Generated banner for AWS Networking
Generated logo for AWS Networking

AWS Networking

AWSOfficialPublished by AWS

  • Skill
  • Meta (authoring, orchestration, planning, memory)
  • Cloud and DevOps
  • Apache-2.0
  • No issues found

From the author

Routes AWS networking requests to the correct service skill for implementation. Covers Route 53 (DNS, health checks, routing policies, Resolver, DNS Firewall), CloudFront (caching, edge, OAC, mTLS, signed URLs), Transit Gateway (multi-VPC hub, segmentation, centralized egress), Direct Connect (hybrid link, DX Gateway, MACsec), Site-to-Site VPN (IPsec tunnels, static or BGP), WAF (web ACLs, AWS Managed Rules, rate-based rules, Bot and Fraud Control), and Shield Advanced (L3/L4 DDoS). Applicable when creating, configuring, troubleshooting, or designing across these services, choosing between them, or diagnosing connectivity or traffic-filtering issues. Not for VPC subnets and route tables, load balancers, VPC endpoints, PrivateLink, API Gateway, IAM policy logic, container or serverless networking, or IaC authoring.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

The aws-networking skill acts as a triage layer for AWS networking tasks. It evaluates user requests and routes them to the correct specialized skill for services including Route 53, CloudFront, Transit Gateway, Direct Connect, Site-to-Site VPN, WAF, and Shield Advanced. It provides a structured framework for disambiguating requests based on connectivity versus security layers, traffic shifting mechanisms, and logging requirements, while ensuring critical security considerations like encryption and least-privilege access are addressed by the target skills.

What it does

  • Routes user requests to specific AWS networking service skills based on intent.
  • Distinguishes between connectivity, security, and DNS-based networking tasks.
  • Provides guidance on cross-service concepts like traffic filtering, logging, and traffic shifting.
  • Enforces security best practices by mandating checks for encryption, DDoS protection, and IAM policies.
  • Identifies when a requested task falls outside the scope of the supported networking services.
  • Coordinates multi-service workflows, such as pairing WAF and Shield Advanced with CloudFront.

When to use it

  • When you need to determine which AWS networking service is required for a specific task.
  • When you are designing or troubleshooting connectivity, DNS, or edge security configurations.
  • When you need to ensure that security controls like WAF or DDoS protection are correctly integrated with internet-facing resources.
  • When you need to identify the correct logging or visibility source for a networking issue.

Advantages

  • Reduces ambiguity by mapping user intent to specific AWS service capabilities.
  • Ensures consistent application of security best practices across different networking layers.
  • Prevents misconfiguration by identifying dependencies between services like CloudFront and WAF.
  • Provides a clear boundary for supported services, preventing incorrect routing to unsupported areas.

Usage examples

“I need to block malicious traffic from specific countries on my website.”
The skill identifies this as an L7 filtering task and routes the request to the WAF skill.
“How do I connect my on-premises data center to multiple VPCs in AWS?”
The skill identifies the requirement for hub-and-spoke connectivity and routes the request to the Transit Gateway skill.
“I want to set up a private, dedicated connection to AWS with high throughput.”
The skill recognizes the need for a dedicated hybrid link and routes the request to the Direct Connect skill.
“How do I configure my VPC subnets and route tables?”
The skill informs the user that VPC foundation services are out of scope and not supported by this skill set.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/aws/aws-networking/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip aws-networking.zip -d .agents/skills

Documentation by AWS

AWS Networking

Overview

Routes networking requests to the correct service-specific skill. Covers 7 services across DNS and content delivery, hybrid connectivity, and network security (web application firewall and DDoS protection). Other AWS networking services (VPC foundations, load balancing, endpoints, PrivateLink, API Gateway, and more) are out of scope for this router (see step 6).

Works best with the AWS MCP server — enables sandboxed execution, audit logging, and enterprise controls. All guidance also works with standard AWS CLI access.

How to use this skill

  1. Match the user's request against the Skill Routing Table below. Match on meaning, not exact wording.

  2. If the request matches multiple skills, use the Cross-Service Concepts tables to determine which layer the request targets, then route to the skill that owns that layer.

  3. If still ambiguous, ask one clarifying question: "Are you looking to set up connectivity, or control/filter existing traffic?"

  4. Load the target skill: if the AWS MCP server is available, use aws___retrieve_skill(skill_name="<skill>"); otherwise retrieve the skill document from this repository at skills/<skill>/SKILL.md.

  5. If a request spans multiple of these skills, route to each in dependency order. When routing to an internet-facing service (cloudfront), also route to shieldadvanced for DDoS protection and to waf for L7 filtering (AWS WAF attaches to CloudFront, Application Load Balancer, API Gateway, and AppSync), if the user has not already addressed L7 filtering and DDoS protection. When routing to a connectivity skill (directconnect, sitetositevpn, transitgateway), confirm encryption in transit is addressed (MACsec for Direct Connect, IPsec for VPN, inter-region peering encryption for Transit Gateway). When the request involves custom domains or TLS on cloudfront, note that ACM certificate provisioning is part of the implementation. When routing to cloudfront for a web-facing distribution, note that the target skill should address security response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) via a CloudFront Response Headers Policy, including the managed SecurityHeadersPolicy. The target skill handles the configuration.

  6. If the request is an AWS networking task that is not in the Skill Routing Table (for example VPC subnets or route tables, security groups, load balancers, VPC endpoints, PrivateLink, or API Gateway), tell the user that service is not available in this skill set rather than routing to the closest listed skill. This skill set does not cover every AWS networking service.

  7. This skill triages — it does not implement. Do not answer service-specific configuration questions from this skill alone.

Connectivity vs Security

DimensionConnectivitySecurity
AnswersCan traffic reach its destination?Should traffic be allowed?
Failure symptomTimeout, unreachable, black holeRejected, denied, dropped
DependencyIndependent of policy — path exists or it doesn'tAssumes connectivity exists — can only filter reachable traffic
GranularityAffects all flows on a pathTargets specific flows by match criteria

Skill Routing Table

SkillChoose when…
transitgatewayConnecting more than two VPCs or on-premises networks in a hub, routing segmentation, cross-account/cross-region connectivity at scale, centralized egress/inspection, multicast
directconnectDedicated private link to on-premises — consistent latency, high throughput, MACsec encryption, LAGs, Direct Connect Gateway for multi-VPC, SiteLink for site-to-site bypass, production hybrid workloads
sitetositevpnEncrypted IPsec tunnel over internet — quick setup, DX backup, static or BGP routing, accelerated option via Global Accelerator backbone, standard or large tunnel bandwidth
route53DNS management (public/private zones, records), health checks, routing policies (weighted, failover, geo, latency), domain registration, Resolver (hybrid DNS forwarding), DNS Firewall, Route 53 Profiles, Global Resolver
cloudfrontCaching, TLS termination at edge, origin protection (OAC), custom domains, cache policies/behaviors, signed URLs, CloudFront Functions, viewer mTLS, VPC origins, multi-tenant distributions
wafWeb application firewall (L7) — web ACLs on CloudFront/ALB/API Gateway/AppSync, AWS Managed Rules, rate-based rules for HTTP floods, IP/geo match, Bot Control, Fraud Control (account takeover/creation), for protecting web apps and APIs from exploits, bots, and credential stuffing
shieldadvancedL3/L4 DDoS protection for internet-facing resources, automatic application-layer (L7) mitigation via WAF, health-based detection, Shield Response Team access, and DDoS cost-protection credits

Cross-Service Concepts

Same concept, different service depending on layer. Use these to disambiguate when the Skill Routing Table matches multiple skills.

Filtering / Blocking

Use when the user says "block", "deny", "filter", or "restrict traffic" — determines which layer the filtering operates at.

LayerServiceWhat it filters onSkill
L7 (HTTP/HTTPS, web apps and APIs)AWS WAFHTTP request attributes, AWS Managed Rules, rate-based and bot rules, IP/geo matchwaf
L3/L4 (DDoS volumetric/state-exhaustion)Shield AdvancedNetwork/transport-layer DDoS floods on internet-facing resourcesshieldadvanced
DNS (resolution)Route 53 DNS FirewallDomain name patterns — blocks resolution, not trafficroute53

When routing to waf or cloudfront for an internet-facing API or website, treat WAF rate-based rules as a default protective measure, not only when the user asks: note that the target skill should add WAF rate-based rules to bound request volume per client — the target skill implements it.

Logging / Visibility

Use when the user says "logs", "visibility", "what's being blocked", or "can I see the traffic" — identifies which log source to check.

What you need to seeServiceLog typeSkill
DNS queries from VPCRoute 53 ResolverQuery logsroute53
Blocked/allowed HTTP requestsAWS WAFweb ACL logs (S3, CloudWatch Logs, or Kinesis Data Firehose)waf
DDoS events and attack detailShield AdvancedCloudWatch metrics, DDoS event detectionshieldadvanced
Edge/CDN request accessCloudFrontStandard logs (S3), real-time logs (Kinesis Data Streams)cloudfront
Tunnel state and trafficSite-to-Site VPNTunnel telemetry, CloudWatch metricssitetositevpn

When routing to any of these services, remind the user to enable the corresponding logging (above) for security visibility and incident response — the target skill implements it. These logs can contain sensitive data (request query strings, internal hostnames in DNS queries), so also remind the user that the log destination (S3, CloudWatch Logs, Kinesis Data Firehose, or Kinesis Data Streams) MUST have encryption at rest enabled and access restricted to authorized personnel — the target skill implements it.

Traffic Shifting

Use when the user says "shift traffic", "blue/green", "failover", "canary", or "weighted routing" — determines the granularity and which service controls it.

GranularityServiceMechanismSkill
DNS-level (global)Route 53Weighted, failover, geolocation, latency routingroute53
Edge (HTTP)CloudFrontOrigin failover, origin groupscloudfront

Security Considerations

These services are security-sensitive, so raise the relevant risk and control when routing regardless of which skill you hand off to — the target skill implements the control:

RiskControl the target skill should addressSkills
Unencrypted traffic in transitMACsec (directconnect), IPsec tunnels (sitetositevpn), inter-region peering encryption (transitgateway), TLS termination and viewer mTLS (cloudfront)directconnect, sitetositevpn, transitgateway, cloudfront
Missing DDoS protection on internet-facing resourcesShield Advanced L3/L4 protection plus WAF L7 mitigationshieldadvanced, waf
Web/API exploits, bots, and request floodsWAF web ACLs, AWS Managed Rules, and rate-based rules; application-layer input validation (request body size limits, schema validation); security response headerswaf, cloudfront
Overly permissive filtering rulesLeast-privilege DNS Firewall domain blockingroute53
Over-privileged IAM policies for service resourcesLeast-privilege IAM roles scoped to specific resources and actions; avoid FullAccess managed policies and Action: *; prefer IAM roles with ephemeral credentials (instance profiles, IRSA, task roles, sts assume-role) over IAM users with long-lived access keysall
Hardcoded credentials and shared secretsLet AWS auto-generate secrets where supported (for example Site-to-Site VPN pre-shared keys), or store customer-managed secrets in AWS Secrets Manager rather than hardcoding themsitetositevpn, directconnect
Confused-deputy in cross-service resource policiesInclude aws:SourceArn and/or aws:SourceAccount condition keys in S3 bucket policies, KMS key policies, and log-destination resource policies (CloudFront OAC, log delivery to S3/CloudWatch Logs/Kinesis) so only the intended resource and account can invoke themcloudfront, waf, all
Insufficient visibility for incident responseEnable the service logging in the Logging / Visibility table, with encryption at rest and restricted access on the log destinationall
No audit trail or alerting on control-plane changesEnable AWS CloudTrail to audit control-plane API calls (record, rule, policy, and firewall changes) and set CloudWatch Alarms on security-relevant events (Shield Advanced DDoS detection, WAF blocked/counted spikes, unexpected rule or record modifications); restrict the SNS topics that receive alarm notifications to authorized personnel and enable encryption at rest (SSE-KMS) on those topics, since the notifications can contain sensitive event detailall

For authoritative guidance, point users to the AWS Well-Architected Framework Security Pillar and the service-specific security documentation for the target skill.

Files

LICENSE


                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/

   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

   1. Definitions.

      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.

      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.

      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).

      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.

      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."

      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.

   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.

   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.

   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:

      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and

      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and

      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and

      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.

      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.

   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.

   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.

   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.

   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.

   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs an MCP server

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · skills/core-skills/aws-networking · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
aws/agent-toolkit-for-aws

AutoGineer is not affiliated with or endorsed by AWS or AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download aws-networking.zip