aws-networking

Name: aws-networking
Author: aws

886installs190forks

How to install aws-networking?

aws/agent-toolkit-for-aws/aws-networking

$npx -y skills add aws/agent-toolkit-for-aws --skill aws-networking

Installs into the current project.

Summary

Routes AWS networking requests to the correct service skill for implementation. Covers Route 53 (DNS, health checks, routing policies, Resolver, DNS Firewall), CloudFront (caching, edge, OAC, mTLS, signed URLs), Transit Gateway (multi-VPC hub, segmentation, centralized egress), D

Files · 1

View on GitHub

SKILL.md

1	# AWS Networking
2
3	## Overview
4
5	Routes networking requests to the correct service-specific skill. Covers 8 services across DNS and content delivery, hybrid connectivity, and network security (inspection, web application firewall, and DDoS protection). Other AWS networking services (VPC foundations, load balancing, endpoints, PrivateLink, API Gateway, and more) are out of scope for this router (see step 6).
6
7	Works best with the [AWS MCP server](https://docs.aws.amazon.com/aws-mcp/) — enables sandboxed execution, audit logging, and enterprise controls. All guidance also works with standard AWS CLI access.
8
9	## How to use this skill
10
11	1. Match the user's request against the Skill Routing Table below. Match on meaning, not exact wording.
12	2. If the request matches multiple skills, use the Cross-Service Concepts tables to determine which layer the request targets, then route to the skill that owns that layer.
13	3. If still ambiguous, ask one clarifying question: "Are you looking to set up connectivity, or control/filter existing traffic?"
14	4. Load the target skill: if the AWS MCP server is available, use `aws___retrieve_skill(skill_name="<skill>")`; otherwise retrieve the skill document from this repository at `skills/<skill>/SKILL.md`.
15	5. If a request spans multiple of these skills (e.g., inspecting east-west traffic between VPCs joined by a Transit Gateway), route to each in dependency order: the connectivity skill first (`transitgateway`), then the inspection skill (`networkfirewall`). When routing to an internet-facing service (`cloudfront`), also route to `shieldadvanced` for DDoS protection and to `waf` for L7 filtering (AWS WAF attaches to CloudFront, Application Load Balancer, API Gateway, and AppSync), if the user has not already addressed L7 filtering and DDoS protection. When routing to a connectivity skill (`directconnect`, `sitetositevpn`, `transitgateway`), confirm encryption in transit is addressed (MACsec for Direct Connect, IPsec for VPN, inter-region peering encryption for Transit Gateway). When the request involves custom domains or TLS on `cloudfront`, note that ACM certificate provisioning is part of the implementation. When routing to `cloudfront` for a web-facing distribution, note that the target skill should address security response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) via a CloudFront Response Headers Policy, including the managed `SecurityHeadersPolicy`. The target skill handles the configuration.
16	6. If the request is an AWS networking task that is not in the Skill Routing Table (for example VPC subnets or route tables, security groups, load balancers, VPC endpoints, PrivateLink, or API Gateway), tell the user that service is not available in this skill set rather than routing to the closest listed skill. This skill set does not cover every AWS networking service.
17	7. This skill triages — it does not implement. Do not answer service-specific configuration questions from this skill alone.
18
19	## Connectivity vs Security
20
21	\| Dimension \| Connectivity \| Security \|
22	\| --- \| --- \| --- \|
23	\| Answers \| Can traffic reach its destination? \| Should traffic be allowed? \|
24	\| Failure symptom \| Timeout, unreachable, black hole \| Rejected, denied, dropped \|
25	\| Dependency \| Independent of policy — path exists or it doesn't \| Assumes connectivity exists — can only filter reachable traffic \|
26	\| Granularity \| Affects all flows on a path \| Targets specific flows by match criteria \|
27
28	## Skill Routing Table
29
30	\| Skill \| Choose when… \|
31	\| --- \| --- \|
32	\| `transitgateway` \| Connecting more than two VPCs or on-premises networks in a hub, routing segmentation, cross-account/cross-region connectivity at scale, centralized egress/inspection, multicast \|
33	\| `directconnect` \| Dedicated private link to on-premises — consistent latency, high throughput, MACsec encryption, LAGs, Direct Connect Gateway for multi-VPC, SiteLink for site-to-site bypass, production hybrid workloads \|
34	\| `sitetositevpn` \| Encrypted IPsec tunnel over internet — quick

People who liked this also viewed

6 picks

Type

aws-networking

886installs190forks

View on GitHub

How to install aws-networking?

aws/agent-toolkit-for-aws/aws-networking

$npx -y skills add aws/agent-toolkit-for-aws --skill aws-networking

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS Networking
2
3	## Overview
4
5	Routes networking requests to the correct service-specific skill. Covers 8 services across DNS and content delivery, hybrid connectivity, and network security (inspection, web application firewall, and DDoS protection). Other AWS networking services (VPC foundations, load balancing, endpoints, PrivateLink, API Gateway, and more) are out of scope for this router (see step 6).
6
7	Works best with the [AWS MCP server](https://docs.aws.amazon.com/aws-mcp/) — enables sandboxed execution, audit logging, and enterprise controls. All guidance also works with standard AWS CLI access.
8
9	## How to use this skill
10
11	1. Match the user's request against the Skill Routing Table below. Match on meaning, not exact wording.
12	2. If the request matches multiple skills, use the Cross-Service Concepts tables to determine which layer the request targets, then route to the skill that owns that layer.
13	3. If still ambiguous, ask one clarifying question: "Are you looking to set up connectivity, or control/filter existing traffic?"
14	4. Load the target skill: if the AWS MCP server is available, use `aws___retrieve_skill(skill_name="<skill>")`; otherwise retrieve the skill document from this repository at `skills/<skill>/SKILL.md`.
15	5. If a request spans multiple of these skills (e.g., inspecting east-west traffic between VPCs joined by a Transit Gateway), route to each in dependency order: the connectivity skill first (`transitgateway`), then the inspection skill (`networkfirewall`). When routing to an internet-facing service (`cloudfront`), also route to `shieldadvanced` for DDoS protection and to `waf` for L7 filtering (AWS WAF attaches to CloudFront, Application Load Balancer, API Gateway, and AppSync), if the user has not already addressed L7 filtering and DDoS protection. When routing to a connectivity skill (`directconnect`, `sitetositevpn`, `transitgateway`), confirm encryption in transit is addressed (MACsec for Direct Connect, IPsec for VPN, inter-region peering encryption for Transit Gateway). When the request involves custom domains or TLS on `cloudfront`, note that ACM certificate provisioning is part of the implementation. When routing to `cloudfront` for a web-facing distribution, note that the target skill should address security response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) via a CloudFront Response Headers Policy, including the managed `SecurityHeadersPolicy`. The target skill handles the configuration.
16	6. If the request is an AWS networking task that is not in the Skill Routing Table (for example VPC subnets or route tables, security groups, load balancers, VPC endpoints, PrivateLink, or API Gateway), tell the user that service is not available in this skill set rather than routing to the closest listed skill. This skill set does not cover every AWS networking service.
17	7. This skill triages — it does not implement. Do not answer service-specific configuration questions from this skill alone.
18
19	## Connectivity vs Security
20
21	\| Dimension \| Connectivity \| Security \|
22	\| --- \| --- \| --- \|
23	\| Answers \| Can traffic reach its destination? \| Should traffic be allowed? \|
24	\| Failure symptom \| Timeout, unreachable, black hole \| Rejected, denied, dropped \|
25	\| Dependency \| Independent of policy — path exists or it doesn't \| Assumes connectivity exists — can only filter reachable traffic \|
26	\| Granularity \| Affects all flows on a path \| Targets specific flows by match criteria \|
27
28	## Skill Routing Table
29
30	\| Skill \| Choose when… \|
31	\| --- \| --- \|
32	\| `transitgateway` \| Connecting more than two VPCs or on-premises networks in a hub, routing segmentation, cross-account/cross-region connectivity at scale, centralized egress/inspection, multicast \|
33	\| `directconnect` \| Dedicated private link to on-premises — consistent latency, high throughput, MACsec encryption, LAGs, Direct Connect Gateway for multi-VPC, SiteLink for site-to-site bypass, production hybrid workloads \|
34	\| `sitetositevpn` \| Encrypted IPsec tunnel over internet — quick

People who liked this also viewed

6 picks

Type