,"line":2587},12,[2589,2594,2599,2603,2607,2611,2616],{"type":46,"tag":894,"props":2590,"children":2591},{"style":931},[2592],{"type":52,"value":2593},"                    \"",{"type":46,"tag":894,"props":2595,"children":2597},{"style":2596},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[2598],{"type":52,"value":2288},{"type":46,"tag":894,"props":2600,"children":2601},{"style":931},[2602],{"type":52,"value":2334},{"type":46,"tag":894,"props":2604,"children":2605},{"style":931},[2606],{"type":52,"value":1062},{"type":46,"tag":894,"props":2608,"children":2609},{"style":931},[2610],{"type":52,"value":969},{"type":46,"tag":894,"props":2612,"children":2613},{"style":915},[2614],{"type":52,"value":2615},"\u003CACCOUNT>",{"type":46,"tag":894,"props":2617,"children":2618},{"style":931},[2619],{"type":52,"value":979},{"type":46,"tag":894,"props":2621,"children":2623},{"class":896,"line":2622},13,[2624],{"type":46,"tag":894,"props":2625,"children":2626},{"style":931},[2627],{"type":52,"value":2628},"                },\n",{"type":46,"tag":894,"props":2630,"children":2632},{"class":896,"line":2631},14,[2633,2637,2642,2646,2650],{"type":46,"tag":894,"props":2634,"children":2635},{"style":931},[2636],{"type":52,"value":2461},{"type":46,"tag":894,"props":2638,"children":2639},{"style":2464},[2640],{"type":52,"value":2641},"ArnLike",{"type":46,"tag":894,"props":2643,"children":2644},{"style":931},[2645],{"type":52,"value":2334},{"type":46,"tag":894,"props":2647,"children":2648},{"style":931},[2649],{"type":52,"value":1062},{"type":46,"tag":894,"props":2651,"children":2652},{"style":931},[2653],{"type":52,"value":2452},{"type":46,"tag":894,"props":2655,"children":2657},{"class":896,"line":2656},15,[2658,2662,2666,2670,2674,2679,2683,2688,2692],{"type":46,"tag":894,"props":2659,"children":2660},{"style":931},[2661],{"type":52,"value":2593},{"type":46,"tag":894,"props":2663,"children":2664},{"style":2596},[2665],{"type":52,"value":2296},{"type":46,"tag":894,"props":2667,"children":2668},{"style":931},[2669],{"type":52,"value":2334},{"type":46,"tag":894,"props":2671,"children":2672},{"style":931},[2673],{"type":52,"value":1062},{"type":46,"tag":894,"props":2675,"children":2676},{"style":931},[2677],{"type":52,"value":2678}," [",{"type":46,"tag":894,"props":2680,"children":2681},{"style":931},[2682],{"type":52,"value":2334},{"type":46,"tag":894,"props":2684,"children":2685},{"style":915},[2686],{"type":52,"value":2687},"arn:aws:logs:\u003CREGION>:\u003CACCOUNT>:log-group:\u003CLOG_GROUP_NAME>",{"type":46,"tag":894,"props":2689,"children":2690},{"style":931},[2691],{"type":52,"value":2334},{"type":46,"tag":894,"props":2693,"children":2694},{"style":931},[2695],{"type":52,"value":2696},"]\n",{"type":46,"tag":894,"props":2698,"children":2700},{"class":896,"line":2699},16,[2701],{"type":46,"tag":894,"props":2702,"children":2703},{"style":931},[2704],{"type":52,"value":2705},"                }\n",{"type":46,"tag":894,"props":2707,"children":2709},{"class":896,"line":2708},17,[2710],{"type":46,"tag":894,"props":2711,"children":2712},{"style":931},[2713],{"type":52,"value":2714},"            }\n",{"type":46,"tag":894,"props":2716,"children":2718},{"class":896,"line":2717},18,[2719],{"type":46,"tag":894,"props":2720,"children":2721},{"style":931},[2722],{"type":52,"value":2723},"        }\n",{"type":46,"tag":894,"props":2725,"children":2727},{"class":896,"line":2726},19,[2728],{"type":46,"tag":894,"props":2729,"children":2730},{"style":931},[2731],{"type":52,"value":2732},"    ]\n",{"type":46,"tag":894,"props":2734,"children":2736},{"class":896,"line":2735},20,[2737],{"type":46,"tag":894,"props":2738,"children":2739},{"style":931},[2740],{"type":52,"value":2741},"}\n",{"type":46,"tag":876,"props":2743,"children":2745},{"id":2744},"service-role-permissions-policy",[2746],{"type":52,"value":2747},"Service Role Permissions Policy",{"type":46,"tag":883,"props":2749,"children":2751},{"className":2301,"code":2750,"language":2303,"meta":888,"style":888},"{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Effect\": \"Allow\",\n            \"Action\": [\"logs:integrateWithS3Table\"],\n            \"Resource\": [\"arn:aws:logs:\u003CREGION>:\u003CACCOUNT>:log-group:\u003CLOG_GROUP_NAME>\"],\n            \"Condition\": {\n                \"StringEquals\": {\n                    \"aws:ResourceAccount\": \"\u003CACCOUNT>\"\n                }\n            }\n        }\n    ]\n}\n",[2752],{"type":46,"tag":90,"props":2753,"children":2754},{"__ignoreMap":888},[2755,2762,2797,2820,2827,2862,2903,2943,2966,2989,3021,3028,3035,3042,3049],{"type":46,"tag":894,"props":2756,"children":2757},{"class":896,"line":40},[2758],{"type":46,"tag":894,"props":2759,"children":2760},{"style":931},[2761],{"type":52,"value":2315},{"type":46,"tag":894,"props":2763,"children":2764},{"class":896,"line":906},[2765,2769,2773,2777,2781,2785,2789,2793],{"type":46,"tag":894,"props":2766,"children":2767},{"style":931},[2768],{"type":52,"value":2323},{"type":46,"tag":894,"props":2770,"children":2771},{"style":2326},[2772],{"type":52,"value":2329},{"type":46,"tag":894,"props":2774,"children":2775},{"style":931},[2776],{"type":52,"value":2334},{"type":46,"tag":894,"props":2778,"children":2779},{"style":931},[2780],{"type":52,"value":1062},{"type":46,"tag":894,"props":2782,"children":2783},{"style":931},[2784],{"type":52,"value":969},{"type":46,"tag":894,"props":2786,"children":2787},{"style":915},[2788],{"type":52,"value":2347},{"type":46,"tag":894,"props":2790,"children":2791},{"style":931},[2792],{"type":52,"value":2334},{"type":46,"tag":894,"props":2794,"children":2795},{"style":931},[2796],{"type":52,"value":2356},{"type":46,"tag":894,"props":2798,"children":2799},{"class":896,"line":958},[2800,2804,2808,2812,2816],{"type":46,"tag":894,"props":2801,"children":2802},{"style":931},[2803],{"type":52,"value":2323},{"type":46,"tag":894,"props":2805,"children":2806},{"style":2326},[2807],{"type":52,"value":2368},{"type":46,"tag":894,"props":2809,"children":2810},{"style":931},[2811],{"type":52,"value":2334},{"type":46,"tag":894,"props":2813,"children":2814},{"style":931},[2815],{"type":52,"value":1062},{"type":46,"tag":894,"props":2817,"children":2818},{"style":931},[2819],{"type":52,"value":2381},{"type":46,"tag":894,"props":2821,"children":2822},{"class":896,"line":1322},[2823],{"type":46,"tag":894,"props":2824,"children":2825},{"style":931},[2826],{"type":52,"value":2389},{"type":46,"tag":894,"props":2828,"children":2829},{"class":896,"line":1749},[2830,2834,2838,2842,2846,2850,2854,2858],{"type":46,"tag":894,"props":2831,"children":2832},{"style":931},[2833],{"type":52,"value":2397},{"type":46,"tag":894,"props":2835,"children":2836},{"style":910},[2837],{"type":52,"value":2402},{"type":46,"tag":894,"props":2839,"children":2840},{"style":931},[2841],{"type":52,"value":2334},{"type":46,"tag":894,"props":2843,"children":2844},{"style":931},[2845],{"type":52,"value":1062},{"type":46,"tag":894,"props":2847,"children":2848},{"style":931},[2849],{"type":52,"value":969},{"type":46,"tag":894,"props":2851,"children":2852},{"style":915},[2853],{"type":52,"value":2419},{"type":46,"tag":894,"props":2855,"children":2856},{"style":931},[2857],{"type":52,"value":2334},{"type":46,"tag":894,"props":2859,"children":2860},{"style":931},[2861],{"type":52,"value":2356},{"type":46,"tag":894,"props":2863,"children":2864},{"class":896,"line":2016},[2865,2869,2873,2877,2881,2885,2889,2894,2898],{"type":46,"tag":894,"props":2866,"children":2867},{"style":931},[2868],{"type":52,"value":2397},{"type":46,"tag":894,"props":2870,"children":2871},{"style":910},[2872],{"type":52,"value":2509},{"type":46,"tag":894,"props":2874,"children":2875},{"style":931},[2876],{"type":52,"value":2334},{"type":46,"tag":894,"props":2878,"children":2879},{"style":931},[2880],{"type":52,"value":1062},{"type":46,"tag":894,"props":2882,"children":2883},{"style":931},[2884],{"type":52,"value":2678},{"type":46,"tag":894,"props":2886,"children":2887},{"style":931},[2888],{"type":52,"value":2334},{"type":46,"tag":894,"props":2890,"children":2891},{"style":915},[2892],{"type":52,"value":2893},"logs:integrateWithS3Table",{"type":46,"tag":894,"props":2895,"children":2896},{"style":931},[2897],{"type":52,"value":2334},{"type":46,"tag":894,"props":2899,"children":2900},{"style":931},[2901],{"type":52,"value":2902},"],\n",{"type":46,"tag":894,"props":2904,"children":2905},{"class":896,"line":2455},[2906,2910,2915,2919,2923,2927,2931,2935,2939],{"type":46,"tag":894,"props":2907,"children":2908},{"style":931},[2909],{"type":52,"value":2397},{"type":46,"tag":894,"props":2911,"children":2912},{"style":910},[2913],{"type":52,"value":2914},"Resource",{"type":46,"tag":894,"props":2916,"children":2917},{"style":931},[2918],{"type":52,"value":2334},{"type":46,"tag":894,"props":2920,"children":2921},{"style":931},[2922],{"type":52,"value":1062},{"type":46,"tag":894,"props":2924,"children":2925},{"style":931},[2926],{"type":52,"value":2678},{"type":46,"tag":894,"props":2928,"children":2929},{"style":931},[2930],{"type":52,"value":2334},{"type":46,"tag":894,"props":2932,"children":2933},{"style":915},[2934],{"type":52,"value":2687},{"type":46,"tag":894,"props":2936,"children":2937},{"style":931},[2938],{"type":52,"value":2334},{"type":46,"tag":894,"props":2940,"children":2941},{"style":931},[2942],{"type":52,"value":2902},{"type":46,"tag":894,"props":2944,"children":2945},{"class":896,"line":2490},[2946,2950,2954,2958,2962],{"type":46,"tag":894,"props":2947,"children":2948},{"style":931},[2949],{"type":52,"value":2397},{"type":46,"tag":894,"props":2951,"children":2952},{"style":910},[2953],{"type":52,"value":2547},{"type":46,"tag":894,"props":2955,"children":2956},{"style":931},[2957],{"type":52,"value":2334},{"type":46,"tag":894,"props":2959,"children":2960},{"style":931},[2961],{"type":52,"value":1062},{"type":46,"tag":894,"props":2963,"children":2964},{"style":931},[2965],{"type":52,"value":2452},{"type":46,"tag":894,"props":2967,"children":2968},{"class":896,"line":2499},[2969,2973,2977,2981,2985],{"type":46,"tag":894,"props":2970,"children":2971},{"style":931},[2972],{"type":52,"value":2461},{"type":46,"tag":894,"props":2974,"children":2975},{"style":2464},[2976],{"type":52,"value":2572},{"type":46,"tag":894,"props":2978,"children":2979},{"style":931},[2980],{"type":52,"value":2334},{"type":46,"tag":894,"props":2982,"children":2983},{"style":931},[2984],{"type":52,"value":1062},{"type":46,"tag":894,"props":2986,"children":2987},{"style":931},[2988],{"type":52,"value":2452},{"type":46,"tag":894,"props":2990,"children":2991},{"class":896,"line":2537},[2992,2996,3001,3005,3009,3013,3017],{"type":46,"tag":894,"props":2993,"children":2994},{"style":931},[2995],{"type":52,"value":2593},{"type":46,"tag":894,"props":2997,"children":2998},{"style":2596},[2999],{"type":52,"value":3000},"aws:ResourceAccount",{"type":46,"tag":894,"props":3002,"children":3003},{"style":931},[3004],{"type":52,"value":2334},{"type":46,"tag":894,"props":3006,"children":3007},{"style":931},[3008],{"type":52,"value":1062},{"type":46,"tag":894,"props":3010,"children":3011},{"style":931},[3012],{"type":52,"value":969},{"type":46,"tag":894,"props":3014,"children":3015},{"style":915},[3016],{"type":52,"value":2615},{"type":46,"tag":894,"props":3018,"children":3019},{"style":931},[3020],{"type":52,"value":979},{"type":46,"tag":894,"props":3022,"children":3023},{"class":896,"line":2562},[3024],{"type":46,"tag":894,"props":3025,"children":3026},{"style":931},[3027],{"type":52,"value":2705},{"type":46,"tag":894,"props":3029,"children":3030},{"class":896,"line":2587},[3031],{"type":46,"tag":894,"props":3032,"children":3033},{"style":931},[3034],{"type":52,"value":2714},{"type":46,"tag":894,"props":3036,"children":3037},{"class":896,"line":2622},[3038],{"type":46,"tag":894,"props":3039,"children":3040},{"style":931},[3041],{"type":52,"value":2723},{"type":46,"tag":894,"props":3043,"children":3044},{"class":896,"line":2631},[3045],{"type":46,"tag":894,"props":3046,"children":3047},{"style":931},[3048],{"type":52,"value":2732},{"type":46,"tag":894,"props":3050,"children":3051},{"class":896,"line":2656},[3052],{"type":46,"tag":894,"props":3053,"children":3054},{"style":931},[3055],{"type":52,"value":2741},{"type":46,"tag":876,"props":3057,"children":3059},{"id":3058},"kms-key-policy-for-encrypted-data",[3060],{"type":52,"value":3061},"KMS Key Policy (for encrypted data)",{"type":46,"tag":62,"props":3063,"children":3064},{},[3065],{"type":52,"value":3066},"If using a customer managed KMS key, grant both service principals access:",{"type":46,"tag":883,"props":3068,"children":3070},{"className":2301,"code":3069,"language":2303,"meta":888,"style":888},"{\n    \"Version\": \"2012-10-17\",\n    \"Statement\": [\n        {\n            \"Sid\": \"EnableSystemTablesKeyUsage\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\"Service\": \"systemtables.cloudwatch.amazonaws.com\"},\n            \"Action\": [\"kms:DescribeKey\", \"kms:GenerateDataKey\", \"kms:Decrypt\"],\n            \"Resource\": \"arn:aws:kms:\u003CREGION>:\u003CACCOUNT>:key\u002F\u003CKEY_ID>\",\n            \"Condition\": {\"StringEquals\": {\"aws:SourceAccount\": \"\u003CACCOUNT>\"}}\n        },\n        {\n            \"Sid\": \"EnableS3TablesMaintenanceKeyUsage\",\n            \"Effect\": \"Allow\",\n            \"Principal\": {\"Service\": \"maintenance.s3tables.amazonaws.com\"},\n            \"Action\": [\"kms:GenerateDataKey\", \"kms:Decrypt\"],\n            \"Resource\": \"arn:aws:kms:\u003CREGION>:\u003CACCOUNT>:key\u002F\u003CKEY_ID>\",\n            \"Condition\": {\"StringLike\": {\"kms:EncryptionContext:aws:s3:arn\": \"\u003CTABLE_OR_TABLE_BUCKET_ARN>\u002F*\"}}\n        }\n    ]\n}\n",[3071],{"type":46,"tag":90,"props":3072,"children":3073},{"__ignoreMap":888},[3074,3081,3116,3139,3146,3183,3218,3276,3351,3387,3463,3471,3478,3514,3549,3605,3660,3695,3773,3780,3787],{"type":46,"tag":894,"props":3075,"children":3076},{"class":896,"line":40},[3077],{"type":46,"tag":894,"props":3078,"children":3079},{"style":931},[3080],{"type":52,"value":2315},{"type":46,"tag":894,"props":3082,"children":3083},{"class":896,"line":906},[3084,3088,3092,3096,3100,3104,3108,3112],{"type":46,"tag":894,"props":3085,"children":3086},{"style":931},[3087],{"type":52,"value":2323},{"type":46,"tag":894,"props":3089,"children":3090},{"style":2326},[3091],{"type":52,"value":2329},{"type":46,"tag":894,"props":3093,"children":3094},{"style":931},[3095],{"type":52,"value":2334},{"type":46,"tag":894,"props":3097,"children":3098},{"style":931},[3099],{"type":52,"value":1062},{"type":46,"tag":894,"props":3101,"children":3102},{"style":931},[3103],{"type":52,"value":969},{"type":46,"tag":894,"props":3105,"children":3106},{"style":915},[3107],{"type":52,"value":2347},{"type":46,"tag":894,"props":3109,"children":3110},{"style":931},[3111],{"type":52,"value":2334},{"type":46,"tag":894,"props":3113,"children":3114},{"style":931},[3115],{"type":52,"value":2356},{"type":46,"tag":894,"props":3117,"children":3118},{"class":896,"line":958},[3119,3123,3127,3131,3135],{"type":46,"tag":894,"props":3120,"children":3121},{"style":931},[3122],{"type":52,"value":2323},{"type":46,"tag":894,"props":3124,"children":3125},{"style":2326},[3126],{"type":52,"value":2368},{"type":46,"tag":894,"props":3128,"children":3129},{"style":931},[3130],{"type":52,"value":2334},{"type":46,"tag":894,"props":3132,"children":3133},{"style":931},[3134],{"type":52,"value":1062},{"type":46,"tag":894,"props":3136,"children":3137},{"style":931},[3138],{"type":52,"value":2381},{"type":46,"tag":894,"props":3140,"children":3141},{"class":896,"line":1322},[3142],{"type":46,"tag":894,"props":3143,"children":3144},{"style":931},[3145],{"type":52,"value":2389},{"type":46,"tag":894,"props":3147,"children":3148},{"class":896,"line":1749},[3149,3153,3158,3162,3166,3170,3175,3179],{"type":46,"tag":894,"props":3150,"children":3151},{"style":931},[3152],{"type":52,"value":2397},{"type":46,"tag":894,"props":3154,"children":3155},{"style":910},[3156],{"type":52,"value":3157},"Sid",{"type":46,"tag":894,"props":3159,"children":3160},{"style":931},[3161],{"type":52,"value":2334},{"type":46,"tag":894,"props":3163,"children":3164},{"style":931},[3165],{"type":52,"value":1062},{"type":46,"tag":894,"props":3167,"children":3168},{"style":931},[3169],{"type":52,"value":969},{"type":46,"tag":894,"props":3171,"children":3172},{"style":915},[3173],{"type":52,"value":3174},"EnableSystemTablesKeyUsage",{"type":46,"tag":894,"props":3176,"children":3177},{"style":931},[3178],{"type":52,"value":2334},{"type":46,"tag":894,"props":3180,"children":3181},{"style":931},[3182],{"type":52,"value":2356},{"type":46,"tag":894,"props":3184,"children":3185},{"class":896,"line":2016},[3186,3190,3194,3198,3202,3206,3210,3214],{"type":46,"tag":894,"props":3187,"children":3188},{"style":931},[3189],{"type":52,"value":2397},{"type":46,"tag":894,"props":3191,"children":3192},{"style":910},[3193],{"type":52,"value":2402},{"type":46,"tag":894,"props":3195,"children":3196},{"style":931},[3197],{"type":52,"value":2334},{"type":46,"tag":894,"props":3199,"children":3200},{"style":931},[3201],{"type":52,"value":1062},{"type":46,"tag":894,"props":3203,"children":3204},{"style":931},[3205],{"type":52,"value":969},{"type":46,"tag":894,"props":3207,"children":3208},{"style":915},[3209],{"type":52,"value":2419},{"type":46,"tag":894,"props":3211,"children":3212},{"style":931},[3213],{"type":52,"value":2334},{"type":46,"tag":894,"props":3215,"children":3216},{"style":931},[3217],{"type":52,"value":2356},{"type":46,"tag":894,"props":3219,"children":3220},{"class":896,"line":2455},[3221,3225,3229,3233,3237,3242,3246,3250,3254,3258,3262,3267,3271],{"type":46,"tag":894,"props":3222,"children":3223},{"style":931},[3224],{"type":52,"value":2397},{"type":46,"tag":894,"props":3226,"children":3227},{"style":910},[3228],{"type":52,"value":2439},{"type":46,"tag":894,"props":3230,"children":3231},{"style":931},[3232],{"type":52,"value":2334},{"type":46,"tag":894,"props":3234,"children":3235},{"style":931},[3236],{"type":52,"value":1062},{"type":46,"tag":894,"props":3238,"children":3239},{"style":931},[3240],{"type":52,"value":3241}," {",{"type":46,"tag":894,"props":3243,"children":3244},{"style":931},[3245],{"type":52,"value":2334},{"type":46,"tag":894,"props":3247,"children":3248},{"style":2464},[3249],{"type":52,"value":2467},{"type":46,"tag":894,"props":3251,"children":3252},{"style":931},[3253],{"type":52,"value":2334},{"type":46,"tag":894,"props":3255,"children":3256},{"style":931},[3257],{"type":52,"value":1062},{"type":46,"tag":894,"props":3259,"children":3260},{"style":931},[3261],{"type":52,"value":969},{"type":46,"tag":894,"props":3263,"children":3264},{"style":915},[3265],{"type":52,"value":3266},"systemtables.cloudwatch.amazonaws.com",{"type":46,"tag":894,"props":3268,"children":3269},{"style":931},[3270],{"type":52,"value":2334},{"type":46,"tag":894,"props":3272,"children":3273},{"style":931},[3274],{"type":52,"value":3275},"},\n",{"type":46,"tag":894,"props":3277,"children":3278},{"class":896,"line":2490},[3279,3283,3287,3291,3295,3299,3303,3308,3312,3317,3321,3326,3330,3334,3338,3343,3347],{"type":46,"tag":894,"props":3280,"children":3281},{"style":931},[3282],{"type":52,"value":2397},{"type":46,"tag":894,"props":3284,"children":3285},{"style":910},[3286],{"type":52,"value":2509},{"type":46,"tag":894,"props":3288,"children":3289},{"style":931},[3290],{"type":52,"value":2334},{"type":46,"tag":894,"props":3292,"children":3293},{"style":931},[3294],{"type":52,"value":1062},{"type":46,"tag":894,"props":3296,"children":3297},{"style":931},[3298],{"type":52,"value":2678},{"type":46,"tag":894,"props":3300,"children":3301},{"style":931},[3302],{"type":52,"value":2334},{"type":46,"tag":894,"props":3304,"children":3305},{"style":915},[3306],{"type":52,"value":3307},"kms:DescribeKey",{"type":46,"tag":894,"props":3309,"children":3310},{"style":931},[3311],{"type":52,"value":2334},{"type":46,"tag":894,"props":3313,"children":3314},{"style":931},[3315],{"type":52,"value":3316},",",{"type":46,"tag":894,"props":3318,"children":3319},{"style":931},[3320],{"type":52,"value":969},{"type":46,"tag":894,"props":3322,"children":3323},{"style":915},[3324],{"type":52,"value":3325},"kms:GenerateDataKey",{"type":46,"tag":894,"props":3327,"children":3328},{"style":931},[3329],{"type":52,"value":2334},{"type":46,"tag":894,"props":3331,"children":3332},{"style":931},[3333],{"type":52,"value":3316},{"type":46,"tag":894,"props":3335,"children":3336},{"style":931},[3337],{"type":52,"value":969},{"type":46,"tag":894,"props":3339,"children":3340},{"style":915},[3341],{"type":52,"value":3342},"kms:Decrypt",{"type":46,"tag":894,"props":3344,"children":3345},{"style":931},[3346],{"type":52,"value":2334},{"type":46,"tag":894,"props":3348,"children":3349},{"style":931},[3350],{"type":52,"value":2902},{"type":46,"tag":894,"props":3352,"children":3353},{"class":896,"line":2499},[3354,3358,3362,3366,3370,3374,3379,3383],{"type":46,"tag":894,"props":3355,"children":3356},{"style":931},[3357],{"type":52,"value":2397},{"type":46,"tag":894,"props":3359,"children":3360},{"style":910},[3361],{"type":52,"value":2914},{"type":46,"tag":894,"props":3363,"children":3364},{"style":931},[3365],{"type":52,"value":2334},{"type":46,"tag":894,"props":3367,"children":3368},{"style":931},[3369],{"type":52,"value":1062},{"type":46,"tag":894,"props":3371,"children":3372},{"style":931},[3373],{"type":52,"value":969},{"type":46,"tag":894,"props":3375,"children":3376},{"style":915},[3377],{"type":52,"value":3378},"arn:aws:kms:\u003CREGION>:\u003CACCOUNT>:key\u002F\u003CKEY_ID>",{"type":46,"tag":894,"props":3380,"children":3381},{"style":931},[3382],{"type":52,"value":2334},{"type":46,"tag":894,"props":3384,"children":3385},{"style":931},[3386],{"type":52,"value":2356},{"type":46,"tag":894,"props":3388,"children":3389},{"class":896,"line":2537},[3390,3394,3398,3402,3406,3410,3414,3418,3422,3426,3430,3434,3438,3442,3446,3450,3454,3458],{"type":46,"tag":894,"props":3391,"children":3392},{"style":931},[3393],{"type":52,"value":2397},{"type":46,"tag":894,"props":3395,"children":3396},{"style":910},[3397],{"type":52,"value":2547},{"type":46,"tag":894,"props":3399,"children":3400},{"style":931},[3401],{"type":52,"value":2334},{"type":46,"tag":894,"props":3403,"children":3404},{"style":931},[3405],{"type":52,"value":1062},{"type":46,"tag":894,"props":3407,"children":3408},{"style":931},[3409],{"type":52,"value":3241},{"type":46,"tag":894,"props":3411,"children":3412},{"style":931},[3413],{"type":52,"value":2334},{"type":46,"tag":894,"props":3415,"children":3416},{"style":2464},[3417],{"type":52,"value":2572},{"type":46,"tag":894,"props":3419,"children":3420},{"style":931},[3421],{"type":52,"value":2334},{"type":46,"tag":894,"props":3423,"children":3424},{"style":931},[3425],{"type":52,"value":1062},{"type":46,"tag":894,"props":3427,"children":3428},{"style":931},[3429],{"type":52,"value":3241},{"type":46,"tag":894,"props":3431,"children":3432},{"style":931},[3433],{"type":52,"value":2334},{"type":46,"tag":894,"props":3435,"children":3436},{"style":2596},[3437],{"type":52,"value":2288},{"type":46,"tag":894,"props":3439,"children":3440},{"style":931},[3441],{"type":52,"value":2334},{"type":46,"tag":894,"props":3443,"children":3444},{"style":931},[3445],{"type":52,"value":1062},{"type":46,"tag":894,"props":3447,"children":3448},{"style":931},[3449],{"type":52,"value":969},{"type":46,"tag":894,"props":3451,"children":3452},{"style":915},[3453],{"type":52,"value":2615},{"type":46,"tag":894,"props":3455,"children":3456},{"style":931},[3457],{"type":52,"value":2334},{"type":46,"tag":894,"props":3459,"children":3460},{"style":931},[3461],{"type":52,"value":3462},"}}\n",{"type":46,"tag":894,"props":3464,"children":3465},{"class":896,"line":2562},[3466],{"type":46,"tag":894,"props":3467,"children":3468},{"style":931},[3469],{"type":52,"value":3470},"        },\n",{"type":46,"tag":894,"props":3472,"children":3473},{"class":896,"line":2587},[3474],{"type":46,"tag":894,"props":3475,"children":3476},{"style":931},[3477],{"type":52,"value":2389},{"type":46,"tag":894,"props":3479,"children":3480},{"class":896,"line":2622},[3481,3485,3489,3493,3497,3501,3506,3510],{"type":46,"tag":894,"props":3482,"children":3483},{"style":931},[3484],{"type":52,"value":2397},{"type":46,"tag":894,"props":3486,"children":3487},{"style":910},[3488],{"type":52,"value":3157},{"type":46,"tag":894,"props":3490,"children":3491},{"style":931},[3492],{"type":52,"value":2334},{"type":46,"tag":894,"props":3494,"children":3495},{"style":931},[3496],{"type":52,"value":1062},{"type":46,"tag":894,"props":3498,"children":3499},{"style":931},[3500],{"type":52,"value":969},{"type":46,"tag":894,"props":3502,"children":3503},{"style":915},[3504],{"type":52,"value":3505},"EnableS3TablesMaintenanceKeyUsage",{"type":46,"tag":894,"props":3507,"children":3508},{"style":931},[3509],{"type":52,"value":2334},{"type":46,"tag":894,"props":3511,"children":3512},{"style":931},[3513],{"type":52,"value":2356},{"type":46,"tag":894,"props":3515,"children":3516},{"class":896,"line":2631},[3517,3521,3525,3529,3533,3537,3541,3545],{"type":46,"tag":894,"props":3518,"children":3519},{"style":931},[3520],{"type":52,"value":2397},{"type":46,"tag":894,"props":3522,"children":3523},{"style":910},[3524],{"type":52,"value":2402},{"type":46,"tag":894,"props":3526,"children":3527},{"style":931},[3528],{"type":52,"value":2334},{"type":46,"tag":894,"props":3530,"children":3531},{"style":931},[3532],{"type":52,"value":1062},{"type":46,"tag":894,"props":3534,"children":3535},{"style":931},[3536],{"type":52,"value":969},{"type":46,"tag":894,"props":3538,"children":3539},{"style":915},[3540],{"type":52,"value":2419},{"type":46,"tag":894,"props":3542,"children":3543},{"style":931},[3544],{"type":52,"value":2334},{"type":46,"tag":894,"props":3546,"children":3547},{"style":931},[3548],{"type":52,"value":2356},{"type":46,"tag":894,"props":3550,"children":3551},{"class":896,"line":2656},[3552,3556,3560,3564,3568,3572,3576,3580,3584,3588,3592,3597,3601],{"type":46,"tag":894,"props":3553,"children":3554},{"style":931},[3555],{"type":52,"value":2397},{"type":46,"tag":894,"props":3557,"children":3558},{"style":910},[3559],{"type":52,"value":2439},{"type":46,"tag":894,"props":3561,"children":3562},{"style":931},[3563],{"type":52,"value":2334},{"type":46,"tag":894,"props":3565,"children":3566},{"style":931},[3567],{"type":52,"value":1062},{"type":46,"tag":894,"props":3569,"children":3570},{"style":931},[3571],{"type":52,"value":3241},{"type":46,"tag":894,"props":3573,"children":3574},{"style":931},[3575],{"type":52,"value":2334},{"type":46,"tag":894,"props":3577,"children":3578},{"style":2464},[3579],{"type":52,"value":2467},{"type":46,"tag":894,"props":3581,"children":3582},{"style":931},[3583],{"type":52,"value":2334},{"type":46,"tag":894,"props":3585,"children":3586},{"style":931},[3587],{"type":52,"value":1062},{"type":46,"tag":894,"props":3589,"children":3590},{"style":931},[3591],{"type":52,"value":969},{"type":46,"tag":894,"props":3593,"children":3594},{"style":915},[3595],{"type":52,"value":3596},"maintenance.s3tables.amazonaws.com",{"type":46,"tag":894,"props":3598,"children":3599},{"style":931},[3600],{"type":52,"value":2334},{"type":46,"tag":894,"props":3602,"children":3603},{"style":931},[3604],{"type":52,"value":3275},{"type":46,"tag":894,"props":3606,"children":3607},{"class":896,"line":2699},[3608,3612,3616,3620,3624,3628,3632,3636,3640,3644,3648,3652,3656],{"type":46,"tag":894,"props":3609,"children":3610},{"style":931},[3611],{"type":52,"value":2397},{"type":46,"tag":894,"props":3613,"children":3614},{"style":910},[3615],{"type":52,"value":2509},{"type":46,"tag":894,"props":3617,"children":3618},{"style":931},[3619],{"type":52,"value":2334},{"type":46,"tag":894,"props":3621,"children":3622},{"style":931},[3623],{"type":52,"value":1062},{"type":46,"tag":894,"props":3625,"children":3626},{"style":931},[3627],{"type":52,"value":2678},{"type":46,"tag":894,"props":3629,"children":3630},{"style":931},[3631],{"type":52,"value":2334},{"type":46,"tag":894,"props":3633,"children":3634},{"style":915},[3635],{"type":52,"value":3325},{"type":46,"tag":894,"props":3637,"children":3638},{"style":931},[3639],{"type":52,"value":2334},{"type":46,"tag":894,"props":3641,"children":3642},{"style":931},[3643],{"type":52,"value":3316},{"type":46,"tag":894,"props":3645,"children":3646},{"style":931},[3647],{"type":52,"value":969},{"type":46,"tag":894,"props":3649,"children":3650},{"style":915},[3651],{"type":52,"value":3342},{"type":46,"tag":894,"props":3653,"children":3654},{"style":931},[3655],{"type":52,"value":2334},{"type":46,"tag":894,"props":3657,"children":3658},{"style":931},[3659],{"type":52,"value":2902},{"type":46,"tag":894,"props":3661,"children":3662},{"class":896,"line":2708},[3663,3667,3671,3675,3679,3683,3687,3691],{"type":46,"tag":894,"props":3664,"children":3665},{"style":931},[3666],{"type":52,"value":2397},{"type":46,"tag":894,"props":3668,"children":3669},{"style":910},[3670],{"type":52,"value":2914},{"type":46,"tag":894,"props":3672,"children":3673},{"style":931},[3674],{"type":52,"value":2334},{"type":46,"tag":894,"props":3676,"children":3677},{"style":931},[3678],{"type":52,"value":1062},{"type":46,"tag":894,"props":3680,"children":3681},{"style":931},[3682],{"type":52,"value":969},{"type":46,"tag":894,"props":3684,"children":3685},{"style":915},[3686],{"type":52,"value":3378},{"type":46,"tag":894,"props":3688,"children":3689},{"style":931},[3690],{"type":52,"value":2334},{"type":46,"tag":894,"props":3692,"children":3693},{"style":931},[3694],{"type":52,"value":2356},{"type":46,"tag":894,"props":3696,"children":3697},{"class":896,"line":2717},[3698,3702,3706,3710,3714,3718,3722,3727,3731,3735,3739,3743,3748,3752,3756,3760,3765,3769],{"type":46,"tag":894,"props":3699,"children":3700},{"style":931},[3701],{"type":52,"value":2397},{"type":46,"tag":894,"props":3703,"children":3704},{"style":910},[3705],{"type":52,"value":2547},{"type":46,"tag":894,"props":3707,"children":3708},{"style":931},[3709],{"type":52,"value":2334},{"type":46,"tag":894,"props":3711,"children":3712},{"style":931},[3713],{"type":52,"value":1062},{"type":46,"tag":894,"props":3715,"children":3716},{"style":931},[3717],{"type":52,"value":3241},{"type":46,"tag":894,"props":3719,"children":3720},{"style":931},[3721],{"type":52,"value":2334},{"type":46,"tag":894,"props":3723,"children":3724},{"style":2464},[3725],{"type":52,"value":3726},"StringLike",{"type":46,"tag":894,"props":3728,"children":3729},{"style":931},[3730],{"type":52,"value":2334},{"type":46,"tag":894,"props":3732,"children":3733},{"style":931},[3734],{"type":52,"value":1062},{"type":46,"tag":894,"props":3736,"children":3737},{"style":931},[3738],{"type":52,"value":3241},{"type":46,"tag":894,"props":3740,"children":3741},{"style":931},[3742],{"type":52,"value":2334},{"type":46,"tag":894,"props":3744,"children":3745},{"style":2596},[3746],{"type":52,"value":3747},"kms:EncryptionContext:aws:s3:arn",{"type":46,"tag":894,"props":3749,"children":3750},{"style":931},[3751],{"type":52,"value":2334},{"type":46,"tag":894,"props":3753,"children":3754},{"style":931},[3755],{"type":52,"value":1062},{"type":46,"tag":894,"props":3757,"children":3758},{"style":931},[3759],{"type":52,"value":969},{"type":46,"tag":894,"props":3761,"children":3762},{"style":915},[3763],{"type":52,"value":3764},"\u003CTABLE_OR_TABLE_BUCKET_ARN>\u002F*",{"type":46,"tag":894,"props":3766,"children":3767},{"style":931},[3768],{"type":52,"value":2334},{"type":46,"tag":894,"props":3770,"children":3771},{"style":931},[3772],{"type":52,"value":3462},{"type":46,"tag":894,"props":3774,"children":3775},{"class":896,"line":2726},[3776],{"type":46,"tag":894,"props":3777,"children":3778},{"style":931},[3779],{"type":52,"value":2723},{"type":46,"tag":894,"props":3781,"children":3782},{"class":896,"line":2735},[3783],{"type":46,"tag":894,"props":3784,"children":3785},{"style":931},[3786],{"type":52,"value":2732},{"type":46,"tag":894,"props":3788,"children":3790},{"class":896,"line":3789},21,[3791],{"type":46,"tag":894,"props":3792,"children":3793},{"style":931},[3794],{"type":52,"value":2741},{"type":46,"tag":876,"props":3796,"children":3798},{"id":3797},"data-sensitivity",[3799],{"type":52,"value":3800},"Data Sensitivity",{"type":46,"tag":62,"props":3802,"children":3803},{},[3804],{"type":52,"value":3805},"Log data may contain PII including IP addresses, user agents, request parameters, and authentication tokens. Treat all exported log tables as sensitive by default.",{"type":46,"tag":876,"props":3807,"children":3809},{"id":3808},"access-control-best-practices",[3810],{"type":52,"value":3811},"Access Control Best Practices",{"type":46,"tag":981,"props":3813,"children":3814},{},[3815,3843,3848],{"type":46,"tag":985,"props":3816,"children":3817},{},[3818,3820,3826,3828,3834,3835,3841],{"type":52,"value":3819},"Use Lake Formation column-level security to restrict access to sensitive columns (e.g., ",{"type":46,"tag":90,"props":3821,"children":3823},{"className":3822},[],[3824],{"type":52,"value":3825},"srcaddr",{"type":52,"value":3827},", ",{"type":46,"tag":90,"props":3829,"children":3831},{"className":3830},[],[3832],{"type":52,"value":3833},"source_ip_address",{"type":52,"value":3827},{"type":46,"tag":90,"props":3836,"children":3838},{"className":3837},[],[3839],{"type":52,"value":3840},"httpRequest",{"type":52,"value":3842},"). Grant permissions to specific tables and columns rather than wildcards.",{"type":46,"tag":985,"props":3844,"children":3845},{},[3846],{"type":52,"value":3847},"Configure SSE-KMS encryption on the Athena workgroup output bucket to protect query results at rest.",{"type":46,"tag":985,"props":3849,"children":3850},{},[3851,3853,3859],{"type":52,"value":3852},"Prefer specific data source associations over wildcard (",{"type":46,"tag":90,"props":3854,"children":3856},{"className":3855},[],[3857],{"type":52,"value":3858},"*\u002F*",{"type":52,"value":3860},") to limit which data sources are exported to queryable tables.",{"type":46,"tag":876,"props":3862,"children":3864},{"id":3863},"audit-trail",[3865],{"type":52,"value":3866},"Audit Trail",{"type":46,"tag":62,"props":3868,"children":3869},{},[3870,3872,3878,3879,3885,3887,3893,3894,3900],{"type":52,"value":3871},"Enable CloudTrail logging for Athena (",{"type":46,"tag":90,"props":3873,"children":3875},{"className":3874},[],[3876],{"type":52,"value":3877},"StartQueryExecution",{"type":52,"value":3827},{"type":46,"tag":90,"props":3880,"children":3882},{"className":3881},[],[3883],{"type":52,"value":3884},"GetQueryResults",{"type":52,"value":3886},") and Lake Formation (",{"type":46,"tag":90,"props":3888,"children":3890},{"className":3889},[],[3891],{"type":52,"value":3892},"GrantPermissions",{"type":52,"value":3827},{"type":46,"tag":90,"props":3895,"children":3897},{"className":3896},[],[3898],{"type":52,"value":3899},"RevokePermissions",{"type":52,"value":3901},") API calls to maintain an audit trail of who queried what data.",{"type":46,"tag":55,"props":3903,"children":3905},{"id":3904},"additional-resources",[3906],{"type":52,"value":3907},"Additional Resources",{"type":46,"tag":981,"props":3909,"children":3910},{},[3911,3921,3931,3941,3951],{"type":46,"tag":985,"props":3912,"children":3913},{},[3914],{"type":46,"tag":74,"props":3915,"children":3918},{"href":3916,"rel":3917},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fs3-tables-integration.html",[78],[3919],{"type":52,"value":3920},"CloudWatch Logs S3 Tables integration",{"type":46,"tag":985,"props":3922,"children":3923},{},[3924],{"type":46,"tag":74,"props":3925,"children":3928},{"href":3926,"rel":3927},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002FAWS-logs-and-resource-types.html",[78],[3929],{"type":52,"value":3930},"Supported AWS vended data sources",{"type":46,"tag":985,"props":3932,"children":3933},{},[3934],{"type":46,"tag":74,"props":3935,"children":3938},{"href":3936,"rel":3937},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonCloudWatch\u002Flatest\u002Flogs\u002Fs3-tables-integration.html#s3-tables-integration-iam-permissions",[78],[3939],{"type":52,"value":3940},"IAM permissions for integration",{"type":46,"tag":985,"props":3942,"children":3943},{},[3944],{"type":46,"tag":74,"props":3945,"children":3948},{"href":3946,"rel":3947},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002Fs3-tables-integrating-aws.html",[78],[3949],{"type":52,"value":3950},"Integrating S3 Tables with analytics services",{"type":46,"tag":985,"props":3952,"children":3953},{},[3954],{"type":46,"tag":74,"props":3955,"children":3958},{"href":3956,"rel":3957},"https:\u002F\u002Fdocs.aws.amazon.com\u002Flake-formation\u002Flatest\u002Fdg\u002Fgranting-catalog-permissions.html",[78],[3959],{"type":52,"value":3960},"Lake Formation permissions",{"type":46,"tag":3962,"props":3963,"children":3964},"style",{},[3965],{"type":52,"value":3966},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3968,"total":4139},[3969,3986,4001,4016,4031,4041,4056,4072,4089,4102,4114,4129],{"slug":3970,"name":3970,"fn":3971,"description":3972,"org":3973,"tags":3974,"stars":27,"repoUrl":28,"updatedAt":3985},"agents-build","add capabilities to existing agent projects","Use when adding capabilities to an existing agent project — memory, app integration, VPC, multi-agent, migration, model changes, browser, code interpreter, or resource removal. Triggers on: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"auth to call agent\", \"streaming responses\", \"VPC\", \"VPC connectivity\", \"VPC error\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"after import\", \"migration issue\", \"framework for migration\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"resource-based policy on memory\", \"pay for x402 content\", \"402 Payment Required\", \"microtransactions\", \"paid API or tool\". Not for connecting to external APIs via Gateway — use agents-connect. Not for scaffolding a new project — use agents-get-started. Not for CLI\u002Fdev server errors — use agents-debug. Strands vs LangGraph in a migration context routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3975,3978,3981,3982],{"name":3976,"slug":3977,"type":15},"Agents","agents",{"name":3979,"slug":3980,"type":15},"Automation","automation",{"name":26,"slug":8,"type":15},{"name":3983,"slug":3984,"type":15},"Engineering","engineering","2026-07-12T08:42:53.812877",{"slug":3987,"name":3987,"fn":3988,"description":3989,"org":3990,"tags":3991,"stars":27,"repoUrl":28,"updatedAt":4000},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3992,3993,3996,3999],{"name":3976,"slug":3977,"type":15},{"name":3994,"slug":3995,"type":15},"API Development","api-development",{"name":3997,"slug":3998,"type":15},"Authentication","authentication",{"name":26,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":4002,"name":4002,"fn":4003,"description":4004,"org":4005,"tags":4006,"stars":27,"repoUrl":28,"updatedAt":4015},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4007,4008,4009,4012],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4010,"slug":4011,"type":15},"Debugging","debugging",{"name":4013,"slug":4014,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":4017,"name":4017,"fn":4018,"description":4019,"org":4020,"tags":4021,"stars":27,"repoUrl":28,"updatedAt":4030},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4022,4023,4024,4027],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4025,"slug":4026,"type":15},"CI\u002FCD","ci-cd",{"name":4028,"slug":4029,"type":15},"Deployment","deployment","2026-07-12T08:42:55.059577",{"slug":4032,"name":4032,"fn":4033,"description":4034,"org":4035,"tags":4036,"stars":27,"repoUrl":28,"updatedAt":4040},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4037,4038,4039],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4028,"slug":4029,"type":15},"2026-07-12T08:42:51.963247",{"slug":4042,"name":4042,"fn":4043,"description":4044,"org":4045,"tags":4046,"stars":27,"repoUrl":28,"updatedAt":4055},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4047,4048,4049,4052],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4050,"slug":4051,"type":15},"Best Practices","best-practices",{"name":4053,"slug":4054,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":4057,"name":4057,"fn":4058,"description":4059,"org":4060,"tags":4061,"stars":27,"repoUrl":28,"updatedAt":4071},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4062,4063,4064,4067,4068],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4065,"slug":4066,"type":15},"Evals","evals",{"name":4013,"slug":4014,"type":15},{"name":4069,"slug":4070,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",{"slug":4073,"name":4073,"fn":4074,"description":4075,"org":4076,"tags":4077,"stars":27,"repoUrl":28,"updatedAt":4088},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4078,4079,4082,4085],{"name":26,"slug":8,"type":15},{"name":4080,"slug":4081,"type":15},"Database","database",{"name":4083,"slug":4084,"type":15},"MySQL","mysql",{"name":4086,"slug":4087,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":4090,"name":4090,"fn":4091,"description":4092,"org":4093,"tags":4094,"stars":27,"repoUrl":28,"updatedAt":4101},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4095,4096,4097,4100],{"name":26,"slug":8,"type":15},{"name":4080,"slug":4081,"type":15},{"name":4098,"slug":4099,"type":15},"PostgreSQL","postgresql",{"name":4086,"slug":4087,"type":15},"2026-07-16T06:00:34.789624",{"slug":4103,"name":4103,"fn":4104,"description":4105,"org":4106,"tags":4107,"stars":27,"repoUrl":28,"updatedAt":4113},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4108,4109,4110],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4111,"slug":4112,"type":15},"LLM","llm","2026-07-25T05:30:35.20899",{"slug":4115,"name":4115,"fn":4116,"description":4117,"org":4118,"tags":4119,"stars":27,"repoUrl":28,"updatedAt":4128},"amazon-documentdb","manage Amazon DocumentDB clusters","Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS\u002FVPC\u002Fdriver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4120,4121,4122,4125],{"name":26,"slug":8,"type":15},{"name":4080,"slug":4081,"type":15},{"name":4123,"slug":4124,"type":15},"MongoDB","mongodb",{"name":4126,"slug":4127,"type":15},"NoSQL","nosql","2026-07-12T08:43:00.455878",{"slug":4130,"name":4130,"fn":4131,"description":4132,"org":4133,"tags":4134,"stars":27,"repoUrl":28,"updatedAt":4138},"amazon-dynamodb","design and debug DynamoDB data layers","Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition\u002Fsort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch\u002FRedshift\u002FSageMaker Lakehouse, and produces a defensible data-layer design with a monthly cost estimate and optional live validation. Applies whenever a user is designing, reviewing, or refactoring anything backed by DynamoDB — schemas, access patterns, GSIs, single- vs. multi-table choices, Streams consumers, transactional outboxes, Global Tables, zero-ETL pipelines — even when they don't say \"axioms\" or \"design review.\" Also applies when debugging hot partitions, throttling, unbounded Scans, LWW conflicts, or surprise bills on DynamoDB workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4135,4136,4137],{"name":26,"slug":8,"type":15},{"name":4080,"slug":4081,"type":15},{"name":4126,"slug":4127,"type":15},"2026-07-16T06:00:37.690386",115,{"items":4141,"total":4191},[4142,4149,4156,4163,4170,4176,4183],{"slug":3970,"name":3970,"fn":3971,"description":3972,"org":4143,"tags":4144,"stars":27,"repoUrl":28,"updatedAt":3985},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4145,4146,4147,4148],{"name":3976,"slug":3977,"type":15},{"name":3979,"slug":3980,"type":15},{"name":26,"slug":8,"type":15},{"name":3983,"slug":3984,"type":15},{"slug":3987,"name":3987,"fn":3988,"description":3989,"org":4150,"tags":4151,"stars":27,"repoUrl":28,"updatedAt":4000},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4152,4153,4154,4155],{"name":3976,"slug":3977,"type":15},{"name":3994,"slug":3995,"type":15},{"name":3997,"slug":3998,"type":15},{"name":26,"slug":8,"type":15},{"slug":4002,"name":4002,"fn":4003,"description":4004,"org":4157,"tags":4158,"stars":27,"repoUrl":28,"updatedAt":4015},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4159,4160,4161,4162],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4010,"slug":4011,"type":15},{"name":4013,"slug":4014,"type":15},{"slug":4017,"name":4017,"fn":4018,"description":4019,"org":4164,"tags":4165,"stars":27,"repoUrl":28,"updatedAt":4030},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4166,4167,4168,4169],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4025,"slug":4026,"type":15},{"name":4028,"slug":4029,"type":15},{"slug":4032,"name":4032,"fn":4033,"description":4034,"org":4171,"tags":4172,"stars":27,"repoUrl":28,"updatedAt":4040},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4173,4174,4175],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4028,"slug":4029,"type":15},{"slug":4042,"name":4042,"fn":4043,"description":4044,"org":4177,"tags":4178,"stars":27,"repoUrl":28,"updatedAt":4055},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4179,4180,4181,4182],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4050,"slug":4051,"type":15},{"name":4053,"slug":4054,"type":15},{"slug":4057,"name":4057,"fn":4058,"description":4059,"org":4184,"tags":4185,"stars":27,"repoUrl":28,"updatedAt":4071},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4186,4187,4188,4189,4190],{"name":3976,"slug":3977,"type":15},{"name":26,"slug":8,"type":15},{"name":4065,"slug":4066,"type":15},{"name":4013,"slug":4014,"type":15},{"name":4069,"slug":4070,"type":15},114]