[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-querying-aws-redshift":3,"mdc--w517ms-key":38,"related-org-aws-querying-aws-redshift":4415,"related-repo-aws-querying-aws-redshift":4589},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":27,"repoUrl":28,"updatedAt":29,"license":30,"forks":31,"topics":32,"repo":33,"sourceUrl":36,"mdContent":37},"querying-aws-redshift","query AWS Redshift system logs","Enables Redshift system-table (SYS_*) log publishing to S3 Tables in Apache Iceberg format for both Provisioned clusters and Serverless namespaces, verifies publishing status, and queries the published logs via any Iceberg-compatible engine including Redshift and Athena. Covers system tables such as sys_query_history, sys_query_text, sys_connection_log, sys_query_detail, and sys_session_history. Applies when turning on S3 Tables log publishing for a cluster or namespace, confirming publishing status and locating the S3 Tables namespace, querying non-realtime data from Redshift system tables off-cluster at scale, or building dashboards for Redshift monitoring and auditing, especially for historical or high-volume system-table data beyond the in-cluster SYS_ view retention window. Trigger phrases: publish redshift system table log to s3 tables, enable-logging s3 tables, describe redshift logging status, query redshift system tables in athena or redshift, redshift log exports to iceberg.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22,25],{"name":13,"slug":14,"type":15},"Logs","logs","tag",{"name":17,"slug":18,"type":15},"Data Engineering","data-engineering",{"name":20,"slug":21,"type":15},"Database","database",{"name":23,"slug":24,"type":15},"SQL","sql",{"name":26,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-08-20T03:53:16.456732",null,157,[],{"repoUrl":28,"stars":27,"forks":31,"topics":34,"description":35},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fspecialized-skills\u002Fsystem-table-skills\u002Fquerying-aws-redshift","---\nname: querying-aws-redshift\ndescription: >-\n  Enables Redshift system-table (SYS_*) log publishing to S3 Tables in Apache\n  Iceberg format for both Provisioned clusters and Serverless namespaces,\n  verifies publishing status, and queries the published logs via any\n  Iceberg-compatible engine including Redshift and Athena. Covers system tables\n  such as sys_query_history, sys_query_text, sys_connection_log,\n  sys_query_detail, and sys_session_history. Applies when turning on S3 Tables\n  log publishing for a cluster or namespace, confirming publishing status and\n  locating the S3 Tables namespace, querying non-realtime data from Redshift\n  system tables off-cluster at scale, or building dashboards for Redshift\n  monitoring and auditing, especially for historical or high-volume system-table data\n  beyond the in-cluster SYS_ view retention window. Trigger phrases: publish\n  redshift system table log to s3 tables, enable-logging s3 tables, describe\n  redshift logging status, query redshift system tables in athena or redshift,\n  redshift log exports to iceberg.\nversion: 1\nargument-hint: \"['enable CLUSTER'|'status CLUSTER'|'query SQL'|'configure']\"\n---\n\n# Query AWS Redshift System Tables\n\n## Overview\n\n**Works best with** the [AWS MCP server](https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002F) for sandboxed execution and audit logging. All commands below use the AWS CLI and work in any environment with configured AWS credentials. Use IAM roles or temporary credentials; avoid long-lived access keys.\n\nRedshift can publish **system tables** — the `SYS_*` monitoring data such as `sys_query_history`, `sys_query_detail`, and `sys_connection_log` — to **S3 Tables** as continuously-updated Apache Iceberg tables.\n\nTerminology used throughout: **system table** refers to a `SYS_*` dataset generally, and each one maps 1:1 to a published Iceberg table. Where this skill says **`SYS_` view**, it means specifically the live in-cluster object you query on the cluster itself — that is a view, and it is a different thing from the published S3 Tables copy. This applies to both **Provisioned clusters** and **Serverless namespaces**. It is an opt-in extension of the existing logging APIs. Published tables are read-only, stored in the AWS-managed `aws-redshift` table bucket, and queryable via any Iceberg-compatible engine including Amazon Athena and Amazon Redshift itself.\n\nQuerying the S3 Tables copy is preferred over the live in-cluster `SYS_` views when analyzing historical or high-volume system-table data because:\n\n- The in-cluster `SYS_` views have a limited retention window; S3 Tables retains history well beyond it.\n- Querying S3 Tables adds **no load** to the running Redshift cluster.\n- The logs are Iceberg tables, so they can be queried at scale from any Iceberg-compatible engine and joined with other lake data.\n\n## Decision Tree\n\n| User intent | Use this skill? | Alternative |\n|---|---|---|\n| Turn on S3 Tables log publishing for a cluster or namespace | **Yes** | — |\n| Confirm a cluster\u002Fnamespace is publishing \u002F find its S3 Tables namespace | **Yes** | — |\n| Querying non-realtime data from Redshift system tables | **Yes** | — |\n| Build daily\u002Fweekly\u002Fmonthly dashboard for Redshift monitoring and auditing | **Yes** | — |\n| Selectively stop S3 Tables publishing | **Yes** | — |\n| Query published system tables from Redshift (cross-database) | **Yes** | — |\n| Query published system tables from Athena | **Yes** | — |\n| Inspect the *current, real-time* `SYS_` state on a live cluster | **No** | Query the `SYS_` view on the cluster directly |\n| Query data *inside* customer tables | **No** | Direct Redshift SQL on the cluster |\n\n## Supported Data Sources\n\n| Compute type | Enable \u002F disable API | Status API | Granularity options |\n|---|---|---|---|\n| Redshift Provisioned cluster | `redshift enable-logging` \u002F `redshift disable-logging` | `redshift describe-logging-status` | `cluster` (default), `account` |\n| Redshift Serverless namespace | `redshift-serverless update-namespace` with `--s3-table-action Enable`\u002F`Disable` | `redshift-serverless get-namespace` | `namespace` (default), `account` |\n\nBoth compute types publish into the same AWS-managed `aws-redshift` table bucket and are queried identically once published. They differ only in the enable\u002Fdisable API surface and in the casing of the status response — see the flag and field tables in [Common Tasks](#common-tasks).\n\nNot covered by this skill: Redshift audit logs delivered to S3 or CloudWatch (`useractivitylog`, `userlog`, `connectionlog`), which use the separate `--log-exports` mechanism on Serverless and are not `SYS_*` system tables.\n\n## Common Tasks\n\n### 1. Check If Configured\n\nBefore querying, confirm the cluster or namespace is publishing to S3 Tables.\n\n```bash\n# Provisioned\naws redshift describe-logging-status --region \u003CREGION> --cluster-identifier \u003CCLUSTER_ID>\n# Serverless\naws redshift-serverless get-namespace --region \u003CREGION> --namespace-name \u003CNAMESPACE_NAME>\n```\n\n**Interpret the response.** The two compute types return the *same* information under **different field names and casing** — Provisioned uses PascalCase under `S3Tables`, Serverless uses camelCase under `namespace.s3TablePublishStatus`:\n\n| Meaning | Provisioned (`describe-logging-status`) | Serverless (`get-namespace`) |\n|---|---|---|\n| Not enabled | `LoggingEnabled: false` or no `S3Tables` block | no `s3TablePublishStatus` block |\n| Destination includes S3 Tables | `LogDestinationType` contains `s3table` | `logDestinationType` contains `s3table` |\n| List of published `SYS_*` tables | `S3Tables.S3Tables` | `namespace.s3TablePublishStatus.s3Tables` |\n| **The exact S3 Tables namespace** (required for querying) | `S3Tables.S3TableNamespace` | `namespace.s3TablePublishStatus.s3TableNamespace` |\n| Granularity | `S3Tables.S3TableGranularity` (`cluster`\u002F`account`) | `namespace.s3TablePublishStatus.s3TableGranularity` (`namespace`\u002F`account`) |\n| Per-table last ingest time | `S3Tables.LastIngestionTimes` | `namespace.s3TablePublishStatus.lastIngestionTimes` |\n| All available system tables published | `S3Tables.EnabledAll` | `namespace.s3TablePublishStatus.enabledAll` |\n\nNotes:\n\n- `LogDestinationType` is a **comma-joined list** when more than one destination is active — e.g. `\"cloudwatch,s3table\"`. Test with a substring\u002Fcontains check, not equality against `s3table`.\n- An empty `LastIngestionTimes` \u002F `lastIngestionTimes` map, or a table listed as published but absent from the map, means data for that table may still be in flight. Compare successive values to confirm new data is landing.\n- On Serverless, do **not** read the top-level `logExports` field for this feature — that field carries the CloudWatch\u002FS3 audit logs (`useractivitylog`, `userlog`, `connectionlog`) and is unrelated to `SYS_*` S3 Tables publishing.\n\n### 2. Enable (if not configured)\n\n```bash\n# Provisioned\naws redshift enable-logging --region \u003CREGION> --cluster-identifier \u003CCLUSTER_ID> --log-destination-type s3table --log-exports \u003CSYS_TABLE>... --s3-table-granularity \u003Ccluster|account> --s3-table-kms-key-id \u003CKMS_KEY_ARN>\n# Serverless\naws redshift-serverless update-namespace --region \u003CREGION> --namespace-name \u003CNAMESPACE_NAME> --log-destination-type s3table --s3-table-names \u003CSYS_TABLE>... --s3-table-action Enable --s3-table-granularity \u003Cnamespace|account> --s3-table-kms-key-id \u003CKMS_KEY_ARN>\n```\n\n`--s3-table-kms-key-id` is part of both commands deliberately, not an optional add-on. Omitting it does not fail — the tables fall back to an AWS-owned key you cannot audit, restrict by policy, or revoke. Because `SYS_*` tables carry `query_text`, `user_name`, and `remote_host`, treat the customer-managed key as the default and drop the flag only for throwaway environments.\n\nEnable from AWS console Amazon Redshift Console > Clusters > select your cluster > Tabs > Integrations \u002F System table integration\n\n**The two compute types take different flags for the same feature.** Do not carry Provisioned flag names over to Serverless:\n\n| Purpose | Provisioned (`enable-logging`) | Serverless (`update-namespace`) |\n|---|---|---|\n| Which system tables to publish | `--log-exports` | `--s3-table-names` |\n| Enable vs disable | separate `enable-logging` \u002F `disable-logging` operations | `--s3-table-action Enable` \\| `Disable` |\n| Granularity | `--s3-table-granularity` `cluster` \\| `account` | `--s3-table-granularity` `namespace` \\| `account` |\n| Customer-managed KMS key | `--s3-table-kms-key-id` | `--s3-table-kms-key-id` |\n| Validate without applying | `--dry-run` | `--dry-run` |\n\nNotes:\n\n- Granularity: Provisioned supports `cluster` (default) or `account`; Serverless supports `namespace` (default) or `account`.\n- `cluster`\u002F`namespace` granularity → one S3 table per cluster\u002Fnamespace; `account` → one shared table for all clusters\u002Fnamespaces per account per region.\n- Use `all` to publish all available `SYS_*` tables — `--log-exports all` on Provisioned, `--s3-table-names all` on Serverless.\n- **Encryption at rest is strongly recommended for production.** Without `--s3-table-kms-key-id` the published tables are encrypted with an AWS-owned key, which you cannot audit, restrict by policy, or revoke. `SYS_*` tables carry `query_text`, `user_name`, and `remote_host` (see [Security Considerations](#security-considerations)), so pass a customer-managed key. Grant key access using the complete key policy in `${SKILL_DIR}\u002Freferences\u002Fsecurity.md` rather than an abbreviated action list — it needs **two** service principals (`systemtables.redshift.amazonaws.com` for publishing and `maintenance.s3tables.amazonaws.com` for table maintenance\u002Fcompaction). Provisioning only the publishing principal lets writes succeed while compaction silently fails.\n- Both operations accept `--dry-run` to validate the request without changing anything. Provisioned returns a `DryRunOperation` error on success (\"Request would have succeeded, but DryRun flag is set\"); Serverless returns an empty body and exit code 0. Note that the Serverless dry-run validates request *shape* only, not parameter values, so a successful dry-run there does not guarantee the values are accepted.\n\n**Disable selectively:**\n\n```bash\n# Provisioned\naws redshift disable-logging --region \u003CREGION> --cluster-identifier \u003CCLUSTER_ID> --log-destination-type s3table --log-exports \u003CSYS_TABLE>...\n# Serverless\naws redshift-serverless update-namespace --region \u003CREGION> --namespace-name \u003CNAMESPACE_NAME> --log-destination-type s3table --s3-table-names \u003CSYS_TABLE>... --s3-table-action Disable\n```\n\n### 3. Verify Permissions\n\nFull setup commands for both paths: **`${SKILL_DIR}\u002Freferences\u002Fpermissions-setup.md`**. Load it before creating roles or registering resources.\n\n**Athena path** — needs the `s3tablescatalog\u002Faws-redshift` catalog registered in Glue, a workgroup with an output location, and S3 Tables read permissions. Confirm the catalog is queryable:\n\n```bash\naws glue get-databases --region \u003CREGION> \\\n  --catalog-id \"\u003CACCOUNT>:s3tablescatalog\u002Faws-redshift\"\n```\n\nNamespaces returned → registered and queryable. `EntityNotFoundException` \u002F `CATALOG_NOT_FOUND` → the S3 Tables integration is not enabled (S3 console > Table buckets > Enable integration). **Encrypt the workgroup output location** — Athena writes full result sets, including `query_text` and `user_name`, to S3.\n\n**Redshift auto-mount path** — needs a Provisioned RA3 cluster and a four-step setup: create the `query_s3_tables` role (trust policy must name *both* `redshift.amazonaws.com` and `lakeformation.amazonaws.com`, the latter with all four of `sts:AssumeRole`, `sts:SetContext`, `sts:SetSourceIdentity`, `sts:TagSession`), attach it to the cluster, register the table bucket with Lake Formation, and add the Redshift service-linked roles to `ReadOnlyAdmins`. Constraints that cause most failures:\n\n- **Condition both trust statements on `aws:SourceAccount`** — a bare service principal is a confused-deputy risk.\n- **Do not attach `AWSLakeFormationDataAdmin` to the cluster's query role.** It is needed only by the principal performing setup, and only during setup. The cluster's role needs read access alone.\n- **Auto-mount is a poll, not a callback** — the catalog can take up to 300 seconds to appear in `pg_database`. A cluster reboot forces immediate discovery.\n\n### 4. Identify the Target Table\n\n**Namespace** — resolve it from the API, do not construct it:\n\n- Read `S3Tables.S3TableNamespace` from `describe-logging-status` (Provisioned) or `s3TablePublishStatus.s3TableNamespace` from `get-namespace` (Serverless) and use it verbatim.\n- Optional sanity check only: the API value typically follows `\u003Cnamespace_arn_id>_sys` for `cluster`\u002F`namespace` granularity and `\u003Caccount>_sys` for `account` granularity. Use this only to *verify* the value looks right — never to generate the namespace when the API response is unavailable.\n\n**Table** — each publishable system table maps 1:1 to a table in the `aws-redshift` table bucket. Do **not** work from a memorized list — resolve it at runtime, in this order:\n\n1. **The published set for this cluster\u002Fnamespace** — `S3Tables.S3Tables` (Provisioned) or `s3TablePublishStatus.s3Tables` (Serverless) from the status call above, e.g. `sys_query_history`. This is the only authoritative answer to \"what can I query right now\".\n2. **The set this API accepts** — `aws redshift enable-logging help` (accepted `--log-exports` values) or `aws redshift-serverless update-namespace help` (accepted `--s3-table-names` values).\n3. **What each table contains** — the public [Redshift SYS monitoring views reference](https:\u002F\u002Fdocs.aws.amazon.com\u002Fredshift\u002Flatest\u002Fdg\u002Fcm_chap_system-tables.html), which documents every `SYS_*` view and its columns. AWS adds views over time, so treat the docs as the current list rather than hardcoding one.\n\nColumn names and types come from the same public reference, or from the live table:\n\n```bash\naws glue get-table --region \u003CREGION> \\\n  --catalog-id \"\u003CACCOUNT>:s3tablescatalog\u002Faws-redshift\" \\\n  --database-name \"\u003CNAMESPACE>\" --name \"\u003CSYS_TABLE>\"\n```\n\nTwo caveats when reading the public docs against a published table: enum-valued columns (`query_type`, `status`, `event`) gain values over time, so confirm with `SELECT DISTINCT` rather than filtering on an assumed set; and the published Iceberg table prepends warehouse-identity columns (`warehouse_name`, `warehouse_namespace_arn`, and peers) that the in-cluster `SYS_` view does not have — they are how you tell apart multiple clusters publishing at `account` granularity.\n\n### 5. Query\n\n#### Query from Athena\n\n**Query syntax:**\n\n```sql\n\"s3tablescatalog\u002Faws-redshift\".\"\u003CNAMESPACE>\".\"\u003CSYS_TABLE>\"\n```\n\n#### Query from Redshift (Auto-Mounted Catalog)\n\nOnce the auto-mounted catalog is set up (see `${SKILL_DIR}\u002Freferences\u002Fpermissions-setup.md`), query using cross-database notation:\n\n```sql\n\"aws-redshift@s3tablescatalog\".\"\u003CNAMESPACE>\".\u003CSYS_TABLE>\n```\n\n#### Query from Redshift (External Schema)\n\nAlternatively, create an external schema pointing to the S3 Tables catalog:\n\n```sql\nCREATE EXTERNAL SCHEMA \u003Cschema_name>\nFROM DATA CATALOG\nDATABASE '\u003CNAMESPACE>'\nCATALOG_ID '\u003CACCOUNT>:s3tablescatalog\u002Faws-redshift'\nIAM_ROLE 'arn:aws:iam::\u003CACCOUNT>:role\u002Fquery_s3_tables'\nREGION '\u003CREGION>';\n\nSELECT * FROM \u003Cschema_name>.\u003CSYS_TABLE> LIMIT 10;\n```\n\n#### Constraints\n\n- You MUST run `describe-logging-status` or `get-namespace` to get the namespace before writing any SQL query — never construct it manually\n- For Athena queries, you MUST confirm workgroup and output location before executing\n- **Timing columns are in microseconds.** Divide by `1000000.0` for seconds\n- Tables are **read-only** — no `INSERT`\u002F`UPDATE`\u002F`DELETE`\n- Always add a `LIMIT` when the user doesn't specify one; filter on `start_time`\u002F`record_time` where possible\n\n#### Examples\n\nWorked SQL for the common asks — longest-running queries, error analysis, connection auditing, queue-time trends, cross-table joins — is in **`${SKILL_DIR}\u002Freferences\u002Fexample-queries.md`**. Two rules that apply to every one of them:\n\n- **Timing columns are microseconds.** Divide by 1,000,000 for seconds. Reporting `elapsed_time` as-is overstates durations by 10^6.\n- **Filter on the Iceberg partition columns** (`year`\u002F`month`\u002F`day` or the table's own partitioning) in addition to any timestamp predicate, or the engine scans the full history.\n\n### Routing: Athena vs Redshift vs Direct SYS_ Access\n\n| Scenario | Use |\n|----------|-----|\n| Historical\u002Fhigh-volume log analysis, no cluster load | Athena or Redshift on S3 Tables |\n| Already connected to a Redshift cluster, want to query S3 Tables logs | Redshift cross-database or external schema |\n| Join system table logs with other lake data | Athena or Redshift Spectrum |\n| Real-time current state of the cluster | Direct `SYS_` view on the cluster |\n| Quick ad-hoc query without Redshift cluster access | Athena |\n\n## Key Behaviors\n\n- **No backfill** — only events recorded after enabling are delivered to S3 Tables\n- **Namespace from the API** — always read the namespace from `describe-logging-status` (`S3Tables.S3TableNamespace`) or `get-namespace` (`s3TablePublishStatus.s3TableNamespace`); never construct it manually\n- **Microsecond timing** — all duration columns are in microseconds; divide by 1000000.0 for seconds\n- **Read-only** — published tables cannot be written to\n- **Both Provisioned and Serverless** — same table bucket (`aws-redshift`), different enable APIs\n- **Any Iceberg-compatible engine** — query from Athena, Redshift, or any engine that reads Iceberg\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n|-------|-------|-----|\n| `aws-redshift` bucket not found | S3 Tables integration not enabled or logging not started | Run `enable-logging` (Provisioned) or `update-namespace` (Serverless) with `--log-destination-type s3table` |\n| `CATALOG_NOT_FOUND` in Athena | S3 Tables not registered in Glue | Enable integration: S3 console > Table buckets > Enable integration |\n| Athena table empty after enabling | Ingestion still in flight | Check `LastIngestionTimes` (Provisioned) \u002F `lastIngestionTimes` (Serverless); wait and re-query |\n| `SYS_*` table missing from the namespace | System table not included when enabling | Re-run enable with that table included, or use `all` — `--log-exports` (Provisioned), `--s3-table-names` (Serverless) |\n| Wrong \u002F empty namespace | Namespace constructed instead of read from API | Use the namespace from the describe\u002Fget response — `S3Tables.S3TableNamespace` (Provisioned) or `s3TablePublishStatus.s3TableNamespace` (Serverless) |\n| Status response has no `S3Tables` \u002F `s3TablePublishStatus` field at all, even though publishing is on | Outdated AWS CLI \u002F SDK. The field is **silently omitted** rather than raising an error, so this looks identical to the feature being disabled | Upgrade the CLI\u002FSDK, then re-run. Confirm publishing is actually off before acting on the absence — check the `aws-redshift` table bucket for the namespace, or that `LogDestinationType` includes `s3table` |\n| `Unknown options: --log-exports, --log-export-action` on Serverless | Provisioned flag names used against `update-namespace` | Use `--s3-table-names` and `--s3-table-action` — see the flag table in the Enable section |\n| `AccessDenied` querying the table | Missing `s3tables:GetTable` or `GetTableData` | See `references\u002Fsecurity.md` |\n| Empty results from `sys_connection_log` | Querying identity lacks visibility | Use an identity with superuser-level access |\n| Catalog doesn't appear in `pg_database` | LF resource not registered, or SLRs not ReadOnlyAdmins | Complete the Lake Formation steps in `references\u002Fpermissions-setup.md`, wait 5 min or reboot |\n| \"Unable to assume role\" from Glue | Missing `sts:SetContext`\u002F`sts:SetSourceIdentity` in trust policy, or missing `AWSLakeFormationDataAdmin` | Fix trust policy and attach `AWSLakeFormationDataAdmin` |\n| `VerificationStatus: NOT_VERIFIED` | Normal after Lake Formation registration | No action needed if queries work |\n| Query fails with \"does not exist\" in Redshift | Catalog not yet auto-mounted (poll delay) | Wait up to 300s or reboot cluster |\n\n## Security Considerations\n\nFull policies, key policy, and detection setup: **`${SKILL_DIR}\u002Freferences\u002Fsecurity.md`**. Read it before granting access. The non-negotiables:\n\n- **Scope IAM to the S3 Tables catalog**, not wildcards. Glue database\u002Ftable ARNs nest under `s3tablescatalog\u002Faws-redshift` — the bare `database\u002F*` form grants metadata read on the whole account. `lakeformation:GetDataAccess` is the one action that must use `\"Resource\": \"*\"`; constrain it with an `aws:ResourceAccount` `StringEquals` condition.\n- **The KMS key policy needs two principals**, not one: `systemtables.redshift.amazonaws.com` (publisher) and `maintenance.s3tables.amazonaws.com` (compaction). Granting only the publisher lets writes succeed while compaction silently fails.\n- **`query_text` can contain credentials**, not just schema — interpolated SQL and `CREATE USER ... PASSWORD` land verbatim in `sys_query_history`. Treat broad access to that table as a secrets-exposure decision; restrict the column with Lake Formation.\n- **Publishing is itself auditable and worth alarming on.** `s3tables.amazonaws.com` `AccessDenied` spikes and `sys_connection_log` failed-auth counts are the two signals to alert on; encrypt the alarm topic with a customer-managed key.\n\n## Reference Files\n\n`${SKILL_DIR}` is the absolute path of the directory containing this SKILL.md. Load these on demand; do not read them all up front.\n\n| File | What it covers | When to load |\n|---|---|---|\n| `${SKILL_DIR}\u002Freferences\u002Fpermissions-setup.md` | Athena prerequisites and workgroup encryption; the full Redshift auto-mount path — IAM role trust\u002Finline policies, Lake Formation `register-resource`, `put-data-lake-settings`, the SLR `ReadOnlyAdmins` step, and the 300s auto-mount poll | Before running any IAM or Lake Formation setup |\n| `${SKILL_DIR}\u002Freferences\u002Fexample-queries.md` | Worked SQL for longest-running queries, error analysis, connection auditing, queue-time trends, and joins across `sys_*` tables | When writing queries against the published tables |\n| `${SKILL_DIR}\u002Freferences\u002Fsecurity.md` | Full least-privilege policy, KMS key policy with both service principals, `query_text` sensitivity, CloudTrail\u002Fmetric-filter detection | Before granting access, or when hardening an existing setup |\n\n## Additional Resources\n\n- [Integrating S3 Tables with AWS analytics services](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002Fs3-tables-integrating-aws.html)\n- [Redshift System Tables](https:\u002F\u002Fdocs.aws.amazon.com\u002Fredshift\u002Flatest\u002Fdg\u002Fserverless_views-monitoring.html)\n- [Lake Formation permissions](https:\u002F\u002Fdocs.aws.amazon.com\u002Flake-formation\u002Flatest\u002Fdg\u002Fgranting-catalog-permissions.html)\n\nSecurity best practices:\n\n- [Amazon Redshift security best practices](https:\u002F\u002Fdocs.aws.amazon.com\u002Fredshift\u002Flatest\u002Fmgmt\u002Fsecurity-best-practices.html)\n- [S3 Tables security](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002Fs3-tables-security.html) and [access management for S3 Tables](https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002Fs3-tables-permissions.html)\n- [IAM security best practices](https:\u002F\u002Fdocs.aws.amazon.com\u002FIAM\u002Flatest\u002FUserGuide\u002Fbest-practices.html)\n- [Lake Formation underlying data access control](https:\u002F\u002Fdocs.aws.amazon.com\u002Flake-formation\u002Flatest\u002Fdg\u002Faccess-control-underlying-data.html) — why `lakeformation:GetDataAccess` requires `\"Resource\": \"*\"`\n",{"data":39,"body":42},{"name":4,"description":6,"version":40,"argument-hint":41},1,"['enable CLUSTER'|'status CLUSTER'|'query SQL'|'configure']",{"type":43,"children":44},"root",[45,54,61,84,136,190,202,236,242,480,486,626,646,688,693,700,705,868,908,1197,1202,1302,1308,1614,1653,1658,1668,1871,1875,2076,2084,2290,2296,2312,2330,2402,2442,2518,2573,2579,2589,2672,2695,2794,2799,2909,2973,2979,2986,2994,3009,3015,3027,3041,3047,3052,3128,3134,3239,3245,3261,3313,3319,3413,3419,3515,3521,3994,3999,4014,4157,4163,4174,4300,4306,4339,4344,4409],{"type":46,"tag":47,"props":48,"children":50},"element","h1",{"id":49},"query-aws-redshift-system-tables",[51],{"type":52,"value":53},"text","Query AWS Redshift System Tables",{"type":46,"tag":55,"props":56,"children":58},"h2",{"id":57},"overview",[59],{"type":52,"value":60},"Overview",{"type":46,"tag":62,"props":63,"children":64},"p",{},[65,71,73,82],{"type":46,"tag":66,"props":67,"children":68},"strong",{},[69],{"type":52,"value":70},"Works best with",{"type":52,"value":72}," the ",{"type":46,"tag":74,"props":75,"children":79},"a",{"href":76,"rel":77},"https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002F",[78],"nofollow",[80],{"type":52,"value":81},"AWS MCP server",{"type":52,"value":83}," for sandboxed execution and audit logging. All commands below use the AWS CLI and work in any environment with configured AWS credentials. Use IAM roles or temporary credentials; avoid long-lived access keys.",{"type":46,"tag":62,"props":85,"children":86},{},[87,89,94,96,103,105,111,113,119,121,127,129,134],{"type":52,"value":88},"Redshift can publish ",{"type":46,"tag":66,"props":90,"children":91},{},[92],{"type":52,"value":93},"system tables",{"type":52,"value":95}," — the ",{"type":46,"tag":97,"props":98,"children":100},"code",{"className":99},[],[101],{"type":52,"value":102},"SYS_*",{"type":52,"value":104}," monitoring data such as ",{"type":46,"tag":97,"props":106,"children":108},{"className":107},[],[109],{"type":52,"value":110},"sys_query_history",{"type":52,"value":112},", ",{"type":46,"tag":97,"props":114,"children":116},{"className":115},[],[117],{"type":52,"value":118},"sys_query_detail",{"type":52,"value":120},", and ",{"type":46,"tag":97,"props":122,"children":124},{"className":123},[],[125],{"type":52,"value":126},"sys_connection_log",{"type":52,"value":128}," — to ",{"type":46,"tag":66,"props":130,"children":131},{},[132],{"type":52,"value":133},"S3 Tables",{"type":52,"value":135}," as continuously-updated Apache Iceberg tables.",{"type":46,"tag":62,"props":137,"children":138},{},[139,141,146,148,153,155,166,168,173,175,180,182,188],{"type":52,"value":140},"Terminology used throughout: ",{"type":46,"tag":66,"props":142,"children":143},{},[144],{"type":52,"value":145},"system table",{"type":52,"value":147}," refers to a ",{"type":46,"tag":97,"props":149,"children":151},{"className":150},[],[152],{"type":52,"value":102},{"type":52,"value":154}," dataset generally, and each one maps 1:1 to a published Iceberg table. Where this skill says ",{"type":46,"tag":66,"props":156,"children":157},{},[158,164],{"type":46,"tag":97,"props":159,"children":161},{"className":160},[],[162],{"type":52,"value":163},"SYS_",{"type":52,"value":165}," view",{"type":52,"value":167},", it means specifically the live in-cluster object you query on the cluster itself — that is a view, and it is a different thing from the published S3 Tables copy. This applies to both ",{"type":46,"tag":66,"props":169,"children":170},{},[171],{"type":52,"value":172},"Provisioned clusters",{"type":52,"value":174}," and ",{"type":46,"tag":66,"props":176,"children":177},{},[178],{"type":52,"value":179},"Serverless namespaces",{"type":52,"value":181},". It is an opt-in extension of the existing logging APIs. Published tables are read-only, stored in the AWS-managed ",{"type":46,"tag":97,"props":183,"children":185},{"className":184},[],[186],{"type":52,"value":187},"aws-redshift",{"type":52,"value":189}," table bucket, and queryable via any Iceberg-compatible engine including Amazon Athena and Amazon Redshift itself.",{"type":46,"tag":62,"props":191,"children":192},{},[193,195,200],{"type":52,"value":194},"Querying the S3 Tables copy is preferred over the live in-cluster ",{"type":46,"tag":97,"props":196,"children":198},{"className":197},[],[199],{"type":52,"value":163},{"type":52,"value":201}," views when analyzing historical or high-volume system-table data because:",{"type":46,"tag":203,"props":204,"children":205},"ul",{},[206,219,231],{"type":46,"tag":207,"props":208,"children":209},"li",{},[210,212,217],{"type":52,"value":211},"The in-cluster ",{"type":46,"tag":97,"props":213,"children":215},{"className":214},[],[216],{"type":52,"value":163},{"type":52,"value":218}," views have a limited retention window; S3 Tables retains history well beyond it.",{"type":46,"tag":207,"props":220,"children":221},{},[222,224,229],{"type":52,"value":223},"Querying S3 Tables adds ",{"type":46,"tag":66,"props":225,"children":226},{},[227],{"type":52,"value":228},"no load",{"type":52,"value":230}," to the running Redshift cluster.",{"type":46,"tag":207,"props":232,"children":233},{},[234],{"type":52,"value":235},"The logs are Iceberg tables, so they can be queried at scale from any Iceberg-compatible engine and joined with other lake data.",{"type":46,"tag":55,"props":237,"children":239},{"id":238},"decision-tree",[240],{"type":52,"value":241},"Decision Tree",{"type":46,"tag":243,"props":244,"children":245},"table",{},[246,270],{"type":46,"tag":247,"props":248,"children":249},"thead",{},[250],{"type":46,"tag":251,"props":252,"children":253},"tr",{},[254,260,265],{"type":46,"tag":255,"props":256,"children":257},"th",{},[258],{"type":52,"value":259},"User intent",{"type":46,"tag":255,"props":261,"children":262},{},[263],{"type":52,"value":264},"Use this skill?",{"type":46,"tag":255,"props":266,"children":267},{},[268],{"type":52,"value":269},"Alternative",{"type":46,"tag":271,"props":272,"children":273},"tbody",{},[274,296,315,334,353,372,391,410,453],{"type":46,"tag":251,"props":275,"children":276},{},[277,283,291],{"type":46,"tag":278,"props":279,"children":280},"td",{},[281],{"type":52,"value":282},"Turn on S3 Tables log publishing for a cluster or namespace",{"type":46,"tag":278,"props":284,"children":285},{},[286],{"type":46,"tag":66,"props":287,"children":288},{},[289],{"type":52,"value":290},"Yes",{"type":46,"tag":278,"props":292,"children":293},{},[294],{"type":52,"value":295},"—",{"type":46,"tag":251,"props":297,"children":298},{},[299,304,311],{"type":46,"tag":278,"props":300,"children":301},{},[302],{"type":52,"value":303},"Confirm a cluster\u002Fnamespace is publishing \u002F find its S3 Tables namespace",{"type":46,"tag":278,"props":305,"children":306},{},[307],{"type":46,"tag":66,"props":308,"children":309},{},[310],{"type":52,"value":290},{"type":46,"tag":278,"props":312,"children":313},{},[314],{"type":52,"value":295},{"type":46,"tag":251,"props":316,"children":317},{},[318,323,330],{"type":46,"tag":278,"props":319,"children":320},{},[321],{"type":52,"value":322},"Querying non-realtime data from Redshift system tables",{"type":46,"tag":278,"props":324,"children":325},{},[326],{"type":46,"tag":66,"props":327,"children":328},{},[329],{"type":52,"value":290},{"type":46,"tag":278,"props":331,"children":332},{},[333],{"type":52,"value":295},{"type":46,"tag":251,"props":335,"children":336},{},[337,342,349],{"type":46,"tag":278,"props":338,"children":339},{},[340],{"type":52,"value":341},"Build daily\u002Fweekly\u002Fmonthly dashboard for Redshift monitoring and auditing",{"type":46,"tag":278,"props":343,"children":344},{},[345],{"type":46,"tag":66,"props":346,"children":347},{},[348],{"type":52,"value":290},{"type":46,"tag":278,"props":350,"children":351},{},[352],{"type":52,"value":295},{"type":46,"tag":251,"props":354,"children":355},{},[356,361,368],{"type":46,"tag":278,"props":357,"children":358},{},[359],{"type":52,"value":360},"Selectively stop S3 Tables publishing",{"type":46,"tag":278,"props":362,"children":363},{},[364],{"type":46,"tag":66,"props":365,"children":366},{},[367],{"type":52,"value":290},{"type":46,"tag":278,"props":369,"children":370},{},[371],{"type":52,"value":295},{"type":46,"tag":251,"props":373,"children":374},{},[375,380,387],{"type":46,"tag":278,"props":376,"children":377},{},[378],{"type":52,"value":379},"Query published system tables from Redshift (cross-database)",{"type":46,"tag":278,"props":381,"children":382},{},[383],{"type":46,"tag":66,"props":384,"children":385},{},[386],{"type":52,"value":290},{"type":46,"tag":278,"props":388,"children":389},{},[390],{"type":52,"value":295},{"type":46,"tag":251,"props":392,"children":393},{},[394,399,406],{"type":46,"tag":278,"props":395,"children":396},{},[397],{"type":52,"value":398},"Query published system tables from Athena",{"type":46,"tag":278,"props":400,"children":401},{},[402],{"type":46,"tag":66,"props":403,"children":404},{},[405],{"type":52,"value":290},{"type":46,"tag":278,"props":407,"children":408},{},[409],{"type":52,"value":295},{"type":46,"tag":251,"props":411,"children":412},{},[413,433,441],{"type":46,"tag":278,"props":414,"children":415},{},[416,418,424,426,431],{"type":52,"value":417},"Inspect the ",{"type":46,"tag":419,"props":420,"children":421},"em",{},[422],{"type":52,"value":423},"current, real-time",{"type":52,"value":425}," ",{"type":46,"tag":97,"props":427,"children":429},{"className":428},[],[430],{"type":52,"value":163},{"type":52,"value":432}," state on a live cluster",{"type":46,"tag":278,"props":434,"children":435},{},[436],{"type":46,"tag":66,"props":437,"children":438},{},[439],{"type":52,"value":440},"No",{"type":46,"tag":278,"props":442,"children":443},{},[444,446,451],{"type":52,"value":445},"Query the ",{"type":46,"tag":97,"props":447,"children":449},{"className":448},[],[450],{"type":52,"value":163},{"type":52,"value":452}," view on the cluster directly",{"type":46,"tag":251,"props":454,"children":455},{},[456,468,475],{"type":46,"tag":278,"props":457,"children":458},{},[459,461,466],{"type":52,"value":460},"Query data ",{"type":46,"tag":419,"props":462,"children":463},{},[464],{"type":52,"value":465},"inside",{"type":52,"value":467}," customer tables",{"type":46,"tag":278,"props":469,"children":470},{},[471],{"type":46,"tag":66,"props":472,"children":473},{},[474],{"type":52,"value":440},{"type":46,"tag":278,"props":476,"children":477},{},[478],{"type":52,"value":479},"Direct Redshift SQL on the cluster",{"type":46,"tag":55,"props":481,"children":483},{"id":482},"supported-data-sources",[484],{"type":52,"value":485},"Supported Data Sources",{"type":46,"tag":243,"props":487,"children":488},{},[489,515],{"type":46,"tag":247,"props":490,"children":491},{},[492],{"type":46,"tag":251,"props":493,"children":494},{},[495,500,505,510],{"type":46,"tag":255,"props":496,"children":497},{},[498],{"type":52,"value":499},"Compute type",{"type":46,"tag":255,"props":501,"children":502},{},[503],{"type":52,"value":504},"Enable \u002F disable API",{"type":46,"tag":255,"props":506,"children":507},{},[508],{"type":52,"value":509},"Status API",{"type":46,"tag":255,"props":511,"children":512},{},[513],{"type":52,"value":514},"Granularity options",{"type":46,"tag":271,"props":516,"children":517},{},[518,569],{"type":46,"tag":251,"props":519,"children":520},{},[521,526,543,552],{"type":46,"tag":278,"props":522,"children":523},{},[524],{"type":52,"value":525},"Redshift Provisioned cluster",{"type":46,"tag":278,"props":527,"children":528},{},[529,535,537],{"type":46,"tag":97,"props":530,"children":532},{"className":531},[],[533],{"type":52,"value":534},"redshift enable-logging",{"type":52,"value":536}," \u002F ",{"type":46,"tag":97,"props":538,"children":540},{"className":539},[],[541],{"type":52,"value":542},"redshift disable-logging",{"type":46,"tag":278,"props":544,"children":545},{},[546],{"type":46,"tag":97,"props":547,"children":549},{"className":548},[],[550],{"type":52,"value":551},"redshift describe-logging-status",{"type":46,"tag":278,"props":553,"children":554},{},[555,561,563],{"type":46,"tag":97,"props":556,"children":558},{"className":557},[],[559],{"type":52,"value":560},"cluster",{"type":52,"value":562}," (default), ",{"type":46,"tag":97,"props":564,"children":566},{"className":565},[],[567],{"type":52,"value":568},"account",{"type":46,"tag":251,"props":570,"children":571},{},[572,577,602,611],{"type":46,"tag":278,"props":573,"children":574},{},[575],{"type":52,"value":576},"Redshift Serverless namespace",{"type":46,"tag":278,"props":578,"children":579},{},[580,586,588,594,596],{"type":46,"tag":97,"props":581,"children":583},{"className":582},[],[584],{"type":52,"value":585},"redshift-serverless update-namespace",{"type":52,"value":587}," with ",{"type":46,"tag":97,"props":589,"children":591},{"className":590},[],[592],{"type":52,"value":593},"--s3-table-action Enable",{"type":52,"value":595},"\u002F",{"type":46,"tag":97,"props":597,"children":599},{"className":598},[],[600],{"type":52,"value":601},"Disable",{"type":46,"tag":278,"props":603,"children":604},{},[605],{"type":46,"tag":97,"props":606,"children":608},{"className":607},[],[609],{"type":52,"value":610},"redshift-serverless get-namespace",{"type":46,"tag":278,"props":612,"children":613},{},[614,620,621],{"type":46,"tag":97,"props":615,"children":617},{"className":616},[],[618],{"type":52,"value":619},"namespace",{"type":52,"value":562},{"type":46,"tag":97,"props":622,"children":624},{"className":623},[],[625],{"type":52,"value":568},{"type":46,"tag":62,"props":627,"children":628},{},[629,631,636,638,644],{"type":52,"value":630},"Both compute types publish into the same AWS-managed ",{"type":46,"tag":97,"props":632,"children":634},{"className":633},[],[635],{"type":52,"value":187},{"type":52,"value":637}," table bucket and are queried identically once published. They differ only in the enable\u002Fdisable API surface and in the casing of the status response — see the flag and field tables in ",{"type":46,"tag":74,"props":639,"children":641},{"href":640},"#common-tasks",[642],{"type":52,"value":643},"Common Tasks",{"type":52,"value":645},".",{"type":46,"tag":62,"props":647,"children":648},{},[649,651,657,658,664,665,671,673,679,681,686],{"type":52,"value":650},"Not covered by this skill: Redshift audit logs delivered to S3 or CloudWatch (",{"type":46,"tag":97,"props":652,"children":654},{"className":653},[],[655],{"type":52,"value":656},"useractivitylog",{"type":52,"value":112},{"type":46,"tag":97,"props":659,"children":661},{"className":660},[],[662],{"type":52,"value":663},"userlog",{"type":52,"value":112},{"type":46,"tag":97,"props":666,"children":668},{"className":667},[],[669],{"type":52,"value":670},"connectionlog",{"type":52,"value":672},"), which use the separate ",{"type":46,"tag":97,"props":674,"children":676},{"className":675},[],[677],{"type":52,"value":678},"--log-exports",{"type":52,"value":680}," mechanism on Serverless and are not ",{"type":46,"tag":97,"props":682,"children":684},{"className":683},[],[685],{"type":52,"value":102},{"type":52,"value":687}," system tables.",{"type":46,"tag":55,"props":689,"children":691},{"id":690},"common-tasks",[692],{"type":52,"value":643},{"type":46,"tag":694,"props":695,"children":697},"h3",{"id":696},"_1-check-if-configured",[698],{"type":52,"value":699},"1. Check If Configured",{"type":46,"tag":62,"props":701,"children":702},{},[703],{"type":52,"value":704},"Before querying, confirm the cluster or namespace is publishing to S3 Tables.",{"type":46,"tag":706,"props":707,"children":712},"pre",{"className":708,"code":709,"language":710,"meta":711,"style":711},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Provisioned\naws redshift describe-logging-status --region \u003CREGION> --cluster-identifier \u003CCLUSTER_ID>\n# Serverless\naws redshift-serverless get-namespace --region \u003CREGION> --namespace-name \u003CNAMESPACE_NAME>\n","bash","",[713],{"type":46,"tag":97,"props":714,"children":715},{"__ignoreMap":711},[716,727,798,807],{"type":46,"tag":717,"props":718,"children":720},"span",{"class":719,"line":40},"line",[721],{"type":46,"tag":717,"props":722,"children":724},{"style":723},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[725],{"type":52,"value":726},"# Provisioned\n",{"type":46,"tag":717,"props":728,"children":730},{"class":719,"line":729},2,[731,736,742,747,752,758,763,769,774,779,783,788,793],{"type":46,"tag":717,"props":732,"children":734},{"style":733},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[735],{"type":52,"value":8},{"type":46,"tag":717,"props":737,"children":739},{"style":738},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[740],{"type":52,"value":741}," redshift",{"type":46,"tag":717,"props":743,"children":744},{"style":738},[745],{"type":52,"value":746}," describe-logging-status",{"type":46,"tag":717,"props":748,"children":749},{"style":738},[750],{"type":52,"value":751}," --region",{"type":46,"tag":717,"props":753,"children":755},{"style":754},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[756],{"type":52,"value":757}," \u003C",{"type":46,"tag":717,"props":759,"children":760},{"style":738},[761],{"type":52,"value":762},"REGIO",{"type":46,"tag":717,"props":764,"children":766},{"style":765},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[767],{"type":52,"value":768},"N",{"type":46,"tag":717,"props":770,"children":771},{"style":754},[772],{"type":52,"value":773},">",{"type":46,"tag":717,"props":775,"children":776},{"style":738},[777],{"type":52,"value":778}," --cluster-identifier",{"type":46,"tag":717,"props":780,"children":781},{"style":754},[782],{"type":52,"value":757},{"type":46,"tag":717,"props":784,"children":785},{"style":738},[786],{"type":52,"value":787},"CLUSTER_I",{"type":46,"tag":717,"props":789,"children":790},{"style":765},[791],{"type":52,"value":792},"D",{"type":46,"tag":717,"props":794,"children":795},{"style":754},[796],{"type":52,"value":797},">\n",{"type":46,"tag":717,"props":799,"children":801},{"class":719,"line":800},3,[802],{"type":46,"tag":717,"props":803,"children":804},{"style":723},[805],{"type":52,"value":806},"# Serverless\n",{"type":46,"tag":717,"props":808,"children":810},{"class":719,"line":809},4,[811,815,820,825,829,833,837,841,845,850,854,859,864],{"type":46,"tag":717,"props":812,"children":813},{"style":733},[814],{"type":52,"value":8},{"type":46,"tag":717,"props":816,"children":817},{"style":738},[818],{"type":52,"value":819}," redshift-serverless",{"type":46,"tag":717,"props":821,"children":822},{"style":738},[823],{"type":52,"value":824}," get-namespace",{"type":46,"tag":717,"props":826,"children":827},{"style":738},[828],{"type":52,"value":751},{"type":46,"tag":717,"props":830,"children":831},{"style":754},[832],{"type":52,"value":757},{"type":46,"tag":717,"props":834,"children":835},{"style":738},[836],{"type":52,"value":762},{"type":46,"tag":717,"props":838,"children":839},{"style":765},[840],{"type":52,"value":768},{"type":46,"tag":717,"props":842,"children":843},{"style":754},[844],{"type":52,"value":773},{"type":46,"tag":717,"props":846,"children":847},{"style":738},[848],{"type":52,"value":849}," --namespace-name",{"type":46,"tag":717,"props":851,"children":852},{"style":754},[853],{"type":52,"value":757},{"type":46,"tag":717,"props":855,"children":856},{"style":738},[857],{"type":52,"value":858},"NAMESPACE_NAM",{"type":46,"tag":717,"props":860,"children":861},{"style":765},[862],{"type":52,"value":863},"E",{"type":46,"tag":717,"props":865,"children":866},{"style":754},[867],{"type":52,"value":797},{"type":46,"tag":62,"props":869,"children":870},{},[871,876,878,883,885,890,892,898,900,906],{"type":46,"tag":66,"props":872,"children":873},{},[874],{"type":52,"value":875},"Interpret the response.",{"type":52,"value":877}," The two compute types return the ",{"type":46,"tag":419,"props":879,"children":880},{},[881],{"type":52,"value":882},"same",{"type":52,"value":884}," information under ",{"type":46,"tag":66,"props":886,"children":887},{},[888],{"type":52,"value":889},"different field names and casing",{"type":52,"value":891}," — Provisioned uses PascalCase under ",{"type":46,"tag":97,"props":893,"children":895},{"className":894},[],[896],{"type":52,"value":897},"S3Tables",{"type":52,"value":899},", Serverless uses camelCase under ",{"type":46,"tag":97,"props":901,"children":903},{"className":902},[],[904],{"type":52,"value":905},"namespace.s3TablePublishStatus",{"type":52,"value":907},":",{"type":46,"tag":243,"props":909,"children":910},{},[911,947],{"type":46,"tag":247,"props":912,"children":913},{},[914],{"type":46,"tag":251,"props":915,"children":916},{},[917,922,935],{"type":46,"tag":255,"props":918,"children":919},{},[920],{"type":52,"value":921},"Meaning",{"type":46,"tag":255,"props":923,"children":924},{},[925,927,933],{"type":52,"value":926},"Provisioned (",{"type":46,"tag":97,"props":928,"children":930},{"className":929},[],[931],{"type":52,"value":932},"describe-logging-status",{"type":52,"value":934},")",{"type":46,"tag":255,"props":936,"children":937},{},[938,940,946],{"type":52,"value":939},"Serverless (",{"type":46,"tag":97,"props":941,"children":943},{"className":942},[],[944],{"type":52,"value":945},"get-namespace",{"type":52,"value":934},{"type":46,"tag":271,"props":948,"children":949},{},[950,988,1028,1061,1092,1145,1171],{"type":46,"tag":251,"props":951,"children":952},{},[953,958,976],{"type":46,"tag":278,"props":954,"children":955},{},[956],{"type":52,"value":957},"Not enabled",{"type":46,"tag":278,"props":959,"children":960},{},[961,967,969,974],{"type":46,"tag":97,"props":962,"children":964},{"className":963},[],[965],{"type":52,"value":966},"LoggingEnabled: false",{"type":52,"value":968}," or no ",{"type":46,"tag":97,"props":970,"children":972},{"className":971},[],[973],{"type":52,"value":897},{"type":52,"value":975}," block",{"type":46,"tag":278,"props":977,"children":978},{},[979,981,987],{"type":52,"value":980},"no ",{"type":46,"tag":97,"props":982,"children":984},{"className":983},[],[985],{"type":52,"value":986},"s3TablePublishStatus",{"type":52,"value":975},{"type":46,"tag":251,"props":989,"children":990},{},[991,996,1013],{"type":46,"tag":278,"props":992,"children":993},{},[994],{"type":52,"value":995},"Destination includes S3 Tables",{"type":46,"tag":278,"props":997,"children":998},{},[999,1005,1007],{"type":46,"tag":97,"props":1000,"children":1002},{"className":1001},[],[1003],{"type":52,"value":1004},"LogDestinationType",{"type":52,"value":1006}," contains ",{"type":46,"tag":97,"props":1008,"children":1010},{"className":1009},[],[1011],{"type":52,"value":1012},"s3table",{"type":46,"tag":278,"props":1014,"children":1015},{},[1016,1022,1023],{"type":46,"tag":97,"props":1017,"children":1019},{"className":1018},[],[1020],{"type":52,"value":1021},"logDestinationType",{"type":52,"value":1006},{"type":46,"tag":97,"props":1024,"children":1026},{"className":1025},[],[1027],{"type":52,"value":1012},{"type":46,"tag":251,"props":1029,"children":1030},{},[1031,1043,1052],{"type":46,"tag":278,"props":1032,"children":1033},{},[1034,1036,1041],{"type":52,"value":1035},"List of published ",{"type":46,"tag":97,"props":1037,"children":1039},{"className":1038},[],[1040],{"type":52,"value":102},{"type":52,"value":1042}," tables",{"type":46,"tag":278,"props":1044,"children":1045},{},[1046],{"type":46,"tag":97,"props":1047,"children":1049},{"className":1048},[],[1050],{"type":52,"value":1051},"S3Tables.S3Tables",{"type":46,"tag":278,"props":1053,"children":1054},{},[1055],{"type":46,"tag":97,"props":1056,"children":1058},{"className":1057},[],[1059],{"type":52,"value":1060},"namespace.s3TablePublishStatus.s3Tables",{"type":46,"tag":251,"props":1062,"children":1063},{},[1064,1074,1083],{"type":46,"tag":278,"props":1065,"children":1066},{},[1067,1072],{"type":46,"tag":66,"props":1068,"children":1069},{},[1070],{"type":52,"value":1071},"The exact S3 Tables namespace",{"type":52,"value":1073}," (required for querying)",{"type":46,"tag":278,"props":1075,"children":1076},{},[1077],{"type":46,"tag":97,"props":1078,"children":1080},{"className":1079},[],[1081],{"type":52,"value":1082},"S3Tables.S3TableNamespace",{"type":46,"tag":278,"props":1084,"children":1085},{},[1086],{"type":46,"tag":97,"props":1087,"children":1089},{"className":1088},[],[1090],{"type":52,"value":1091},"namespace.s3TablePublishStatus.s3TableNamespace",{"type":46,"tag":251,"props":1093,"children":1094},{},[1095,1100,1123],{"type":46,"tag":278,"props":1096,"children":1097},{},[1098],{"type":52,"value":1099},"Granularity",{"type":46,"tag":278,"props":1101,"children":1102},{},[1103,1109,1111,1116,1117,1122],{"type":46,"tag":97,"props":1104,"children":1106},{"className":1105},[],[1107],{"type":52,"value":1108},"S3Tables.S3TableGranularity",{"type":52,"value":1110}," (",{"type":46,"tag":97,"props":1112,"children":1114},{"className":1113},[],[1115],{"type":52,"value":560},{"type":52,"value":595},{"type":46,"tag":97,"props":1118,"children":1120},{"className":1119},[],[1121],{"type":52,"value":568},{"type":52,"value":934},{"type":46,"tag":278,"props":1124,"children":1125},{},[1126,1132,1133,1138,1139,1144],{"type":46,"tag":97,"props":1127,"children":1129},{"className":1128},[],[1130],{"type":52,"value":1131},"namespace.s3TablePublishStatus.s3TableGranularity",{"type":52,"value":1110},{"type":46,"tag":97,"props":1134,"children":1136},{"className":1135},[],[1137],{"type":52,"value":619},{"type":52,"value":595},{"type":46,"tag":97,"props":1140,"children":1142},{"className":1141},[],[1143],{"type":52,"value":568},{"type":52,"value":934},{"type":46,"tag":251,"props":1146,"children":1147},{},[1148,1153,1162],{"type":46,"tag":278,"props":1149,"children":1150},{},[1151],{"type":52,"value":1152},"Per-table last ingest time",{"type":46,"tag":278,"props":1154,"children":1155},{},[1156],{"type":46,"tag":97,"props":1157,"children":1159},{"className":1158},[],[1160],{"type":52,"value":1161},"S3Tables.LastIngestionTimes",{"type":46,"tag":278,"props":1163,"children":1164},{},[1165],{"type":46,"tag":97,"props":1166,"children":1168},{"className":1167},[],[1169],{"type":52,"value":1170},"namespace.s3TablePublishStatus.lastIngestionTimes",{"type":46,"tag":251,"props":1172,"children":1173},{},[1174,1179,1188],{"type":46,"tag":278,"props":1175,"children":1176},{},[1177],{"type":52,"value":1178},"All available system tables published",{"type":46,"tag":278,"props":1180,"children":1181},{},[1182],{"type":46,"tag":97,"props":1183,"children":1185},{"className":1184},[],[1186],{"type":52,"value":1187},"S3Tables.EnabledAll",{"type":46,"tag":278,"props":1189,"children":1190},{},[1191],{"type":46,"tag":97,"props":1192,"children":1194},{"className":1193},[],[1195],{"type":52,"value":1196},"namespace.s3TablePublishStatus.enabledAll",{"type":46,"tag":62,"props":1198,"children":1199},{},[1200],{"type":52,"value":1201},"Notes:",{"type":46,"tag":203,"props":1203,"children":1204},{},[1205,1236,1256],{"type":46,"tag":207,"props":1206,"children":1207},{},[1208,1213,1215,1220,1222,1228,1230,1235],{"type":46,"tag":97,"props":1209,"children":1211},{"className":1210},[],[1212],{"type":52,"value":1004},{"type":52,"value":1214}," is a ",{"type":46,"tag":66,"props":1216,"children":1217},{},[1218],{"type":52,"value":1219},"comma-joined list",{"type":52,"value":1221}," when more than one destination is active — e.g. ",{"type":46,"tag":97,"props":1223,"children":1225},{"className":1224},[],[1226],{"type":52,"value":1227},"\"cloudwatch,s3table\"",{"type":52,"value":1229},". Test with a substring\u002Fcontains check, not equality against ",{"type":46,"tag":97,"props":1231,"children":1233},{"className":1232},[],[1234],{"type":52,"value":1012},{"type":52,"value":645},{"type":46,"tag":207,"props":1237,"children":1238},{},[1239,1241,1247,1248,1254],{"type":52,"value":1240},"An empty ",{"type":46,"tag":97,"props":1242,"children":1244},{"className":1243},[],[1245],{"type":52,"value":1246},"LastIngestionTimes",{"type":52,"value":536},{"type":46,"tag":97,"props":1249,"children":1251},{"className":1250},[],[1252],{"type":52,"value":1253},"lastIngestionTimes",{"type":52,"value":1255}," map, or a table listed as published but absent from the map, means data for that table may still be in flight. Compare successive values to confirm new data is landing.",{"type":46,"tag":207,"props":1257,"children":1258},{},[1259,1261,1266,1268,1274,1276,1281,1282,1287,1288,1293,1295,1300],{"type":52,"value":1260},"On Serverless, do ",{"type":46,"tag":66,"props":1262,"children":1263},{},[1264],{"type":52,"value":1265},"not",{"type":52,"value":1267}," read the top-level ",{"type":46,"tag":97,"props":1269,"children":1271},{"className":1270},[],[1272],{"type":52,"value":1273},"logExports",{"type":52,"value":1275}," field for this feature — that field carries the CloudWatch\u002FS3 audit logs (",{"type":46,"tag":97,"props":1277,"children":1279},{"className":1278},[],[1280],{"type":52,"value":656},{"type":52,"value":112},{"type":46,"tag":97,"props":1283,"children":1285},{"className":1284},[],[1286],{"type":52,"value":663},{"type":52,"value":112},{"type":46,"tag":97,"props":1289,"children":1291},{"className":1290},[],[1292],{"type":52,"value":670},{"type":52,"value":1294},") and is unrelated to ",{"type":46,"tag":97,"props":1296,"children":1298},{"className":1297},[],[1299],{"type":52,"value":102},{"type":52,"value":1301}," S3 Tables publishing.",{"type":46,"tag":694,"props":1303,"children":1305},{"id":1304},"_2-enable-if-not-configured",[1306],{"type":52,"value":1307},"2. Enable (if not configured)",{"type":46,"tag":706,"props":1309,"children":1311},{"className":708,"code":1310,"language":710,"meta":711,"style":711},"# Provisioned\naws redshift enable-logging --region \u003CREGION> --cluster-identifier \u003CCLUSTER_ID> --log-destination-type s3table --log-exports \u003CSYS_TABLE>... --s3-table-granularity \u003Ccluster|account> --s3-table-kms-key-id \u003CKMS_KEY_ARN>\n# Serverless\naws redshift-serverless update-namespace --region \u003CREGION> --namespace-name \u003CNAMESPACE_NAME> --log-destination-type s3table --s3-table-names \u003CSYS_TABLE>... --s3-table-action Enable --s3-table-granularity \u003Cnamespace|account> --s3-table-kms-key-id \u003CKMS_KEY_ARN>\n",[1312],{"type":46,"tag":97,"props":1313,"children":1314},{"__ignoreMap":711},[1315,1322,1464,1471],{"type":46,"tag":717,"props":1316,"children":1317},{"class":719,"line":40},[1318],{"type":46,"tag":717,"props":1319,"children":1320},{"style":723},[1321],{"type":52,"value":726},{"type":46,"tag":717,"props":1323,"children":1324},{"class":719,"line":729},[1325,1329,1333,1338,1342,1346,1350,1354,1358,1362,1366,1370,1374,1378,1383,1388,1393,1397,1402,1406,1410,1415,1420,1424,1428,1433,1437,1442,1447,1451,1456,1460],{"type":46,"tag":717,"props":1326,"children":1327},{"style":733},[1328],{"type":52,"value":8},{"type":46,"tag":717,"props":1330,"children":1331},{"style":738},[1332],{"type":52,"value":741},{"type":46,"tag":717,"props":1334,"children":1335},{"style":738},[1336],{"type":52,"value":1337}," enable-logging",{"type":46,"tag":717,"props":1339,"children":1340},{"style":738},[1341],{"type":52,"value":751},{"type":46,"tag":717,"props":1343,"children":1344},{"style":754},[1345],{"type":52,"value":757},{"type":46,"tag":717,"props":1347,"children":1348},{"style":738},[1349],{"type":52,"value":762},{"type":46,"tag":717,"props":1351,"children":1352},{"style":765},[1353],{"type":52,"value":768},{"type":46,"tag":717,"props":1355,"children":1356},{"style":754},[1357],{"type":52,"value":773},{"type":46,"tag":717,"props":1359,"children":1360},{"style":738},[1361],{"type":52,"value":778},{"type":46,"tag":717,"props":1363,"children":1364},{"style":754},[1365],{"type":52,"value":757},{"type":46,"tag":717,"props":1367,"children":1368},{"style":738},[1369],{"type":52,"value":787},{"type":46,"tag":717,"props":1371,"children":1372},{"style":765},[1373],{"type":52,"value":792},{"type":46,"tag":717,"props":1375,"children":1376},{"style":754},[1377],{"type":52,"value":773},{"type":46,"tag":717,"props":1379,"children":1380},{"style":738},[1381],{"type":52,"value":1382}," --log-destination-type",{"type":46,"tag":717,"props":1384,"children":1385},{"style":738},[1386],{"type":52,"value":1387}," s3table",{"type":46,"tag":717,"props":1389,"children":1390},{"style":738},[1391],{"type":52,"value":1392}," --log-exports",{"type":46,"tag":717,"props":1394,"children":1395},{"style":754},[1396],{"type":52,"value":757},{"type":46,"tag":717,"props":1398,"children":1399},{"style":738},[1400],{"type":52,"value":1401},"SYS_TABL",{"type":46,"tag":717,"props":1403,"children":1404},{"style":765},[1405],{"type":52,"value":863},{"type":46,"tag":717,"props":1407,"children":1408},{"style":754},[1409],{"type":52,"value":773},{"type":46,"tag":717,"props":1411,"children":1412},{"style":738},[1413],{"type":52,"value":1414},"...",{"type":46,"tag":717,"props":1416,"children":1417},{"style":738},[1418],{"type":52,"value":1419}," --s3-table-granularity",{"type":46,"tag":717,"props":1421,"children":1422},{"style":754},[1423],{"type":52,"value":757},{"type":46,"tag":717,"props":1425,"children":1426},{"style":738},[1427],{"type":52,"value":560},{"type":46,"tag":717,"props":1429,"children":1430},{"style":754},[1431],{"type":52,"value":1432},"|",{"type":46,"tag":717,"props":1434,"children":1435},{"style":733},[1436],{"type":52,"value":568},{"type":46,"tag":717,"props":1438,"children":1439},{"style":765},[1440],{"type":52,"value":1441},"> ",{"type":46,"tag":717,"props":1443,"children":1444},{"style":738},[1445],{"type":52,"value":1446},"--s3-table-kms-key-id",{"type":46,"tag":717,"props":1448,"children":1449},{"style":754},[1450],{"type":52,"value":757},{"type":46,"tag":717,"props":1452,"children":1453},{"style":738},[1454],{"type":52,"value":1455},"KMS_KEY_AR",{"type":46,"tag":717,"props":1457,"children":1458},{"style":765},[1459],{"type":52,"value":768},{"type":46,"tag":717,"props":1461,"children":1462},{"style":754},[1463],{"type":52,"value":797},{"type":46,"tag":717,"props":1465,"children":1466},{"class":719,"line":800},[1467],{"type":46,"tag":717,"props":1468,"children":1469},{"style":723},[1470],{"type":52,"value":806},{"type":46,"tag":717,"props":1472,"children":1473},{"class":719,"line":809},[1474,1478,1482,1487,1491,1495,1499,1503,1507,1511,1515,1519,1523,1527,1531,1535,1540,1544,1548,1552,1556,1560,1565,1570,1574,1578,1582,1586,1590,1594,1598,1602,1606,1610],{"type":46,"tag":717,"props":1475,"children":1476},{"style":733},[1477],{"type":52,"value":8},{"type":46,"tag":717,"props":1479,"children":1480},{"style":738},[1481],{"type":52,"value":819},{"type":46,"tag":717,"props":1483,"children":1484},{"style":738},[1485],{"type":52,"value":1486}," update-namespace",{"type":46,"tag":717,"props":1488,"children":1489},{"style":738},[1490],{"type":52,"value":751},{"type":46,"tag":717,"props":1492,"children":1493},{"style":754},[1494],{"type":52,"value":757},{"type":46,"tag":717,"props":1496,"children":1497},{"style":738},[1498],{"type":52,"value":762},{"type":46,"tag":717,"props":1500,"children":1501},{"style":765},[1502],{"type":52,"value":768},{"type":46,"tag":717,"props":1504,"children":1505},{"style":754},[1506],{"type":52,"value":773},{"type":46,"tag":717,"props":1508,"children":1509},{"style":738},[1510],{"type":52,"value":849},{"type":46,"tag":717,"props":1512,"children":1513},{"style":754},[1514],{"type":52,"value":757},{"type":46,"tag":717,"props":1516,"children":1517},{"style":738},[1518],{"type":52,"value":858},{"type":46,"tag":717,"props":1520,"children":1521},{"style":765},[1522],{"type":52,"value":863},{"type":46,"tag":717,"props":1524,"children":1525},{"style":754},[1526],{"type":52,"value":773},{"type":46,"tag":717,"props":1528,"children":1529},{"style":738},[1530],{"type":52,"value":1382},{"type":46,"tag":717,"props":1532,"children":1533},{"style":738},[1534],{"type":52,"value":1387},{"type":46,"tag":717,"props":1536,"children":1537},{"style":738},[1538],{"type":52,"value":1539}," --s3-table-names",{"type":46,"tag":717,"props":1541,"children":1542},{"style":754},[1543],{"type":52,"value":757},{"type":46,"tag":717,"props":1545,"children":1546},{"style":738},[1547],{"type":52,"value":1401},{"type":46,"tag":717,"props":1549,"children":1550},{"style":765},[1551],{"type":52,"value":863},{"type":46,"tag":717,"props":1553,"children":1554},{"style":754},[1555],{"type":52,"value":773},{"type":46,"tag":717,"props":1557,"children":1558},{"style":738},[1559],{"type":52,"value":1414},{"type":46,"tag":717,"props":1561,"children":1562},{"style":738},[1563],{"type":52,"value":1564}," --s3-table-action",{"type":46,"tag":717,"props":1566,"children":1567},{"style":738},[1568],{"type":52,"value":1569}," Enable",{"type":46,"tag":717,"props":1571,"children":1572},{"style":738},[1573],{"type":52,"value":1419},{"type":46,"tag":717,"props":1575,"children":1576},{"style":754},[1577],{"type":52,"value":757},{"type":46,"tag":717,"props":1579,"children":1580},{"style":738},[1581],{"type":52,"value":619},{"type":46,"tag":717,"props":1583,"children":1584},{"style":754},[1585],{"type":52,"value":1432},{"type":46,"tag":717,"props":1587,"children":1588},{"style":733},[1589],{"type":52,"value":568},{"type":46,"tag":717,"props":1591,"children":1592},{"style":765},[1593],{"type":52,"value":1441},{"type":46,"tag":717,"props":1595,"children":1596},{"style":738},[1597],{"type":52,"value":1446},{"type":46,"tag":717,"props":1599,"children":1600},{"style":754},[1601],{"type":52,"value":757},{"type":46,"tag":717,"props":1603,"children":1604},{"style":738},[1605],{"type":52,"value":1455},{"type":46,"tag":717,"props":1607,"children":1608},{"style":765},[1609],{"type":52,"value":768},{"type":46,"tag":717,"props":1611,"children":1612},{"style":754},[1613],{"type":52,"value":797},{"type":46,"tag":62,"props":1615,"children":1616},{},[1617,1622,1624,1629,1631,1637,1638,1644,1645,1651],{"type":46,"tag":97,"props":1618,"children":1620},{"className":1619},[],[1621],{"type":52,"value":1446},{"type":52,"value":1623}," is part of both commands deliberately, not an optional add-on. Omitting it does not fail — the tables fall back to an AWS-owned key you cannot audit, restrict by policy, or revoke. Because ",{"type":46,"tag":97,"props":1625,"children":1627},{"className":1626},[],[1628],{"type":52,"value":102},{"type":52,"value":1630}," tables carry ",{"type":46,"tag":97,"props":1632,"children":1634},{"className":1633},[],[1635],{"type":52,"value":1636},"query_text",{"type":52,"value":112},{"type":46,"tag":97,"props":1639,"children":1641},{"className":1640},[],[1642],{"type":52,"value":1643},"user_name",{"type":52,"value":120},{"type":46,"tag":97,"props":1646,"children":1648},{"className":1647},[],[1649],{"type":52,"value":1650},"remote_host",{"type":52,"value":1652},", treat the customer-managed key as the default and drop the flag only for throwaway environments.",{"type":46,"tag":62,"props":1654,"children":1655},{},[1656],{"type":52,"value":1657},"Enable from AWS console Amazon Redshift Console > Clusters > select your cluster > Tabs > Integrations \u002F System table integration",{"type":46,"tag":62,"props":1659,"children":1660},{},[1661,1666],{"type":46,"tag":66,"props":1662,"children":1663},{},[1664],{"type":52,"value":1665},"The two compute types take different flags for the same feature.",{"type":52,"value":1667}," Do not carry Provisioned flag names over to Serverless:",{"type":46,"tag":243,"props":1669,"children":1670},{},[1671,1704],{"type":46,"tag":247,"props":1672,"children":1673},{},[1674],{"type":46,"tag":251,"props":1675,"children":1676},{},[1677,1682,1693],{"type":46,"tag":255,"props":1678,"children":1679},{},[1680],{"type":52,"value":1681},"Purpose",{"type":46,"tag":255,"props":1683,"children":1684},{},[1685,1686,1692],{"type":52,"value":926},{"type":46,"tag":97,"props":1687,"children":1689},{"className":1688},[],[1690],{"type":52,"value":1691},"enable-logging",{"type":52,"value":934},{"type":46,"tag":255,"props":1694,"children":1695},{},[1696,1697,1703],{"type":52,"value":939},{"type":46,"tag":97,"props":1698,"children":1700},{"className":1699},[],[1701],{"type":52,"value":1702},"update-namespace",{"type":52,"value":934},{"type":46,"tag":271,"props":1705,"children":1706},{},[1707,1732,1774,1822,1846],{"type":46,"tag":251,"props":1708,"children":1709},{},[1710,1715,1723],{"type":46,"tag":278,"props":1711,"children":1712},{},[1713],{"type":52,"value":1714},"Which system tables to publish",{"type":46,"tag":278,"props":1716,"children":1717},{},[1718],{"type":46,"tag":97,"props":1719,"children":1721},{"className":1720},[],[1722],{"type":52,"value":678},{"type":46,"tag":278,"props":1724,"children":1725},{},[1726],{"type":46,"tag":97,"props":1727,"children":1729},{"className":1728},[],[1730],{"type":52,"value":1731},"--s3-table-names",{"type":46,"tag":251,"props":1733,"children":1734},{},[1735,1740,1759],{"type":46,"tag":278,"props":1736,"children":1737},{},[1738],{"type":52,"value":1739},"Enable vs disable",{"type":46,"tag":278,"props":1741,"children":1742},{},[1743,1745,1750,1751,1757],{"type":52,"value":1744},"separate ",{"type":46,"tag":97,"props":1746,"children":1748},{"className":1747},[],[1749],{"type":52,"value":1691},{"type":52,"value":536},{"type":46,"tag":97,"props":1752,"children":1754},{"className":1753},[],[1755],{"type":52,"value":1756},"disable-logging",{"type":52,"value":1758}," operations",{"type":46,"tag":278,"props":1760,"children":1761},{},[1762,1767,1769],{"type":46,"tag":97,"props":1763,"children":1765},{"className":1764},[],[1766],{"type":52,"value":593},{"type":52,"value":1768}," | ",{"type":46,"tag":97,"props":1770,"children":1772},{"className":1771},[],[1773],{"type":52,"value":601},{"type":46,"tag":251,"props":1775,"children":1776},{},[1777,1781,1802],{"type":46,"tag":278,"props":1778,"children":1779},{},[1780],{"type":52,"value":1099},{"type":46,"tag":278,"props":1782,"children":1783},{},[1784,1790,1791,1796,1797],{"type":46,"tag":97,"props":1785,"children":1787},{"className":1786},[],[1788],{"type":52,"value":1789},"--s3-table-granularity",{"type":52,"value":425},{"type":46,"tag":97,"props":1792,"children":1794},{"className":1793},[],[1795],{"type":52,"value":560},{"type":52,"value":1768},{"type":46,"tag":97,"props":1798,"children":1800},{"className":1799},[],[1801],{"type":52,"value":568},{"type":46,"tag":278,"props":1803,"children":1804},{},[1805,1810,1811,1816,1817],{"type":46,"tag":97,"props":1806,"children":1808},{"className":1807},[],[1809],{"type":52,"value":1789},{"type":52,"value":425},{"type":46,"tag":97,"props":1812,"children":1814},{"className":1813},[],[1815],{"type":52,"value":619},{"type":52,"value":1768},{"type":46,"tag":97,"props":1818,"children":1820},{"className":1819},[],[1821],{"type":52,"value":568},{"type":46,"tag":251,"props":1823,"children":1824},{},[1825,1830,1838],{"type":46,"tag":278,"props":1826,"children":1827},{},[1828],{"type":52,"value":1829},"Customer-managed KMS key",{"type":46,"tag":278,"props":1831,"children":1832},{},[1833],{"type":46,"tag":97,"props":1834,"children":1836},{"className":1835},[],[1837],{"type":52,"value":1446},{"type":46,"tag":278,"props":1839,"children":1840},{},[1841],{"type":46,"tag":97,"props":1842,"children":1844},{"className":1843},[],[1845],{"type":52,"value":1446},{"type":46,"tag":251,"props":1847,"children":1848},{},[1849,1854,1863],{"type":46,"tag":278,"props":1850,"children":1851},{},[1852],{"type":52,"value":1853},"Validate without applying",{"type":46,"tag":278,"props":1855,"children":1856},{},[1857],{"type":46,"tag":97,"props":1858,"children":1860},{"className":1859},[],[1861],{"type":52,"value":1862},"--dry-run",{"type":46,"tag":278,"props":1864,"children":1865},{},[1866],{"type":46,"tag":97,"props":1867,"children":1869},{"className":1868},[],[1870],{"type":52,"value":1862},{"type":46,"tag":62,"props":1872,"children":1873},{},[1874],{"type":52,"value":1201},{"type":46,"tag":203,"props":1876,"children":1877},{},[1878,1909,1932,1968,2049],{"type":46,"tag":207,"props":1879,"children":1880},{},[1881,1883,1888,1890,1895,1897,1902,1903,1908],{"type":52,"value":1882},"Granularity: Provisioned supports ",{"type":46,"tag":97,"props":1884,"children":1886},{"className":1885},[],[1887],{"type":52,"value":560},{"type":52,"value":1889}," (default) or ",{"type":46,"tag":97,"props":1891,"children":1893},{"className":1892},[],[1894],{"type":52,"value":568},{"type":52,"value":1896},"; Serverless supports ",{"type":46,"tag":97,"props":1898,"children":1900},{"className":1899},[],[1901],{"type":52,"value":619},{"type":52,"value":1889},{"type":46,"tag":97,"props":1904,"children":1906},{"className":1905},[],[1907],{"type":52,"value":568},{"type":52,"value":645},{"type":46,"tag":207,"props":1910,"children":1911},{},[1912,1917,1918,1923,1925,1930],{"type":46,"tag":97,"props":1913,"children":1915},{"className":1914},[],[1916],{"type":52,"value":560},{"type":52,"value":595},{"type":46,"tag":97,"props":1919,"children":1921},{"className":1920},[],[1922],{"type":52,"value":619},{"type":52,"value":1924}," granularity → one S3 table per cluster\u002Fnamespace; ",{"type":46,"tag":97,"props":1926,"children":1928},{"className":1927},[],[1929],{"type":52,"value":568},{"type":52,"value":1931}," → one shared table for all clusters\u002Fnamespaces per account per region.",{"type":46,"tag":207,"props":1933,"children":1934},{},[1935,1937,1943,1945,1950,1952,1958,1960,1966],{"type":52,"value":1936},"Use ",{"type":46,"tag":97,"props":1938,"children":1940},{"className":1939},[],[1941],{"type":52,"value":1942},"all",{"type":52,"value":1944}," to publish all available ",{"type":46,"tag":97,"props":1946,"children":1948},{"className":1947},[],[1949],{"type":52,"value":102},{"type":52,"value":1951}," tables — ",{"type":46,"tag":97,"props":1953,"children":1955},{"className":1954},[],[1956],{"type":52,"value":1957},"--log-exports all",{"type":52,"value":1959}," on Provisioned, ",{"type":46,"tag":97,"props":1961,"children":1963},{"className":1962},[],[1964],{"type":52,"value":1965},"--s3-table-names all",{"type":52,"value":1967}," on Serverless.",{"type":46,"tag":207,"props":1969,"children":1970},{},[1971,1976,1978,1983,1985,1990,1991,1996,1997,2002,2003,2008,2010,2016,2018,2024,2026,2031,2033,2039,2041,2047],{"type":46,"tag":66,"props":1972,"children":1973},{},[1974],{"type":52,"value":1975},"Encryption at rest is strongly recommended for production.",{"type":52,"value":1977}," Without ",{"type":46,"tag":97,"props":1979,"children":1981},{"className":1980},[],[1982],{"type":52,"value":1446},{"type":52,"value":1984}," the published tables are encrypted with an AWS-owned key, which you cannot audit, restrict by policy, or revoke. ",{"type":46,"tag":97,"props":1986,"children":1988},{"className":1987},[],[1989],{"type":52,"value":102},{"type":52,"value":1630},{"type":46,"tag":97,"props":1992,"children":1994},{"className":1993},[],[1995],{"type":52,"value":1636},{"type":52,"value":112},{"type":46,"tag":97,"props":1998,"children":2000},{"className":1999},[],[2001],{"type":52,"value":1643},{"type":52,"value":120},{"type":46,"tag":97,"props":2004,"children":2006},{"className":2005},[],[2007],{"type":52,"value":1650},{"type":52,"value":2009}," (see ",{"type":46,"tag":74,"props":2011,"children":2013},{"href":2012},"#security-considerations",[2014],{"type":52,"value":2015},"Security Considerations",{"type":52,"value":2017},"), so pass a customer-managed key. Grant key access using the complete key policy in ",{"type":46,"tag":97,"props":2019,"children":2021},{"className":2020},[],[2022],{"type":52,"value":2023},"${SKILL_DIR}\u002Freferences\u002Fsecurity.md",{"type":52,"value":2025}," rather than an abbreviated action list — it needs ",{"type":46,"tag":66,"props":2027,"children":2028},{},[2029],{"type":52,"value":2030},"two",{"type":52,"value":2032}," service principals (",{"type":46,"tag":97,"props":2034,"children":2036},{"className":2035},[],[2037],{"type":52,"value":2038},"systemtables.redshift.amazonaws.com",{"type":52,"value":2040}," for publishing and ",{"type":46,"tag":97,"props":2042,"children":2044},{"className":2043},[],[2045],{"type":52,"value":2046},"maintenance.s3tables.amazonaws.com",{"type":52,"value":2048}," for table maintenance\u002Fcompaction). Provisioning only the publishing principal lets writes succeed while compaction silently fails.",{"type":46,"tag":207,"props":2050,"children":2051},{},[2052,2054,2059,2061,2067,2069,2074],{"type":52,"value":2053},"Both operations accept ",{"type":46,"tag":97,"props":2055,"children":2057},{"className":2056},[],[2058],{"type":52,"value":1862},{"type":52,"value":2060}," to validate the request without changing anything. Provisioned returns a ",{"type":46,"tag":97,"props":2062,"children":2064},{"className":2063},[],[2065],{"type":52,"value":2066},"DryRunOperation",{"type":52,"value":2068}," error on success (\"Request would have succeeded, but DryRun flag is set\"); Serverless returns an empty body and exit code 0. Note that the Serverless dry-run validates request ",{"type":46,"tag":419,"props":2070,"children":2071},{},[2072],{"type":52,"value":2073},"shape",{"type":52,"value":2075}," only, not parameter values, so a successful dry-run there does not guarantee the values are accepted.",{"type":46,"tag":62,"props":2077,"children":2078},{},[2079],{"type":46,"tag":66,"props":2080,"children":2081},{},[2082],{"type":52,"value":2083},"Disable selectively:",{"type":46,"tag":706,"props":2085,"children":2087},{"className":708,"code":2086,"language":710,"meta":711,"style":711},"# Provisioned\naws redshift disable-logging --region \u003CREGION> --cluster-identifier \u003CCLUSTER_ID> --log-destination-type s3table --log-exports \u003CSYS_TABLE>...\n# Serverless\naws redshift-serverless update-namespace --region \u003CREGION> --namespace-name \u003CNAMESPACE_NAME> --log-destination-type s3table --s3-table-names \u003CSYS_TABLE>... --s3-table-action Disable\n",[2088],{"type":46,"tag":97,"props":2089,"children":2090},{"__ignoreMap":711},[2091,2098,2187,2194],{"type":46,"tag":717,"props":2092,"children":2093},{"class":719,"line":40},[2094],{"type":46,"tag":717,"props":2095,"children":2096},{"style":723},[2097],{"type":52,"value":726},{"type":46,"tag":717,"props":2099,"children":2100},{"class":719,"line":729},[2101,2105,2109,2114,2118,2122,2126,2130,2134,2138,2142,2146,2150,2154,2158,2162,2166,2170,2174,2178,2182],{"type":46,"tag":717,"props":2102,"children":2103},{"style":733},[2104],{"type":52,"value":8},{"type":46,"tag":717,"props":2106,"children":2107},{"style":738},[2108],{"type":52,"value":741},{"type":46,"tag":717,"props":2110,"children":2111},{"style":738},[2112],{"type":52,"value":2113}," disable-logging",{"type":46,"tag":717,"props":2115,"children":2116},{"style":738},[2117],{"type":52,"value":751},{"type":46,"tag":717,"props":2119,"children":2120},{"style":754},[2121],{"type":52,"value":757},{"type":46,"tag":717,"props":2123,"children":2124},{"style":738},[2125],{"type":52,"value":762},{"type":46,"tag":717,"props":2127,"children":2128},{"style":765},[2129],{"type":52,"value":768},{"type":46,"tag":717,"props":2131,"children":2132},{"style":754},[2133],{"type":52,"value":773},{"type":46,"tag":717,"props":2135,"children":2136},{"style":738},[2137],{"type":52,"value":778},{"type":46,"tag":717,"props":2139,"children":2140},{"style":754},[2141],{"type":52,"value":757},{"type":46,"tag":717,"props":2143,"children":2144},{"style":738},[2145],{"type":52,"value":787},{"type":46,"tag":717,"props":2147,"children":2148},{"style":765},[2149],{"type":52,"value":792},{"type":46,"tag":717,"props":2151,"children":2152},{"style":754},[2153],{"type":52,"value":773},{"type":46,"tag":717,"props":2155,"children":2156},{"style":738},[2157],{"type":52,"value":1382},{"type":46,"tag":717,"props":2159,"children":2160},{"style":738},[2161],{"type":52,"value":1387},{"type":46,"tag":717,"props":2163,"children":2164},{"style":738},[2165],{"type":52,"value":1392},{"type":46,"tag":717,"props":2167,"children":2168},{"style":754},[2169],{"type":52,"value":757},{"type":46,"tag":717,"props":2171,"children":2172},{"style":738},[2173],{"type":52,"value":1401},{"type":46,"tag":717,"props":2175,"children":2176},{"style":765},[2177],{"type":52,"value":863},{"type":46,"tag":717,"props":2179,"children":2180},{"style":754},[2181],{"type":52,"value":773},{"type":46,"tag":717,"props":2183,"children":2184},{"style":738},[2185],{"type":52,"value":2186},"...\n",{"type":46,"tag":717,"props":2188,"children":2189},{"class":719,"line":800},[2190],{"type":46,"tag":717,"props":2191,"children":2192},{"style":723},[2193],{"type":52,"value":806},{"type":46,"tag":717,"props":2195,"children":2196},{"class":719,"line":809},[2197,2201,2205,2209,2213,2217,2221,2225,2229,2233,2237,2241,2245,2249,2253,2257,2261,2265,2269,2273,2277,2281,2285],{"type":46,"tag":717,"props":2198,"children":2199},{"style":733},[2200],{"type":52,"value":8},{"type":46,"tag":717,"props":2202,"children":2203},{"style":738},[2204],{"type":52,"value":819},{"type":46,"tag":717,"props":2206,"children":2207},{"style":738},[2208],{"type":52,"value":1486},{"type":46,"tag":717,"props":2210,"children":2211},{"style":738},[2212],{"type":52,"value":751},{"type":46,"tag":717,"props":2214,"children":2215},{"style":754},[2216],{"type":52,"value":757},{"type":46,"tag":717,"props":2218,"children":2219},{"style":738},[2220],{"type":52,"value":762},{"type":46,"tag":717,"props":2222,"children":2223},{"style":765},[2224],{"type":52,"value":768},{"type":46,"tag":717,"props":2226,"children":2227},{"style":754},[2228],{"type":52,"value":773},{"type":46,"tag":717,"props":2230,"children":2231},{"style":738},[2232],{"type":52,"value":849},{"type":46,"tag":717,"props":2234,"children":2235},{"style":754},[2236],{"type":52,"value":757},{"type":46,"tag":717,"props":2238,"children":2239},{"style":738},[2240],{"type":52,"value":858},{"type":46,"tag":717,"props":2242,"children":2243},{"style":765},[2244],{"type":52,"value":863},{"type":46,"tag":717,"props":2246,"children":2247},{"style":754},[2248],{"type":52,"value":773},{"type":46,"tag":717,"props":2250,"children":2251},{"style":738},[2252],{"type":52,"value":1382},{"type":46,"tag":717,"props":2254,"children":2255},{"style":738},[2256],{"type":52,"value":1387},{"type":46,"tag":717,"props":2258,"children":2259},{"style":738},[2260],{"type":52,"value":1539},{"type":46,"tag":717,"props":2262,"children":2263},{"style":754},[2264],{"type":52,"value":757},{"type":46,"tag":717,"props":2266,"children":2267},{"style":738},[2268],{"type":52,"value":1401},{"type":46,"tag":717,"props":2270,"children":2271},{"style":765},[2272],{"type":52,"value":863},{"type":46,"tag":717,"props":2274,"children":2275},{"style":754},[2276],{"type":52,"value":773},{"type":46,"tag":717,"props":2278,"children":2279},{"style":738},[2280],{"type":52,"value":1414},{"type":46,"tag":717,"props":2282,"children":2283},{"style":738},[2284],{"type":52,"value":1564},{"type":46,"tag":717,"props":2286,"children":2287},{"style":738},[2288],{"type":52,"value":2289}," Disable\n",{"type":46,"tag":694,"props":2291,"children":2293},{"id":2292},"_3-verify-permissions",[2294],{"type":52,"value":2295},"3. Verify Permissions",{"type":46,"tag":62,"props":2297,"children":2298},{},[2299,2301,2310],{"type":52,"value":2300},"Full setup commands for both paths: ",{"type":46,"tag":66,"props":2302,"children":2303},{},[2304],{"type":46,"tag":97,"props":2305,"children":2307},{"className":2306},[],[2308],{"type":52,"value":2309},"${SKILL_DIR}\u002Freferences\u002Fpermissions-setup.md",{"type":52,"value":2311},". Load it before creating roles or registering resources.",{"type":46,"tag":62,"props":2313,"children":2314},{},[2315,2320,2322,2328],{"type":46,"tag":66,"props":2316,"children":2317},{},[2318],{"type":52,"value":2319},"Athena path",{"type":52,"value":2321}," — needs the ",{"type":46,"tag":97,"props":2323,"children":2325},{"className":2324},[],[2326],{"type":52,"value":2327},"s3tablescatalog\u002Faws-redshift",{"type":52,"value":2329}," catalog registered in Glue, a workgroup with an output location, and S3 Tables read permissions. Confirm the catalog is queryable:",{"type":46,"tag":706,"props":2331,"children":2333},{"className":708,"code":2332,"language":710,"meta":711,"style":711},"aws glue get-databases --region \u003CREGION> \\\n  --catalog-id \"\u003CACCOUNT>:s3tablescatalog\u002Faws-redshift\"\n",[2334],{"type":46,"tag":97,"props":2335,"children":2336},{"__ignoreMap":711},[2337,2379],{"type":46,"tag":717,"props":2338,"children":2339},{"class":719,"line":40},[2340,2344,2349,2354,2358,2362,2366,2370,2374],{"type":46,"tag":717,"props":2341,"children":2342},{"style":733},[2343],{"type":52,"value":8},{"type":46,"tag":717,"props":2345,"children":2346},{"style":738},[2347],{"type":52,"value":2348}," glue",{"type":46,"tag":717,"props":2350,"children":2351},{"style":738},[2352],{"type":52,"value":2353}," get-databases",{"type":46,"tag":717,"props":2355,"children":2356},{"style":738},[2357],{"type":52,"value":751},{"type":46,"tag":717,"props":2359,"children":2360},{"style":754},[2361],{"type":52,"value":757},{"type":46,"tag":717,"props":2363,"children":2364},{"style":738},[2365],{"type":52,"value":762},{"type":46,"tag":717,"props":2367,"children":2368},{"style":765},[2369],{"type":52,"value":768},{"type":46,"tag":717,"props":2371,"children":2372},{"style":754},[2373],{"type":52,"value":773},{"type":46,"tag":717,"props":2375,"children":2376},{"style":765},[2377],{"type":52,"value":2378}," \\\n",{"type":46,"tag":717,"props":2380,"children":2381},{"class":719,"line":729},[2382,2387,2392,2397],{"type":46,"tag":717,"props":2383,"children":2384},{"style":738},[2385],{"type":52,"value":2386},"  --catalog-id",{"type":46,"tag":717,"props":2388,"children":2389},{"style":754},[2390],{"type":52,"value":2391}," \"",{"type":46,"tag":717,"props":2393,"children":2394},{"style":738},[2395],{"type":52,"value":2396},"\u003CACCOUNT>:s3tablescatalog\u002Faws-redshift",{"type":46,"tag":717,"props":2398,"children":2399},{"style":754},[2400],{"type":52,"value":2401},"\"\n",{"type":46,"tag":62,"props":2403,"children":2404},{},[2405,2407,2413,2414,2420,2422,2427,2429,2434,2435,2440],{"type":52,"value":2406},"Namespaces returned → registered and queryable. ",{"type":46,"tag":97,"props":2408,"children":2410},{"className":2409},[],[2411],{"type":52,"value":2412},"EntityNotFoundException",{"type":52,"value":536},{"type":46,"tag":97,"props":2415,"children":2417},{"className":2416},[],[2418],{"type":52,"value":2419},"CATALOG_NOT_FOUND",{"type":52,"value":2421}," → the S3 Tables integration is not enabled (S3 console > Table buckets > Enable integration). ",{"type":46,"tag":66,"props":2423,"children":2424},{},[2425],{"type":52,"value":2426},"Encrypt the workgroup output location",{"type":52,"value":2428}," — Athena writes full result sets, including ",{"type":46,"tag":97,"props":2430,"children":2432},{"className":2431},[],[2433],{"type":52,"value":1636},{"type":52,"value":174},{"type":46,"tag":97,"props":2436,"children":2438},{"className":2437},[],[2439],{"type":52,"value":1643},{"type":52,"value":2441},", to S3.",{"type":46,"tag":62,"props":2443,"children":2444},{},[2445,2450,2452,2458,2460,2465,2466,2472,2473,2479,2481,2487,2488,2494,2495,2501,2502,2508,2510,2516],{"type":46,"tag":66,"props":2446,"children":2447},{},[2448],{"type":52,"value":2449},"Redshift auto-mount path",{"type":52,"value":2451}," — needs a Provisioned RA3 cluster and a four-step setup: create the ",{"type":46,"tag":97,"props":2453,"children":2455},{"className":2454},[],[2456],{"type":52,"value":2457},"query_s3_tables",{"type":52,"value":2459}," role (trust policy must name ",{"type":46,"tag":419,"props":2461,"children":2462},{},[2463],{"type":52,"value":2464},"both",{"type":52,"value":425},{"type":46,"tag":97,"props":2467,"children":2469},{"className":2468},[],[2470],{"type":52,"value":2471},"redshift.amazonaws.com",{"type":52,"value":174},{"type":46,"tag":97,"props":2474,"children":2476},{"className":2475},[],[2477],{"type":52,"value":2478},"lakeformation.amazonaws.com",{"type":52,"value":2480},", the latter with all four of ",{"type":46,"tag":97,"props":2482,"children":2484},{"className":2483},[],[2485],{"type":52,"value":2486},"sts:AssumeRole",{"type":52,"value":112},{"type":46,"tag":97,"props":2489,"children":2491},{"className":2490},[],[2492],{"type":52,"value":2493},"sts:SetContext",{"type":52,"value":112},{"type":46,"tag":97,"props":2496,"children":2498},{"className":2497},[],[2499],{"type":52,"value":2500},"sts:SetSourceIdentity",{"type":52,"value":112},{"type":46,"tag":97,"props":2503,"children":2505},{"className":2504},[],[2506],{"type":52,"value":2507},"sts:TagSession",{"type":52,"value":2509},"), attach it to the cluster, register the table bucket with Lake Formation, and add the Redshift service-linked roles to ",{"type":46,"tag":97,"props":2511,"children":2513},{"className":2512},[],[2514],{"type":52,"value":2515},"ReadOnlyAdmins",{"type":52,"value":2517},". Constraints that cause most failures:",{"type":46,"tag":203,"props":2519,"children":2520},{},[2521,2537,2555],{"type":46,"tag":207,"props":2522,"children":2523},{},[2524,2535],{"type":46,"tag":66,"props":2525,"children":2526},{},[2527,2529],{"type":52,"value":2528},"Condition both trust statements on ",{"type":46,"tag":97,"props":2530,"children":2532},{"className":2531},[],[2533],{"type":52,"value":2534},"aws:SourceAccount",{"type":52,"value":2536}," — a bare service principal is a confused-deputy risk.",{"type":46,"tag":207,"props":2538,"children":2539},{},[2540,2553],{"type":46,"tag":66,"props":2541,"children":2542},{},[2543,2545,2551],{"type":52,"value":2544},"Do not attach ",{"type":46,"tag":97,"props":2546,"children":2548},{"className":2547},[],[2549],{"type":52,"value":2550},"AWSLakeFormationDataAdmin",{"type":52,"value":2552}," to the cluster's query role.",{"type":52,"value":2554}," It is needed only by the principal performing setup, and only during setup. The cluster's role needs read access alone.",{"type":46,"tag":207,"props":2556,"children":2557},{},[2558,2563,2565,2571],{"type":46,"tag":66,"props":2559,"children":2560},{},[2561],{"type":52,"value":2562},"Auto-mount is a poll, not a callback",{"type":52,"value":2564}," — the catalog can take up to 300 seconds to appear in ",{"type":46,"tag":97,"props":2566,"children":2568},{"className":2567},[],[2569],{"type":52,"value":2570},"pg_database",{"type":52,"value":2572},". A cluster reboot forces immediate discovery.",{"type":46,"tag":694,"props":2574,"children":2576},{"id":2575},"_4-identify-the-target-table",[2577],{"type":52,"value":2578},"4. Identify the Target Table",{"type":46,"tag":62,"props":2580,"children":2581},{},[2582,2587],{"type":46,"tag":66,"props":2583,"children":2584},{},[2585],{"type":52,"value":2586},"Namespace",{"type":52,"value":2588}," — resolve it from the API, do not construct it:",{"type":46,"tag":203,"props":2590,"children":2591},{},[2592,2625],{"type":46,"tag":207,"props":2593,"children":2594},{},[2595,2597,2602,2604,2609,2611,2617,2618,2623],{"type":52,"value":2596},"Read ",{"type":46,"tag":97,"props":2598,"children":2600},{"className":2599},[],[2601],{"type":52,"value":1082},{"type":52,"value":2603}," from ",{"type":46,"tag":97,"props":2605,"children":2607},{"className":2606},[],[2608],{"type":52,"value":932},{"type":52,"value":2610}," (Provisioned) or ",{"type":46,"tag":97,"props":2612,"children":2614},{"className":2613},[],[2615],{"type":52,"value":2616},"s3TablePublishStatus.s3TableNamespace",{"type":52,"value":2603},{"type":46,"tag":97,"props":2619,"children":2621},{"className":2620},[],[2622],{"type":52,"value":945},{"type":52,"value":2624}," (Serverless) and use it verbatim.",{"type":46,"tag":207,"props":2626,"children":2627},{},[2628,2630,2636,2638,2643,2644,2649,2651,2657,2658,2663,2665,2670],{"type":52,"value":2629},"Optional sanity check only: the API value typically follows ",{"type":46,"tag":97,"props":2631,"children":2633},{"className":2632},[],[2634],{"type":52,"value":2635},"\u003Cnamespace_arn_id>_sys",{"type":52,"value":2637}," for ",{"type":46,"tag":97,"props":2639,"children":2641},{"className":2640},[],[2642],{"type":52,"value":560},{"type":52,"value":595},{"type":46,"tag":97,"props":2645,"children":2647},{"className":2646},[],[2648],{"type":52,"value":619},{"type":52,"value":2650}," granularity and ",{"type":46,"tag":97,"props":2652,"children":2654},{"className":2653},[],[2655],{"type":52,"value":2656},"\u003Caccount>_sys",{"type":52,"value":2637},{"type":46,"tag":97,"props":2659,"children":2661},{"className":2660},[],[2662],{"type":52,"value":568},{"type":52,"value":2664}," granularity. Use this only to ",{"type":46,"tag":419,"props":2666,"children":2667},{},[2668],{"type":52,"value":2669},"verify",{"type":52,"value":2671}," the value looks right — never to generate the namespace when the API response is unavailable.",{"type":46,"tag":62,"props":2673,"children":2674},{},[2675,2680,2682,2687,2689,2693],{"type":46,"tag":66,"props":2676,"children":2677},{},[2678],{"type":52,"value":2679},"Table",{"type":52,"value":2681}," — each publishable system table maps 1:1 to a table in the ",{"type":46,"tag":97,"props":2683,"children":2685},{"className":2684},[],[2686],{"type":52,"value":187},{"type":52,"value":2688}," table bucket. Do ",{"type":46,"tag":66,"props":2690,"children":2691},{},[2692],{"type":52,"value":1265},{"type":52,"value":2694}," work from a memorized list — resolve it at runtime, in this order:",{"type":46,"tag":2696,"props":2697,"children":2698},"ol",{},[2699,2730,2768],{"type":46,"tag":207,"props":2700,"children":2701},{},[2702,2707,2709,2714,2715,2721,2723,2728],{"type":46,"tag":66,"props":2703,"children":2704},{},[2705],{"type":52,"value":2706},"The published set for this cluster\u002Fnamespace",{"type":52,"value":2708}," — ",{"type":46,"tag":97,"props":2710,"children":2712},{"className":2711},[],[2713],{"type":52,"value":1051},{"type":52,"value":2610},{"type":46,"tag":97,"props":2716,"children":2718},{"className":2717},[],[2719],{"type":52,"value":2720},"s3TablePublishStatus.s3Tables",{"type":52,"value":2722}," (Serverless) from the status call above, e.g. ",{"type":46,"tag":97,"props":2724,"children":2726},{"className":2725},[],[2727],{"type":52,"value":110},{"type":52,"value":2729},". This is the only authoritative answer to \"what can I query right now\".",{"type":46,"tag":207,"props":2731,"children":2732},{},[2733,2738,2739,2745,2747,2752,2754,2760,2761,2766],{"type":46,"tag":66,"props":2734,"children":2735},{},[2736],{"type":52,"value":2737},"The set this API accepts",{"type":52,"value":2708},{"type":46,"tag":97,"props":2740,"children":2742},{"className":2741},[],[2743],{"type":52,"value":2744},"aws redshift enable-logging help",{"type":52,"value":2746}," (accepted ",{"type":46,"tag":97,"props":2748,"children":2750},{"className":2749},[],[2751],{"type":52,"value":678},{"type":52,"value":2753}," values) or ",{"type":46,"tag":97,"props":2755,"children":2757},{"className":2756},[],[2758],{"type":52,"value":2759},"aws redshift-serverless update-namespace help",{"type":52,"value":2746},{"type":46,"tag":97,"props":2762,"children":2764},{"className":2763},[],[2765],{"type":52,"value":1731},{"type":52,"value":2767}," values).",{"type":46,"tag":207,"props":2769,"children":2770},{},[2771,2776,2778,2785,2787,2792],{"type":46,"tag":66,"props":2772,"children":2773},{},[2774],{"type":52,"value":2775},"What each table contains",{"type":52,"value":2777}," — the public ",{"type":46,"tag":74,"props":2779,"children":2782},{"href":2780,"rel":2781},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fredshift\u002Flatest\u002Fdg\u002Fcm_chap_system-tables.html",[78],[2783],{"type":52,"value":2784},"Redshift SYS monitoring views reference",{"type":52,"value":2786},", which documents every ",{"type":46,"tag":97,"props":2788,"children":2790},{"className":2789},[],[2791],{"type":52,"value":102},{"type":52,"value":2793}," view and its columns. AWS adds views over time, so treat the docs as the current list rather than hardcoding one.",{"type":46,"tag":62,"props":2795,"children":2796},{},[2797],{"type":52,"value":2798},"Column names and types come from the same public reference, or from the live table:",{"type":46,"tag":706,"props":2800,"children":2802},{"className":708,"code":2801,"language":710,"meta":711,"style":711},"aws glue get-table --region \u003CREGION> \\\n  --catalog-id \"\u003CACCOUNT>:s3tablescatalog\u002Faws-redshift\" \\\n  --database-name \"\u003CNAMESPACE>\" --name \"\u003CSYS_TABLE>\"\n",[2803],{"type":46,"tag":97,"props":2804,"children":2805},{"__ignoreMap":711},[2806,2846,2870],{"type":46,"tag":717,"props":2807,"children":2808},{"class":719,"line":40},[2809,2813,2817,2822,2826,2830,2834,2838,2842],{"type":46,"tag":717,"props":2810,"children":2811},{"style":733},[2812],{"type":52,"value":8},{"type":46,"tag":717,"props":2814,"children":2815},{"style":738},[2816],{"type":52,"value":2348},{"type":46,"tag":717,"props":2818,"children":2819},{"style":738},[2820],{"type":52,"value":2821}," get-table",{"type":46,"tag":717,"props":2823,"children":2824},{"style":738},[2825],{"type":52,"value":751},{"type":46,"tag":717,"props":2827,"children":2828},{"style":754},[2829],{"type":52,"value":757},{"type":46,"tag":717,"props":2831,"children":2832},{"style":738},[2833],{"type":52,"value":762},{"type":46,"tag":717,"props":2835,"children":2836},{"style":765},[2837],{"type":52,"value":768},{"type":46,"tag":717,"props":2839,"children":2840},{"style":754},[2841],{"type":52,"value":773},{"type":46,"tag":717,"props":2843,"children":2844},{"style":765},[2845],{"type":52,"value":2378},{"type":46,"tag":717,"props":2847,"children":2848},{"class":719,"line":729},[2849,2853,2857,2861,2866],{"type":46,"tag":717,"props":2850,"children":2851},{"style":738},[2852],{"type":52,"value":2386},{"type":46,"tag":717,"props":2854,"children":2855},{"style":754},[2856],{"type":52,"value":2391},{"type":46,"tag":717,"props":2858,"children":2859},{"style":738},[2860],{"type":52,"value":2396},{"type":46,"tag":717,"props":2862,"children":2863},{"style":754},[2864],{"type":52,"value":2865},"\"",{"type":46,"tag":717,"props":2867,"children":2868},{"style":765},[2869],{"type":52,"value":2378},{"type":46,"tag":717,"props":2871,"children":2872},{"class":719,"line":800},[2873,2878,2882,2887,2891,2896,2900,2905],{"type":46,"tag":717,"props":2874,"children":2875},{"style":738},[2876],{"type":52,"value":2877},"  --database-name",{"type":46,"tag":717,"props":2879,"children":2880},{"style":754},[2881],{"type":52,"value":2391},{"type":46,"tag":717,"props":2883,"children":2884},{"style":738},[2885],{"type":52,"value":2886},"\u003CNAMESPACE>",{"type":46,"tag":717,"props":2888,"children":2889},{"style":754},[2890],{"type":52,"value":2865},{"type":46,"tag":717,"props":2892,"children":2893},{"style":738},[2894],{"type":52,"value":2895}," --name",{"type":46,"tag":717,"props":2897,"children":2898},{"style":754},[2899],{"type":52,"value":2391},{"type":46,"tag":717,"props":2901,"children":2902},{"style":738},[2903],{"type":52,"value":2904},"\u003CSYS_TABLE>",{"type":46,"tag":717,"props":2906,"children":2907},{"style":754},[2908],{"type":52,"value":2401},{"type":46,"tag":62,"props":2910,"children":2911},{},[2912,2914,2920,2921,2927,2928,2934,2936,2942,2944,2950,2951,2957,2959,2964,2966,2971],{"type":52,"value":2913},"Two caveats when reading the public docs against a published table: enum-valued columns (",{"type":46,"tag":97,"props":2915,"children":2917},{"className":2916},[],[2918],{"type":52,"value":2919},"query_type",{"type":52,"value":112},{"type":46,"tag":97,"props":2922,"children":2924},{"className":2923},[],[2925],{"type":52,"value":2926},"status",{"type":52,"value":112},{"type":46,"tag":97,"props":2929,"children":2931},{"className":2930},[],[2932],{"type":52,"value":2933},"event",{"type":52,"value":2935},") gain values over time, so confirm with ",{"type":46,"tag":97,"props":2937,"children":2939},{"className":2938},[],[2940],{"type":52,"value":2941},"SELECT DISTINCT",{"type":52,"value":2943}," rather than filtering on an assumed set; and the published Iceberg table prepends warehouse-identity columns (",{"type":46,"tag":97,"props":2945,"children":2947},{"className":2946},[],[2948],{"type":52,"value":2949},"warehouse_name",{"type":52,"value":112},{"type":46,"tag":97,"props":2952,"children":2954},{"className":2953},[],[2955],{"type":52,"value":2956},"warehouse_namespace_arn",{"type":52,"value":2958},", and peers) that the in-cluster ",{"type":46,"tag":97,"props":2960,"children":2962},{"className":2961},[],[2963],{"type":52,"value":163},{"type":52,"value":2965}," view does not have — they are how you tell apart multiple clusters publishing at ",{"type":46,"tag":97,"props":2967,"children":2969},{"className":2968},[],[2970],{"type":52,"value":568},{"type":52,"value":2972}," granularity.",{"type":46,"tag":694,"props":2974,"children":2976},{"id":2975},"_5-query",[2977],{"type":52,"value":2978},"5. Query",{"type":46,"tag":2980,"props":2981,"children":2983},"h4",{"id":2982},"query-from-athena",[2984],{"type":52,"value":2985},"Query from Athena",{"type":46,"tag":62,"props":2987,"children":2988},{},[2989],{"type":46,"tag":66,"props":2990,"children":2991},{},[2992],{"type":52,"value":2993},"Query syntax:",{"type":46,"tag":706,"props":2995,"children":2998},{"className":2996,"code":2997,"language":24,"meta":711,"style":711},"language-sql shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\"s3tablescatalog\u002Faws-redshift\".\"\u003CNAMESPACE>\".\"\u003CSYS_TABLE>\"\n",[2999],{"type":46,"tag":97,"props":3000,"children":3001},{"__ignoreMap":711},[3002],{"type":46,"tag":717,"props":3003,"children":3004},{"class":719,"line":40},[3005],{"type":46,"tag":717,"props":3006,"children":3007},{},[3008],{"type":52,"value":2997},{"type":46,"tag":2980,"props":3010,"children":3012},{"id":3011},"query-from-redshift-auto-mounted-catalog",[3013],{"type":52,"value":3014},"Query from Redshift (Auto-Mounted Catalog)",{"type":46,"tag":62,"props":3016,"children":3017},{},[3018,3020,3025],{"type":52,"value":3019},"Once the auto-mounted catalog is set up (see ",{"type":46,"tag":97,"props":3021,"children":3023},{"className":3022},[],[3024],{"type":52,"value":2309},{"type":52,"value":3026},"), query using cross-database notation:",{"type":46,"tag":706,"props":3028,"children":3030},{"className":2996,"code":3029,"language":24,"meta":711,"style":711},"\"aws-redshift@s3tablescatalog\".\"\u003CNAMESPACE>\".\u003CSYS_TABLE>\n",[3031],{"type":46,"tag":97,"props":3032,"children":3033},{"__ignoreMap":711},[3034],{"type":46,"tag":717,"props":3035,"children":3036},{"class":719,"line":40},[3037],{"type":46,"tag":717,"props":3038,"children":3039},{},[3040],{"type":52,"value":3029},{"type":46,"tag":2980,"props":3042,"children":3044},{"id":3043},"query-from-redshift-external-schema",[3045],{"type":52,"value":3046},"Query from Redshift (External Schema)",{"type":46,"tag":62,"props":3048,"children":3049},{},[3050],{"type":52,"value":3051},"Alternatively, create an external schema pointing to the S3 Tables catalog:",{"type":46,"tag":706,"props":3053,"children":3055},{"className":2996,"code":3054,"language":24,"meta":711,"style":711},"CREATE EXTERNAL SCHEMA \u003Cschema_name>\nFROM DATA CATALOG\nDATABASE '\u003CNAMESPACE>'\nCATALOG_ID '\u003CACCOUNT>:s3tablescatalog\u002Faws-redshift'\nIAM_ROLE 'arn:aws:iam::\u003CACCOUNT>:role\u002Fquery_s3_tables'\nREGION '\u003CREGION>';\n\nSELECT * FROM \u003Cschema_name>.\u003CSYS_TABLE> LIMIT 10;\n",[3056],{"type":46,"tag":97,"props":3057,"children":3058},{"__ignoreMap":711},[3059,3067,3075,3083,3091,3100,3109,3119],{"type":46,"tag":717,"props":3060,"children":3061},{"class":719,"line":40},[3062],{"type":46,"tag":717,"props":3063,"children":3064},{},[3065],{"type":52,"value":3066},"CREATE EXTERNAL SCHEMA \u003Cschema_name>\n",{"type":46,"tag":717,"props":3068,"children":3069},{"class":719,"line":729},[3070],{"type":46,"tag":717,"props":3071,"children":3072},{},[3073],{"type":52,"value":3074},"FROM DATA CATALOG\n",{"type":46,"tag":717,"props":3076,"children":3077},{"class":719,"line":800},[3078],{"type":46,"tag":717,"props":3079,"children":3080},{},[3081],{"type":52,"value":3082},"DATABASE '\u003CNAMESPACE>'\n",{"type":46,"tag":717,"props":3084,"children":3085},{"class":719,"line":809},[3086],{"type":46,"tag":717,"props":3087,"children":3088},{},[3089],{"type":52,"value":3090},"CATALOG_ID '\u003CACCOUNT>:s3tablescatalog\u002Faws-redshift'\n",{"type":46,"tag":717,"props":3092,"children":3094},{"class":719,"line":3093},5,[3095],{"type":46,"tag":717,"props":3096,"children":3097},{},[3098],{"type":52,"value":3099},"IAM_ROLE 'arn:aws:iam::\u003CACCOUNT>:role\u002Fquery_s3_tables'\n",{"type":46,"tag":717,"props":3101,"children":3103},{"class":719,"line":3102},6,[3104],{"type":46,"tag":717,"props":3105,"children":3106},{},[3107],{"type":52,"value":3108},"REGION '\u003CREGION>';\n",{"type":46,"tag":717,"props":3110,"children":3112},{"class":719,"line":3111},7,[3113],{"type":46,"tag":717,"props":3114,"children":3116},{"emptyLinePlaceholder":3115},true,[3117],{"type":52,"value":3118},"\n",{"type":46,"tag":717,"props":3120,"children":3122},{"class":719,"line":3121},8,[3123],{"type":46,"tag":717,"props":3124,"children":3125},{},[3126],{"type":52,"value":3127},"SELECT * FROM \u003Cschema_name>.\u003CSYS_TABLE> LIMIT 10;\n",{"type":46,"tag":2980,"props":3129,"children":3131},{"id":3130},"constraints",[3132],{"type":52,"value":3133},"Constraints",{"type":46,"tag":203,"props":3135,"children":3136},{},[3137,3156,3161,3179,3211],{"type":46,"tag":207,"props":3138,"children":3139},{},[3140,3142,3147,3149,3154],{"type":52,"value":3141},"You MUST run ",{"type":46,"tag":97,"props":3143,"children":3145},{"className":3144},[],[3146],{"type":52,"value":932},{"type":52,"value":3148}," or ",{"type":46,"tag":97,"props":3150,"children":3152},{"className":3151},[],[3153],{"type":52,"value":945},{"type":52,"value":3155}," to get the namespace before writing any SQL query — never construct it manually",{"type":46,"tag":207,"props":3157,"children":3158},{},[3159],{"type":52,"value":3160},"For Athena queries, you MUST confirm workgroup and output location before executing",{"type":46,"tag":207,"props":3162,"children":3163},{},[3164,3169,3171,3177],{"type":46,"tag":66,"props":3165,"children":3166},{},[3167],{"type":52,"value":3168},"Timing columns are in microseconds.",{"type":52,"value":3170}," Divide by ",{"type":46,"tag":97,"props":3172,"children":3174},{"className":3173},[],[3175],{"type":52,"value":3176},"1000000.0",{"type":52,"value":3178}," for seconds",{"type":46,"tag":207,"props":3180,"children":3181},{},[3182,3184,3189,3191,3197,3198,3204,3205],{"type":52,"value":3183},"Tables are ",{"type":46,"tag":66,"props":3185,"children":3186},{},[3187],{"type":52,"value":3188},"read-only",{"type":52,"value":3190}," — no ",{"type":46,"tag":97,"props":3192,"children":3194},{"className":3193},[],[3195],{"type":52,"value":3196},"INSERT",{"type":52,"value":595},{"type":46,"tag":97,"props":3199,"children":3201},{"className":3200},[],[3202],{"type":52,"value":3203},"UPDATE",{"type":52,"value":595},{"type":46,"tag":97,"props":3206,"children":3208},{"className":3207},[],[3209],{"type":52,"value":3210},"DELETE",{"type":46,"tag":207,"props":3212,"children":3213},{},[3214,3216,3222,3224,3230,3231,3237],{"type":52,"value":3215},"Always add a ",{"type":46,"tag":97,"props":3217,"children":3219},{"className":3218},[],[3220],{"type":52,"value":3221},"LIMIT",{"type":52,"value":3223}," when the user doesn't specify one; filter on ",{"type":46,"tag":97,"props":3225,"children":3227},{"className":3226},[],[3228],{"type":52,"value":3229},"start_time",{"type":52,"value":595},{"type":46,"tag":97,"props":3232,"children":3234},{"className":3233},[],[3235],{"type":52,"value":3236},"record_time",{"type":52,"value":3238}," where possible",{"type":46,"tag":2980,"props":3240,"children":3242},{"id":3241},"examples",[3243],{"type":52,"value":3244},"Examples",{"type":46,"tag":62,"props":3246,"children":3247},{},[3248,3250,3259],{"type":52,"value":3249},"Worked SQL for the common asks — longest-running queries, error analysis, connection auditing, queue-time trends, cross-table joins — is in ",{"type":46,"tag":66,"props":3251,"children":3252},{},[3253],{"type":46,"tag":97,"props":3254,"children":3256},{"className":3255},[],[3257],{"type":52,"value":3258},"${SKILL_DIR}\u002Freferences\u002Fexample-queries.md",{"type":52,"value":3260},". Two rules that apply to every one of them:",{"type":46,"tag":203,"props":3262,"children":3263},{},[3264,3282],{"type":46,"tag":207,"props":3265,"children":3266},{},[3267,3272,3274,3280],{"type":46,"tag":66,"props":3268,"children":3269},{},[3270],{"type":52,"value":3271},"Timing columns are microseconds.",{"type":52,"value":3273}," Divide by 1,000,000 for seconds. Reporting ",{"type":46,"tag":97,"props":3275,"children":3277},{"className":3276},[],[3278],{"type":52,"value":3279},"elapsed_time",{"type":52,"value":3281}," as-is overstates durations by 10^6.",{"type":46,"tag":207,"props":3283,"children":3284},{},[3285,3290,3291,3297,3298,3304,3305,3311],{"type":46,"tag":66,"props":3286,"children":3287},{},[3288],{"type":52,"value":3289},"Filter on the Iceberg partition columns",{"type":52,"value":1110},{"type":46,"tag":97,"props":3292,"children":3294},{"className":3293},[],[3295],{"type":52,"value":3296},"year",{"type":52,"value":595},{"type":46,"tag":97,"props":3299,"children":3301},{"className":3300},[],[3302],{"type":52,"value":3303},"month",{"type":52,"value":595},{"type":46,"tag":97,"props":3306,"children":3308},{"className":3307},[],[3309],{"type":52,"value":3310},"day",{"type":52,"value":3312}," or the table's own partitioning) in addition to any timestamp predicate, or the engine scans the full history.",{"type":46,"tag":694,"props":3314,"children":3316},{"id":3315},"routing-athena-vs-redshift-vs-direct-sys_-access",[3317],{"type":52,"value":3318},"Routing: Athena vs Redshift vs Direct SYS_ Access",{"type":46,"tag":243,"props":3320,"children":3321},{},[3322,3338],{"type":46,"tag":247,"props":3323,"children":3324},{},[3325],{"type":46,"tag":251,"props":3326,"children":3327},{},[3328,3333],{"type":46,"tag":255,"props":3329,"children":3330},{},[3331],{"type":52,"value":3332},"Scenario",{"type":46,"tag":255,"props":3334,"children":3335},{},[3336],{"type":52,"value":3337},"Use",{"type":46,"tag":271,"props":3339,"children":3340},{},[3341,3354,3367,3380,3400],{"type":46,"tag":251,"props":3342,"children":3343},{},[3344,3349],{"type":46,"tag":278,"props":3345,"children":3346},{},[3347],{"type":52,"value":3348},"Historical\u002Fhigh-volume log analysis, no cluster load",{"type":46,"tag":278,"props":3350,"children":3351},{},[3352],{"type":52,"value":3353},"Athena or Redshift on S3 Tables",{"type":46,"tag":251,"props":3355,"children":3356},{},[3357,3362],{"type":46,"tag":278,"props":3358,"children":3359},{},[3360],{"type":52,"value":3361},"Already connected to a Redshift cluster, want to query S3 Tables logs",{"type":46,"tag":278,"props":3363,"children":3364},{},[3365],{"type":52,"value":3366},"Redshift cross-database or external schema",{"type":46,"tag":251,"props":3368,"children":3369},{},[3370,3375],{"type":46,"tag":278,"props":3371,"children":3372},{},[3373],{"type":52,"value":3374},"Join system table logs with other lake data",{"type":46,"tag":278,"props":3376,"children":3377},{},[3378],{"type":52,"value":3379},"Athena or Redshift Spectrum",{"type":46,"tag":251,"props":3381,"children":3382},{},[3383,3388],{"type":46,"tag":278,"props":3384,"children":3385},{},[3386],{"type":52,"value":3387},"Real-time current state of the cluster",{"type":46,"tag":278,"props":3389,"children":3390},{},[3391,3393,3398],{"type":52,"value":3392},"Direct ",{"type":46,"tag":97,"props":3394,"children":3396},{"className":3395},[],[3397],{"type":52,"value":163},{"type":52,"value":3399}," view on the cluster",{"type":46,"tag":251,"props":3401,"children":3402},{},[3403,3408],{"type":46,"tag":278,"props":3404,"children":3405},{},[3406],{"type":52,"value":3407},"Quick ad-hoc query without Redshift cluster access",{"type":46,"tag":278,"props":3409,"children":3410},{},[3411],{"type":52,"value":3412},"Athena",{"type":46,"tag":55,"props":3414,"children":3416},{"id":3415},"key-behaviors",[3417],{"type":52,"value":3418},"Key Behaviors",{"type":46,"tag":203,"props":3420,"children":3421},{},[3422,3432,3468,3478,3488,3505],{"type":46,"tag":207,"props":3423,"children":3424},{},[3425,3430],{"type":46,"tag":66,"props":3426,"children":3427},{},[3428],{"type":52,"value":3429},"No backfill",{"type":52,"value":3431}," — only events recorded after enabling are delivered to S3 Tables",{"type":46,"tag":207,"props":3433,"children":3434},{},[3435,3440,3442,3447,3448,3453,3455,3460,3461,3466],{"type":46,"tag":66,"props":3436,"children":3437},{},[3438],{"type":52,"value":3439},"Namespace from the API",{"type":52,"value":3441}," — always read the namespace from ",{"type":46,"tag":97,"props":3443,"children":3445},{"className":3444},[],[3446],{"type":52,"value":932},{"type":52,"value":1110},{"type":46,"tag":97,"props":3449,"children":3451},{"className":3450},[],[3452],{"type":52,"value":1082},{"type":52,"value":3454},") or ",{"type":46,"tag":97,"props":3456,"children":3458},{"className":3457},[],[3459],{"type":52,"value":945},{"type":52,"value":1110},{"type":46,"tag":97,"props":3462,"children":3464},{"className":3463},[],[3465],{"type":52,"value":2616},{"type":52,"value":3467},"); never construct it manually",{"type":46,"tag":207,"props":3469,"children":3470},{},[3471,3476],{"type":46,"tag":66,"props":3472,"children":3473},{},[3474],{"type":52,"value":3475},"Microsecond timing",{"type":52,"value":3477}," — all duration columns are in microseconds; divide by 1000000.0 for seconds",{"type":46,"tag":207,"props":3479,"children":3480},{},[3481,3486],{"type":46,"tag":66,"props":3482,"children":3483},{},[3484],{"type":52,"value":3485},"Read-only",{"type":52,"value":3487}," — published tables cannot be written to",{"type":46,"tag":207,"props":3489,"children":3490},{},[3491,3496,3498,3503],{"type":46,"tag":66,"props":3492,"children":3493},{},[3494],{"type":52,"value":3495},"Both Provisioned and Serverless",{"type":52,"value":3497}," — same table bucket (",{"type":46,"tag":97,"props":3499,"children":3501},{"className":3500},[],[3502],{"type":52,"value":187},{"type":52,"value":3504},"), different enable APIs",{"type":46,"tag":207,"props":3506,"children":3507},{},[3508,3513],{"type":46,"tag":66,"props":3509,"children":3510},{},[3511],{"type":52,"value":3512},"Any Iceberg-compatible engine",{"type":52,"value":3514}," — query from Athena, Redshift, or any engine that reads Iceberg",{"type":46,"tag":55,"props":3516,"children":3518},{"id":3517},"troubleshooting",[3519],{"type":52,"value":3520},"Troubleshooting",{"type":46,"tag":243,"props":3522,"children":3523},{},[3524,3545],{"type":46,"tag":247,"props":3525,"children":3526},{},[3527],{"type":46,"tag":251,"props":3528,"children":3529},{},[3530,3535,3540],{"type":46,"tag":255,"props":3531,"children":3532},{},[3533],{"type":52,"value":3534},"Error",{"type":46,"tag":255,"props":3536,"children":3537},{},[3538],{"type":52,"value":3539},"Cause",{"type":46,"tag":255,"props":3541,"children":3542},{},[3543],{"type":52,"value":3544},"Fix",{"type":46,"tag":271,"props":3546,"children":3547},{},[3548,3590,3613,3645,3688,3718,3775,3817,3860,3883,3914,3954,3976],{"type":46,"tag":251,"props":3549,"children":3550},{},[3551,3561,3566],{"type":46,"tag":278,"props":3552,"children":3553},{},[3554,3559],{"type":46,"tag":97,"props":3555,"children":3557},{"className":3556},[],[3558],{"type":52,"value":187},{"type":52,"value":3560}," bucket not found",{"type":46,"tag":278,"props":3562,"children":3563},{},[3564],{"type":52,"value":3565},"S3 Tables integration not enabled or logging not started",{"type":46,"tag":278,"props":3567,"children":3568},{},[3569,3571,3576,3577,3582,3584],{"type":52,"value":3570},"Run ",{"type":46,"tag":97,"props":3572,"children":3574},{"className":3573},[],[3575],{"type":52,"value":1691},{"type":52,"value":2610},{"type":46,"tag":97,"props":3578,"children":3580},{"className":3579},[],[3581],{"type":52,"value":1702},{"type":52,"value":3583}," (Serverless) with ",{"type":46,"tag":97,"props":3585,"children":3587},{"className":3586},[],[3588],{"type":52,"value":3589},"--log-destination-type s3table",{"type":46,"tag":251,"props":3591,"children":3592},{},[3593,3603,3608],{"type":46,"tag":278,"props":3594,"children":3595},{},[3596,3601],{"type":46,"tag":97,"props":3597,"children":3599},{"className":3598},[],[3600],{"type":52,"value":2419},{"type":52,"value":3602}," in Athena",{"type":46,"tag":278,"props":3604,"children":3605},{},[3606],{"type":52,"value":3607},"S3 Tables not registered in Glue",{"type":46,"tag":278,"props":3609,"children":3610},{},[3611],{"type":52,"value":3612},"Enable integration: S3 console > Table buckets > Enable integration",{"type":46,"tag":251,"props":3614,"children":3615},{},[3616,3621,3626],{"type":46,"tag":278,"props":3617,"children":3618},{},[3619],{"type":52,"value":3620},"Athena table empty after enabling",{"type":46,"tag":278,"props":3622,"children":3623},{},[3624],{"type":52,"value":3625},"Ingestion still in flight",{"type":46,"tag":278,"props":3627,"children":3628},{},[3629,3631,3636,3638,3643],{"type":52,"value":3630},"Check ",{"type":46,"tag":97,"props":3632,"children":3634},{"className":3633},[],[3635],{"type":52,"value":1246},{"type":52,"value":3637}," (Provisioned) \u002F ",{"type":46,"tag":97,"props":3639,"children":3641},{"className":3640},[],[3642],{"type":52,"value":1253},{"type":52,"value":3644}," (Serverless); wait and re-query",{"type":46,"tag":251,"props":3646,"children":3647},{},[3648,3658,3663],{"type":46,"tag":278,"props":3649,"children":3650},{},[3651,3656],{"type":46,"tag":97,"props":3652,"children":3654},{"className":3653},[],[3655],{"type":52,"value":102},{"type":52,"value":3657}," table missing from the namespace",{"type":46,"tag":278,"props":3659,"children":3660},{},[3661],{"type":52,"value":3662},"System table not included when enabling",{"type":46,"tag":278,"props":3664,"children":3665},{},[3666,3668,3673,3674,3679,3681,3686],{"type":52,"value":3667},"Re-run enable with that table included, or use ",{"type":46,"tag":97,"props":3669,"children":3671},{"className":3670},[],[3672],{"type":52,"value":1942},{"type":52,"value":2708},{"type":46,"tag":97,"props":3675,"children":3677},{"className":3676},[],[3678],{"type":52,"value":678},{"type":52,"value":3680}," (Provisioned), ",{"type":46,"tag":97,"props":3682,"children":3684},{"className":3683},[],[3685],{"type":52,"value":1731},{"type":52,"value":3687}," (Serverless)",{"type":46,"tag":251,"props":3689,"children":3690},{},[3691,3696,3701],{"type":46,"tag":278,"props":3692,"children":3693},{},[3694],{"type":52,"value":3695},"Wrong \u002F empty namespace",{"type":46,"tag":278,"props":3697,"children":3698},{},[3699],{"type":52,"value":3700},"Namespace constructed instead of read from API",{"type":46,"tag":278,"props":3702,"children":3703},{},[3704,3706,3711,3712,3717],{"type":52,"value":3705},"Use the namespace from the describe\u002Fget response — ",{"type":46,"tag":97,"props":3707,"children":3709},{"className":3708},[],[3710],{"type":52,"value":1082},{"type":52,"value":2610},{"type":46,"tag":97,"props":3713,"children":3715},{"className":3714},[],[3716],{"type":52,"value":2616},{"type":52,"value":3687},{"type":46,"tag":251,"props":3719,"children":3720},{},[3721,3739,3751],{"type":46,"tag":278,"props":3722,"children":3723},{},[3724,3726,3731,3732,3737],{"type":52,"value":3725},"Status response has no ",{"type":46,"tag":97,"props":3727,"children":3729},{"className":3728},[],[3730],{"type":52,"value":897},{"type":52,"value":536},{"type":46,"tag":97,"props":3733,"children":3735},{"className":3734},[],[3736],{"type":52,"value":986},{"type":52,"value":3738}," field at all, even though publishing is on",{"type":46,"tag":278,"props":3740,"children":3741},{},[3742,3744,3749],{"type":52,"value":3743},"Outdated AWS CLI \u002F SDK. The field is ",{"type":46,"tag":66,"props":3745,"children":3746},{},[3747],{"type":52,"value":3748},"silently omitted",{"type":52,"value":3750}," rather than raising an error, so this looks identical to the feature being disabled",{"type":46,"tag":278,"props":3752,"children":3753},{},[3754,3756,3761,3763,3768,3770],{"type":52,"value":3755},"Upgrade the CLI\u002FSDK, then re-run. Confirm publishing is actually off before acting on the absence — check the ",{"type":46,"tag":97,"props":3757,"children":3759},{"className":3758},[],[3760],{"type":52,"value":187},{"type":52,"value":3762}," table bucket for the namespace, or that ",{"type":46,"tag":97,"props":3764,"children":3766},{"className":3765},[],[3767],{"type":52,"value":1004},{"type":52,"value":3769}," includes ",{"type":46,"tag":97,"props":3771,"children":3773},{"className":3772},[],[3774],{"type":52,"value":1012},{"type":46,"tag":251,"props":3776,"children":3777},{},[3778,3789,3799],{"type":46,"tag":278,"props":3779,"children":3780},{},[3781,3787],{"type":46,"tag":97,"props":3782,"children":3784},{"className":3783},[],[3785],{"type":52,"value":3786},"Unknown options: --log-exports, --log-export-action",{"type":52,"value":3788}," on Serverless",{"type":46,"tag":278,"props":3790,"children":3791},{},[3792,3794],{"type":52,"value":3793},"Provisioned flag names used against ",{"type":46,"tag":97,"props":3795,"children":3797},{"className":3796},[],[3798],{"type":52,"value":1702},{"type":46,"tag":278,"props":3800,"children":3801},{},[3802,3803,3808,3809,3815],{"type":52,"value":1936},{"type":46,"tag":97,"props":3804,"children":3806},{"className":3805},[],[3807],{"type":52,"value":1731},{"type":52,"value":174},{"type":46,"tag":97,"props":3810,"children":3812},{"className":3811},[],[3813],{"type":52,"value":3814},"--s3-table-action",{"type":52,"value":3816}," — see the flag table in the Enable section",{"type":46,"tag":251,"props":3818,"children":3819},{},[3820,3831,3849],{"type":46,"tag":278,"props":3821,"children":3822},{},[3823,3829],{"type":46,"tag":97,"props":3824,"children":3826},{"className":3825},[],[3827],{"type":52,"value":3828},"AccessDenied",{"type":52,"value":3830}," querying the table",{"type":46,"tag":278,"props":3832,"children":3833},{},[3834,3836,3842,3843],{"type":52,"value":3835},"Missing ",{"type":46,"tag":97,"props":3837,"children":3839},{"className":3838},[],[3840],{"type":52,"value":3841},"s3tables:GetTable",{"type":52,"value":3148},{"type":46,"tag":97,"props":3844,"children":3846},{"className":3845},[],[3847],{"type":52,"value":3848},"GetTableData",{"type":46,"tag":278,"props":3850,"children":3851},{},[3852,3854],{"type":52,"value":3853},"See ",{"type":46,"tag":97,"props":3855,"children":3857},{"className":3856},[],[3858],{"type":52,"value":3859},"references\u002Fsecurity.md",{"type":46,"tag":251,"props":3861,"children":3862},{},[3863,3873,3878],{"type":46,"tag":278,"props":3864,"children":3865},{},[3866,3868],{"type":52,"value":3867},"Empty results from ",{"type":46,"tag":97,"props":3869,"children":3871},{"className":3870},[],[3872],{"type":52,"value":126},{"type":46,"tag":278,"props":3874,"children":3875},{},[3876],{"type":52,"value":3877},"Querying identity lacks visibility",{"type":46,"tag":278,"props":3879,"children":3880},{},[3881],{"type":52,"value":3882},"Use an identity with superuser-level access",{"type":46,"tag":251,"props":3884,"children":3885},{},[3886,3896,3901],{"type":46,"tag":278,"props":3887,"children":3888},{},[3889,3891],{"type":52,"value":3890},"Catalog doesn't appear in ",{"type":46,"tag":97,"props":3892,"children":3894},{"className":3893},[],[3895],{"type":52,"value":2570},{"type":46,"tag":278,"props":3897,"children":3898},{},[3899],{"type":52,"value":3900},"LF resource not registered, or SLRs not ReadOnlyAdmins",{"type":46,"tag":278,"props":3902,"children":3903},{},[3904,3906,3912],{"type":52,"value":3905},"Complete the Lake Formation steps in ",{"type":46,"tag":97,"props":3907,"children":3909},{"className":3908},[],[3910],{"type":52,"value":3911},"references\u002Fpermissions-setup.md",{"type":52,"value":3913},", wait 5 min or reboot",{"type":46,"tag":251,"props":3915,"children":3916},{},[3917,3922,3944],{"type":46,"tag":278,"props":3918,"children":3919},{},[3920],{"type":52,"value":3921},"\"Unable to assume role\" from Glue",{"type":46,"tag":278,"props":3923,"children":3924},{},[3925,3926,3931,3932,3937,3939],{"type":52,"value":3835},{"type":46,"tag":97,"props":3927,"children":3929},{"className":3928},[],[3930],{"type":52,"value":2493},{"type":52,"value":595},{"type":46,"tag":97,"props":3933,"children":3935},{"className":3934},[],[3936],{"type":52,"value":2500},{"type":52,"value":3938}," in trust policy, or missing ",{"type":46,"tag":97,"props":3940,"children":3942},{"className":3941},[],[3943],{"type":52,"value":2550},{"type":46,"tag":278,"props":3945,"children":3946},{},[3947,3949],{"type":52,"value":3948},"Fix trust policy and attach ",{"type":46,"tag":97,"props":3950,"children":3952},{"className":3951},[],[3953],{"type":52,"value":2550},{"type":46,"tag":251,"props":3955,"children":3956},{},[3957,3966,3971],{"type":46,"tag":278,"props":3958,"children":3959},{},[3960],{"type":46,"tag":97,"props":3961,"children":3963},{"className":3962},[],[3964],{"type":52,"value":3965},"VerificationStatus: NOT_VERIFIED",{"type":46,"tag":278,"props":3967,"children":3968},{},[3969],{"type":52,"value":3970},"Normal after Lake Formation registration",{"type":46,"tag":278,"props":3972,"children":3973},{},[3974],{"type":52,"value":3975},"No action needed if queries work",{"type":46,"tag":251,"props":3977,"children":3978},{},[3979,3984,3989],{"type":46,"tag":278,"props":3980,"children":3981},{},[3982],{"type":52,"value":3983},"Query fails with \"does not exist\" in Redshift",{"type":46,"tag":278,"props":3985,"children":3986},{},[3987],{"type":52,"value":3988},"Catalog not yet auto-mounted (poll delay)",{"type":46,"tag":278,"props":3990,"children":3991},{},[3992],{"type":52,"value":3993},"Wait up to 300s or reboot cluster",{"type":46,"tag":55,"props":3995,"children":3997},{"id":3996},"security-considerations",[3998],{"type":52,"value":2015},{"type":46,"tag":62,"props":4000,"children":4001},{},[4002,4004,4012],{"type":52,"value":4003},"Full policies, key policy, and detection setup: ",{"type":46,"tag":66,"props":4005,"children":4006},{},[4007],{"type":46,"tag":97,"props":4008,"children":4010},{"className":4009},[],[4011],{"type":52,"value":2023},{"type":52,"value":4013},". Read it before granting access. The non-negotiables:",{"type":46,"tag":203,"props":4015,"children":4016},{},[4017,4073,4097,4127],{"type":46,"tag":207,"props":4018,"children":4019},{},[4020,4025,4027,4032,4034,4040,4042,4048,4050,4056,4058,4064,4065,4071],{"type":46,"tag":66,"props":4021,"children":4022},{},[4023],{"type":52,"value":4024},"Scope IAM to the S3 Tables catalog",{"type":52,"value":4026},", not wildcards. Glue database\u002Ftable ARNs nest under ",{"type":46,"tag":97,"props":4028,"children":4030},{"className":4029},[],[4031],{"type":52,"value":2327},{"type":52,"value":4033}," — the bare ",{"type":46,"tag":97,"props":4035,"children":4037},{"className":4036},[],[4038],{"type":52,"value":4039},"database\u002F*",{"type":52,"value":4041}," form grants metadata read on the whole account. ",{"type":46,"tag":97,"props":4043,"children":4045},{"className":4044},[],[4046],{"type":52,"value":4047},"lakeformation:GetDataAccess",{"type":52,"value":4049}," is the one action that must use ",{"type":46,"tag":97,"props":4051,"children":4053},{"className":4052},[],[4054],{"type":52,"value":4055},"\"Resource\": \"*\"",{"type":52,"value":4057},"; constrain it with an ",{"type":46,"tag":97,"props":4059,"children":4061},{"className":4060},[],[4062],{"type":52,"value":4063},"aws:ResourceAccount",{"type":52,"value":425},{"type":46,"tag":97,"props":4066,"children":4068},{"className":4067},[],[4069],{"type":52,"value":4070},"StringEquals",{"type":52,"value":4072}," condition.",{"type":46,"tag":207,"props":4074,"children":4075},{},[4076,4081,4083,4088,4090,4095],{"type":46,"tag":66,"props":4077,"children":4078},{},[4079],{"type":52,"value":4080},"The KMS key policy needs two principals",{"type":52,"value":4082},", not one: ",{"type":46,"tag":97,"props":4084,"children":4086},{"className":4085},[],[4087],{"type":52,"value":2038},{"type":52,"value":4089}," (publisher) and ",{"type":46,"tag":97,"props":4091,"children":4093},{"className":4092},[],[4094],{"type":52,"value":2046},{"type":52,"value":4096}," (compaction). Granting only the publisher lets writes succeed while compaction silently fails.",{"type":46,"tag":207,"props":4098,"children":4099},{},[4100,4110,4112,4118,4120,4125],{"type":46,"tag":66,"props":4101,"children":4102},{},[4103,4108],{"type":46,"tag":97,"props":4104,"children":4106},{"className":4105},[],[4107],{"type":52,"value":1636},{"type":52,"value":4109}," can contain credentials",{"type":52,"value":4111},", not just schema — interpolated SQL and ",{"type":46,"tag":97,"props":4113,"children":4115},{"className":4114},[],[4116],{"type":52,"value":4117},"CREATE USER ... PASSWORD",{"type":52,"value":4119}," land verbatim in ",{"type":46,"tag":97,"props":4121,"children":4123},{"className":4122},[],[4124],{"type":52,"value":110},{"type":52,"value":4126},". Treat broad access to that table as a secrets-exposure decision; restrict the column with Lake Formation.",{"type":46,"tag":207,"props":4128,"children":4129},{},[4130,4135,4136,4142,4143,4148,4150,4155],{"type":46,"tag":66,"props":4131,"children":4132},{},[4133],{"type":52,"value":4134},"Publishing is itself auditable and worth alarming on.",{"type":52,"value":425},{"type":46,"tag":97,"props":4137,"children":4139},{"className":4138},[],[4140],{"type":52,"value":4141},"s3tables.amazonaws.com",{"type":52,"value":425},{"type":46,"tag":97,"props":4144,"children":4146},{"className":4145},[],[4147],{"type":52,"value":3828},{"type":52,"value":4149}," spikes and ",{"type":46,"tag":97,"props":4151,"children":4153},{"className":4152},[],[4154],{"type":52,"value":126},{"type":52,"value":4156}," failed-auth counts are the two signals to alert on; encrypt the alarm topic with a customer-managed key.",{"type":46,"tag":55,"props":4158,"children":4160},{"id":4159},"reference-files",[4161],{"type":52,"value":4162},"Reference Files",{"type":46,"tag":62,"props":4164,"children":4165},{},[4166,4172],{"type":46,"tag":97,"props":4167,"children":4169},{"className":4168},[],[4170],{"type":52,"value":4171},"${SKILL_DIR}",{"type":52,"value":4173}," is the absolute path of the directory containing this SKILL.md. Load these on demand; do not read them all up front.",{"type":46,"tag":243,"props":4175,"children":4176},{},[4177,4198],{"type":46,"tag":247,"props":4178,"children":4179},{},[4180],{"type":46,"tag":251,"props":4181,"children":4182},{},[4183,4188,4193],{"type":46,"tag":255,"props":4184,"children":4185},{},[4186],{"type":52,"value":4187},"File",{"type":46,"tag":255,"props":4189,"children":4190},{},[4191],{"type":52,"value":4192},"What it covers",{"type":46,"tag":255,"props":4194,"children":4195},{},[4196],{"type":52,"value":4197},"When to load",{"type":46,"tag":271,"props":4199,"children":4200},{},[4201,4244,4272],{"type":46,"tag":251,"props":4202,"children":4203},{},[4204,4212,4239],{"type":46,"tag":278,"props":4205,"children":4206},{},[4207],{"type":46,"tag":97,"props":4208,"children":4210},{"className":4209},[],[4211],{"type":52,"value":2309},{"type":46,"tag":278,"props":4213,"children":4214},{},[4215,4217,4223,4224,4230,4232,4237],{"type":52,"value":4216},"Athena prerequisites and workgroup encryption; the full Redshift auto-mount path — IAM role trust\u002Finline policies, Lake Formation ",{"type":46,"tag":97,"props":4218,"children":4220},{"className":4219},[],[4221],{"type":52,"value":4222},"register-resource",{"type":52,"value":112},{"type":46,"tag":97,"props":4225,"children":4227},{"className":4226},[],[4228],{"type":52,"value":4229},"put-data-lake-settings",{"type":52,"value":4231},", the SLR ",{"type":46,"tag":97,"props":4233,"children":4235},{"className":4234},[],[4236],{"type":52,"value":2515},{"type":52,"value":4238}," step, and the 300s auto-mount poll",{"type":46,"tag":278,"props":4240,"children":4241},{},[4242],{"type":52,"value":4243},"Before running any IAM or Lake Formation setup",{"type":46,"tag":251,"props":4245,"children":4246},{},[4247,4255,4267],{"type":46,"tag":278,"props":4248,"children":4249},{},[4250],{"type":46,"tag":97,"props":4251,"children":4253},{"className":4252},[],[4254],{"type":52,"value":3258},{"type":46,"tag":278,"props":4256,"children":4257},{},[4258,4260,4266],{"type":52,"value":4259},"Worked SQL for longest-running queries, error analysis, connection auditing, queue-time trends, and joins across ",{"type":46,"tag":97,"props":4261,"children":4263},{"className":4262},[],[4264],{"type":52,"value":4265},"sys_*",{"type":52,"value":1042},{"type":46,"tag":278,"props":4268,"children":4269},{},[4270],{"type":52,"value":4271},"When writing queries against the published tables",{"type":46,"tag":251,"props":4273,"children":4274},{},[4275,4283,4295],{"type":46,"tag":278,"props":4276,"children":4277},{},[4278],{"type":46,"tag":97,"props":4279,"children":4281},{"className":4280},[],[4282],{"type":52,"value":2023},{"type":46,"tag":278,"props":4284,"children":4285},{},[4286,4288,4293],{"type":52,"value":4287},"Full least-privilege policy, KMS key policy with both service principals, ",{"type":46,"tag":97,"props":4289,"children":4291},{"className":4290},[],[4292],{"type":52,"value":1636},{"type":52,"value":4294}," sensitivity, CloudTrail\u002Fmetric-filter detection",{"type":46,"tag":278,"props":4296,"children":4297},{},[4298],{"type":52,"value":4299},"Before granting access, or when hardening an existing setup",{"type":46,"tag":55,"props":4301,"children":4303},{"id":4302},"additional-resources",[4304],{"type":52,"value":4305},"Additional Resources",{"type":46,"tag":203,"props":4307,"children":4308},{},[4309,4319,4329],{"type":46,"tag":207,"props":4310,"children":4311},{},[4312],{"type":46,"tag":74,"props":4313,"children":4316},{"href":4314,"rel":4315},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002Fs3-tables-integrating-aws.html",[78],[4317],{"type":52,"value":4318},"Integrating S3 Tables with AWS analytics services",{"type":46,"tag":207,"props":4320,"children":4321},{},[4322],{"type":46,"tag":74,"props":4323,"children":4326},{"href":4324,"rel":4325},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fredshift\u002Flatest\u002Fdg\u002Fserverless_views-monitoring.html",[78],[4327],{"type":52,"value":4328},"Redshift System Tables",{"type":46,"tag":207,"props":4330,"children":4331},{},[4332],{"type":46,"tag":74,"props":4333,"children":4336},{"href":4334,"rel":4335},"https:\u002F\u002Fdocs.aws.amazon.com\u002Flake-formation\u002Flatest\u002Fdg\u002Fgranting-catalog-permissions.html",[78],[4337],{"type":52,"value":4338},"Lake Formation permissions",{"type":46,"tag":62,"props":4340,"children":4341},{},[4342],{"type":52,"value":4343},"Security best practices:",{"type":46,"tag":203,"props":4345,"children":4346},{},[4347,4357,4375,4385],{"type":46,"tag":207,"props":4348,"children":4349},{},[4350],{"type":46,"tag":74,"props":4351,"children":4354},{"href":4352,"rel":4353},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fredshift\u002Flatest\u002Fmgmt\u002Fsecurity-best-practices.html",[78],[4355],{"type":52,"value":4356},"Amazon Redshift security best practices",{"type":46,"tag":207,"props":4358,"children":4359},{},[4360,4367,4368],{"type":46,"tag":74,"props":4361,"children":4364},{"href":4362,"rel":4363},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002Fs3-tables-security.html",[78],[4365],{"type":52,"value":4366},"S3 Tables security",{"type":52,"value":174},{"type":46,"tag":74,"props":4369,"children":4372},{"href":4370,"rel":4371},"https:\u002F\u002Fdocs.aws.amazon.com\u002FAmazonS3\u002Flatest\u002Fuserguide\u002Fs3-tables-permissions.html",[78],[4373],{"type":52,"value":4374},"access management for S3 Tables",{"type":46,"tag":207,"props":4376,"children":4377},{},[4378],{"type":46,"tag":74,"props":4379,"children":4382},{"href":4380,"rel":4381},"https:\u002F\u002Fdocs.aws.amazon.com\u002FIAM\u002Flatest\u002FUserGuide\u002Fbest-practices.html",[78],[4383],{"type":52,"value":4384},"IAM security best practices",{"type":46,"tag":207,"props":4386,"children":4387},{},[4388,4395,4397,4402,4404],{"type":46,"tag":74,"props":4389,"children":4392},{"href":4390,"rel":4391},"https:\u002F\u002Fdocs.aws.amazon.com\u002Flake-formation\u002Flatest\u002Fdg\u002Faccess-control-underlying-data.html",[78],[4393],{"type":52,"value":4394},"Lake Formation underlying data access control",{"type":52,"value":4396}," — why ",{"type":46,"tag":97,"props":4398,"children":4400},{"className":4399},[],[4401],{"type":52,"value":4047},{"type":52,"value":4403}," requires ",{"type":46,"tag":97,"props":4405,"children":4407},{"className":4406},[],[4408],{"type":52,"value":4055},{"type":46,"tag":4410,"props":4411,"children":4412},"style",{},[4413],{"type":52,"value":4414},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":4416,"total":4588},[4417,4434,4449,4464,4479,4489,4504,4520,4534,4549,4562,4574],{"slug":4418,"name":4418,"fn":4419,"description":4420,"org":4421,"tags":4422,"stars":27,"repoUrl":28,"updatedAt":4433},"agents-build","add capabilities to existing agent projects","Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments, or resource removal. Triggers: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"agent auth\", \"streaming\", \"VPC\", \"VPC connectivity\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"migration issue\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"add payments capability to my agent\", \"wire payments plugin\", \"integrate x402 payments with the agent I'm building\", \"add MPP payments\", \"Machine Payments Protocol\". External APIs via Gateway: use agents-connect. New project: use agents-get-started. CLI\u002Fdev-server errors: use agents-debug. Runtime x402\u002FMPP payments: use agents-pay. Migration-specific Strands vs LangGraph routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4423,4426,4429,4430],{"name":4424,"slug":4425,"type":15},"Agents","agents",{"name":4427,"slug":4428,"type":15},"Automation","automation",{"name":26,"slug":8,"type":15},{"name":4431,"slug":4432,"type":15},"Engineering","engineering","2026-08-20T03:27:06.137661",{"slug":4435,"name":4435,"fn":4436,"description":4437,"org":4438,"tags":4439,"stars":27,"repoUrl":28,"updatedAt":4448},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4440,4441,4444,4447],{"name":4424,"slug":4425,"type":15},{"name":4442,"slug":4443,"type":15},"API Development","api-development",{"name":4445,"slug":4446,"type":15},"Authentication","authentication",{"name":26,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":4450,"name":4450,"fn":4451,"description":4452,"org":4453,"tags":4454,"stars":27,"repoUrl":28,"updatedAt":4463},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4455,4456,4457,4460],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4458,"slug":4459,"type":15},"Debugging","debugging",{"name":4461,"slug":4462,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":4465,"name":4465,"fn":4466,"description":4467,"org":4468,"tags":4469,"stars":27,"repoUrl":28,"updatedAt":4478},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4470,4471,4472,4475],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4473,"slug":4474,"type":15},"CI\u002FCD","ci-cd",{"name":4476,"slug":4477,"type":15},"Deployment","deployment","2026-07-12T08:42:55.059577",{"slug":4480,"name":4480,"fn":4481,"description":4482,"org":4483,"tags":4484,"stars":27,"repoUrl":28,"updatedAt":4488},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4485,4486,4487],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4476,"slug":4477,"type":15},"2026-07-12T08:42:51.963247",{"slug":4490,"name":4490,"fn":4491,"description":4492,"org":4493,"tags":4494,"stars":27,"repoUrl":28,"updatedAt":4503},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4495,4496,4497,4500],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4498,"slug":4499,"type":15},"Best Practices","best-practices",{"name":4501,"slug":4502,"type":15},"Security","security","2026-07-16T06:00:42.174705",{"slug":4505,"name":4505,"fn":4506,"description":4507,"org":4508,"tags":4509,"stars":27,"repoUrl":28,"updatedAt":4519},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4510,4511,4512,4515,4516],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4513,"slug":4514,"type":15},"Evals","evals",{"name":4461,"slug":4462,"type":15},{"name":4517,"slug":4518,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",{"slug":4521,"name":4521,"fn":4522,"description":4523,"org":4524,"tags":4525,"stars":27,"repoUrl":28,"updatedAt":4533},"agents-pay","handle x402 payments for agent tasks","Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments, and applying operator-defined spend limits. Covers payment setup, policy, session budgets, and troubleshooting. Triggers on: \"my agent hit a 402 while calling an API\", \"a tool call returned 402 Payment Required\", \"my agent needs to pay for x402-protected content\", \"let the agent pay for content, capped at $5 per session\", \"set a spend limit for the agent\", \"ProcessPayment failed\", or \"why did my agent refuse to pay\". Not for BUILDING payment capability for end users, including wallets and framework middleware; use agents-build and references\u002Fpayments.md. For non-paid APIs via Gateway use agents-connect. For inbound auth use agents-harden. For project scaffolding use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4526,4527,4528,4531],{"name":4424,"slug":4425,"type":15},{"name":4427,"slug":4428,"type":15},{"name":4529,"slug":4530,"type":15},"Payments","payments",{"name":4532,"slug":4532,"type":15},"x402","2026-08-10T04:16:31.844309",{"slug":4535,"name":4535,"fn":4536,"description":4537,"org":4538,"tags":4539,"stars":27,"repoUrl":28,"updatedAt":4548},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4540,4541,4542,4545],{"name":26,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":4543,"slug":4544,"type":15},"MySQL","mysql",{"name":4546,"slug":4547,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":4550,"name":4550,"fn":4551,"description":4552,"org":4553,"tags":4554,"stars":27,"repoUrl":28,"updatedAt":4561},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4555,4556,4557,4560],{"name":26,"slug":8,"type":15},{"name":20,"slug":21,"type":15},{"name":4558,"slug":4559,"type":15},"PostgreSQL","postgresql",{"name":4546,"slug":4547,"type":15},"2026-07-16T06:00:34.789624",{"slug":4563,"name":4563,"fn":4564,"description":4565,"org":4566,"tags":4567,"stars":27,"repoUrl":28,"updatedAt":4573},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore (including the Harness managed agent loop). Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching, quota health checks and throttling diagnosis, cost attribution, migrating between Claude model generations, chunking strategies, API selection (Converse vs InvokeModel), and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Coinbase CDP, Stripe Privy, 402 Payment Required, paid endpoint). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4568,4569,4570],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4571,"slug":4572,"type":15},"LLM","llm","2026-08-07T04:38:13.03499",{"slug":4575,"name":4575,"fn":4576,"description":4577,"org":4578,"tags":4579,"stars":27,"repoUrl":28,"updatedAt":4587},"amazon-braket","run quantum computing workflows on AWS","Runs quantum computing workflows on AWS through Amazon Braket — discovering devices (QPUs and simulators) and their availability, building gate-model circuits and analog Hamiltonian programs, submitting quantum tasks, program sets and hybrid jobs, looking up prices, and capping spend with spending limits. Applies to any request about quantum computing, quantum hardware, quantum simulation, AHS, OpenQASM, or running a quantum algorithm on AWS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4580,4581,4584],{"name":26,"slug":8,"type":15},{"name":4582,"slug":4583,"type":15},"Quantum Computing","quantum-computing",{"name":4585,"slug":4586,"type":15},"Simulation","simulation","2026-08-20T03:53:19.377174",139,{"items":4590,"total":4640},[4591,4598,4605,4612,4619,4625,4632],{"slug":4418,"name":4418,"fn":4419,"description":4420,"org":4592,"tags":4593,"stars":27,"repoUrl":28,"updatedAt":4433},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4594,4595,4596,4597],{"name":4424,"slug":4425,"type":15},{"name":4427,"slug":4428,"type":15},{"name":26,"slug":8,"type":15},{"name":4431,"slug":4432,"type":15},{"slug":4435,"name":4435,"fn":4436,"description":4437,"org":4599,"tags":4600,"stars":27,"repoUrl":28,"updatedAt":4448},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4601,4602,4603,4604],{"name":4424,"slug":4425,"type":15},{"name":4442,"slug":4443,"type":15},{"name":4445,"slug":4446,"type":15},{"name":26,"slug":8,"type":15},{"slug":4450,"name":4450,"fn":4451,"description":4452,"org":4606,"tags":4607,"stars":27,"repoUrl":28,"updatedAt":4463},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4608,4609,4610,4611],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4458,"slug":4459,"type":15},{"name":4461,"slug":4462,"type":15},{"slug":4465,"name":4465,"fn":4466,"description":4467,"org":4613,"tags":4614,"stars":27,"repoUrl":28,"updatedAt":4478},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4615,4616,4617,4618],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4473,"slug":4474,"type":15},{"name":4476,"slug":4477,"type":15},{"slug":4480,"name":4480,"fn":4481,"description":4482,"org":4620,"tags":4621,"stars":27,"repoUrl":28,"updatedAt":4488},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4622,4623,4624],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4476,"slug":4477,"type":15},{"slug":4490,"name":4490,"fn":4491,"description":4492,"org":4626,"tags":4627,"stars":27,"repoUrl":28,"updatedAt":4503},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4628,4629,4630,4631],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4498,"slug":4499,"type":15},{"name":4501,"slug":4502,"type":15},{"slug":4505,"name":4505,"fn":4506,"description":4507,"org":4633,"tags":4634,"stars":27,"repoUrl":28,"updatedAt":4519},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[4635,4636,4637,4638,4639],{"name":4424,"slug":4425,"type":15},{"name":26,"slug":8,"type":15},{"name":4513,"slug":4514,"type":15},{"name":4461,"slug":4462,"type":15},{"name":4517,"slug":4518,"type":15},122]