$npx -y skills add aws/agent-toolkit-for-aws --skill querying-data-lakeExecute and manage Athena SQL queries across default and federated catalogs (Glue, S3 Tables, Redshift). Triggers on phrases like: query data, run SQL, athena query, analyze table, SQL query, workgroup status, profile table, query Redshift catalog, query S3 Tables. Do NOT use for
| 1 | # Query Data Lake |
| 2 | |
| 3 | Execute SQL queries on Amazon Athena across default and federated catalogs (Glue, S3 Tables, Redshift) with workgroup selection, statement classification, and error recovery. |
| 4 | |
| 5 | ## Overview |
| 6 | |
| 7 | Executes and manages Athena SQL queries across default and federated catalogs. Selects a workgroup, resolves target assets (delegating fuzzy references to `finding-data-lake-assets`), classifies statements for safety, and reports cost and data scanned. Use the AWS MCP server for sandboxed execution and audit logging; the same AWS CLI commands work directly when the MCP server is not available. |
| 8 | |
| 9 | **Constraints for parameter acquisition:** |
| 10 | |
| 11 | - You MUST accept a single optional argument: SQL text, a named-query name, a workgroup name, a catalog name, or `profile TABLE_NAME` |
| 12 | - You MUST accept the argument as direct text or a pointer to a file containing SQL |
| 13 | - You MUST ask the user for the target AWS region if not already set |
| 14 | - You MUST confirm the output S3 location before executing any non-trivial query |
| 15 | - You MUST respect the user's decision to abort at any step |
| 16 | |
| 17 | ## Common Tasks |
| 18 | |
| 19 | ### 1. Verify Dependencies |
| 20 | |
| 21 | Check for required tools and AWS access before running queries. |
| 22 | |
| 23 | **Constraints:** |
| 24 | |
| 25 | - You MUST verify AWS MCP server tools are available (`aws___call_aws`) and run queries through them when present; fall back to AWS CLI only if the MCP server is unavailable |
| 26 | - You MUST NOT fall back to shell or Bash for query execution — results must be captured via the MCP tool or `aws athena` CLI so output location and cost are tracked |
| 27 | - You MUST confirm credentials with `aws sts get-caller-identity` and inform the user about any missing tools |
| 28 | |
| 29 | ### 2. Resolve Workgroup |
| 30 | |
| 31 | Check caller identity, list workgroups, auto-select the best one (see [workgroup-selection.md](references/workgroup-selection.md)). |
| 32 | |
| 33 | **Constraints:** |
| 34 | |
| 35 | - You MUST select a workgroup before submitting any query (prevents output-location errors) |
| 36 | - You MUST present the selected workgroup and its output location to the user |
| 37 | - You MUST NOT auto-escalate to a different workgroup on failure without user confirmation |
| 38 | |
| 39 | ### 3. Resolve the Target Asset |
| 40 | |
| 41 | If the user refers to a table by name, by business concept ("our quarterly report", "the sales data"), by S3 path, or by catalog without specifying the table, delegate to `finding-data-lake-assets` to return the concrete `database.table` (and catalog if non-default). |
| 42 | |
| 43 | **Constraints:** |
| 44 | |
| 45 | - You MUST NOT attempt to resolve fuzzy asset references with `athena list-data-catalogs` or by iterating `get-tables` — those miss federated catalogs and waste tokens |
| 46 | - You SHOULD skip this step only when the user provides a fully-qualified reference (exact `database.table`) or raw SQL they want executed as-is |
| 47 | - You MUST state the resolved asset explicitly before building the query: "Found [table] in [catalog]. Using this for the query." |
| 48 | - You SHOULD default to the default Glue catalog unless the user mentions "federated", "Redshift", "S3 Tables", or `finding-data-lake-assets` returns a different catalog |
| 49 | |
| 50 | ### 4. Discover Schema |
| 51 | |
| 52 | For analytical queries, You SHOULD profile the target table before building the final query. You MUST show sample rows (`SELECT ... LIMIT 5`) as part of profiling. |
| 53 | |
| 54 | ### 5. Build Query |
| 55 | |
| 56 | Table addressing depends on catalog type: |
| 57 | |
| 58 | - Default Glue catalog: `database.table` (omit the catalog prefix for single-catalog queries). In cross-catalog queries, qualify default-catalog tables with `"awsdatacatalog".database.table`. |
| 59 | - Registered data source: `datasource.database.table` |
| 60 | - Unregistered Glue catalog: `"catalog/subcatalog".database.table` |
| 61 | |
| 62 | ### 6. Classify and Execute |
| 63 | |
| 64 | Classify the SQL statement before executing: |
| 65 | |
| 66 | | Statement | Behavior | |
| 67 | |---|---| |
| 68 | | `SELECT`, `SHOW`, `DESCRIBE`, `EXPLAIN` | Safe — execute | |
| 69 | | `INSERT`, `UPDATE`, `DELETE`, `DROP`, `ALTER`, `CREATE`, `TRUNCATE`, `MERGE` | Destructive — warn the user and require explicit confirmation | |
| 70 | | Unsure | Treat as destructive; confirm | |
| 71 | |
| 72 | Example tool call (via AWS MCP server): |
| 73 | |
| 74 | ``` |
| 75 | aws___call_aws(command="aws athena start-query-execution --work-group <WORKGROUP_NAME> --query-string '<sql>' --query-execution-context Database=<db>") |
| 76 | ``` |
| 77 | |
| 78 | For federated or S3 Tables catalogs, also set `Catalog=<CATALOG_PATH>` in the execution context (e.g. `Catalog=s3tablescatalog/<BUCKET_NAME>`). |
| 79 | |
| 80 | **Constraints:** |
| 81 | |
| 82 | - You MUST warn the user before executing when the target is Redshift-federat |