Watadot Aws Cloudwatch

Observability and monitoring by Watadot Studio. Log tailing and metric extraction.

Security Scan

Instruction-only AWS CloudWatch helper that is internally consistent: it only expects the aws CLI and contains example read-focused CloudWatch commands; no unexpected installs or unrelated credentials are requested.

Purpose & Capability

Name/description (CloudWatch observability, log tailing, metrics) match the SKILL.md commands (aws logs, aws cloudwatch). Requesting the aws CLI is appropriate for this purpose.

Instruction Scope

SKILL.md is narrowly scoped to specific aws CLI commands for tailing logs, filtering events, listing alarms/dashboards, and fetching metrics. It does not instruct the agent to read arbitrary local files or send data to external endpoints. Note: the skill does not declare credentials but will use whatever AWS credentials the environment provides when running the aws CLI.

Install Mechanism

No install spec and no code files — lowest-risk instruction-only skill. It relies on an existing aws binary and does not download or execute external code.

Credentials

The skill declares no required env vars or credentials, which is reasonable for an instruction-only AWS helper. However, the aws CLI uses AWS credentials from environment or config (~/.aws). Users should be aware the agent will run aws commands under whatever AWS identity is available.

Persistence & Privilege

always:false and default model invocation settings — no elevated persistence. The skill does not request system-wide changes or modify other skills.

Assessment

This skill is instruction-only and simply provides aws CLI examples for CloudWatch. Before enabling it: ensure the agent environment has the aws CLI installed and that any AWS credentials available to the agent follow least-privilege (read-only for logging/metrics if possible). Remember the skill will run commands using whatever AWS identity is configured (even though it doesn't declare creds explicitly). If you run agents autonomously, be cautious about granting them wide AWS permissions. Also note small portability issues (e.g., date -d usage may not work on macOS) but these are operational, not security-related.

AWS CloudWatch Skills

Observability and automated monitoring patterns.

🚀 Core Commands

Log Insights

# Live tail of a Log Group
aws logs tail /aws/lambda/<function-name> --follow

# Query logs for errors (last 1h)
aws logs filter-log-events --log-group-name <name> --filter-pattern "ERROR" --start-time $(date -d '1 hour ago' +%s000) --query "events[].message"

Metrics & Alarms

# List active alarms with state
aws cloudwatch describe-alarms --query "MetricAlarms[?StateValue==\`ALARM\`].{Name:AlarmName,Reason:StateReason}" --output table

# Get CPU utilization metric for EC2
aws cloudwatch get-metric-statistics --namespace AWS/EC2 --metric-name CPUUtilization --dimensions Name=InstanceId,Value=<id> --period 3600 --statistics Average --start-time 2026-03-15T00:00:00 --end-time 2026-03-16T00:00:00

Dashboard Orchestration

# List dashboard names
aws cloudwatch list-dashboards --query "DashboardEntries[].DashboardName"

🧠 Best Practices

1. Retention Policies: Don't keep logs forever. Set retention (e.g., 14 days) to save storage costs.
2. Log Streams: Use unique log stream names for different agent instances to avoid interleaving.
3. Structured Logging: Log in JSON format to make filtering and automated analysis via OpenClaw easier.
4. Alarms: Set up billing alarms to catch sudden spikes in AWS usage early.