AWS Networking
AWSOfficialPublished by AWS
- Skill
- Meta (authoring, orchestration, planning, memory)
- Cloud and DevOps
- Apache-2.0
- No issues found
AutoGineer summary
Written by AutoGineer from the skill’s own files, not by the author
The aws-networking skill acts as a triage layer for AWS networking tasks. It evaluates user requests and routes them to the correct specialized skill for services including Route 53, CloudFront, Transit Gateway, Direct Connect, Site-to-Site VPN, WAF, and Shield Advanced. It provides a structured framework for disambiguating requests based on connectivity versus security layers, traffic shifting mechanisms, and logging requirements, while ensuring critical security considerations like encryption and least-privilege access are addressed by the target skills.
What it does
- Routes user requests to specific AWS networking service skills based on intent.
- Distinguishes between connectivity, security, and DNS-based networking tasks.
- Provides guidance on cross-service concepts like traffic filtering, logging, and traffic shifting.
- Enforces security best practices by mandating checks for encryption, DDoS protection, and IAM policies.
- Identifies when a requested task falls outside the scope of the supported networking services.
- Coordinates multi-service workflows, such as pairing WAF and Shield Advanced with CloudFront.
When to use it
- When you need to determine which AWS networking service is required for a specific task.
- When you are designing or troubleshooting connectivity, DNS, or edge security configurations.
- When you need to ensure that security controls like WAF or DDoS protection are correctly integrated with internet-facing resources.
- When you need to identify the correct logging or visibility source for a networking issue.
Advantages
- Reduces ambiguity by mapping user intent to specific AWS service capabilities.
- Ensures consistent application of security best practices across different networking layers.
- Prevents misconfiguration by identifying dependencies between services like CloudFront and WAF.
- Provides a clear boundary for supported services, preventing incorrect routing to unsupported areas.
Usage examples
- “I need to block malicious traffic from specific countries on my website.”
- The skill identifies this as an L7 filtering task and routes the request to the WAF skill.
- “How do I connect my on-premises data center to multiple VPCs in AWS?”
- The skill identifies the requirement for hub-and-spoke connectivity and routes the request to the Transit Gateway skill.
- “I want to set up a private, dedicated connection to AWS with high throughput.”
- The skill recognizes the need for a dedicated hybrid link and routes the request to the Direct Connect skill.
- “How do I configure my VPC subnets and route tables?”
- The skill informs the user that VPC foundation services are out of scope and not supported by this skill set.
Install
Download the skill as a ZIP:
https://autogineer.com/agent-skills/aws/aws-networking/downloadUnzip it into the cross-client skills folder of your project:
mkdir -p .agents/skills && unzip aws-networking.zip -d .agents/skills
Documentation by AWS
AWS Networking
Overview
Routes networking requests to the correct service-specific skill. Covers 7 services across DNS and content delivery, hybrid connectivity, and network security (web application firewall and DDoS protection). Other AWS networking services (VPC foundations, load balancing, endpoints, PrivateLink, API Gateway, and more) are out of scope for this router (see step 6).
Works best with the AWS MCP server — enables sandboxed execution, audit logging, and enterprise controls. All guidance also works with standard AWS CLI access.
How to use this skill
Match the user's request against the Skill Routing Table below. Match on meaning, not exact wording.
If the request matches multiple skills, use the Cross-Service Concepts tables to determine which layer the request targets, then route to the skill that owns that layer.
If still ambiguous, ask one clarifying question: "Are you looking to set up connectivity, or control/filter existing traffic?"
Load the target skill: if the AWS MCP server is available, use
aws___retrieve_skill(skill_name="<skill>"); otherwise retrieve the skill document from this repository atskills/<skill>/SKILL.md.If a request spans multiple of these skills, route to each in dependency order. When routing to an internet-facing service (
cloudfront), also route toshieldadvancedfor DDoS protection and towaffor L7 filtering (AWS WAF attaches to CloudFront, Application Load Balancer, API Gateway, and AppSync), if the user has not already addressed L7 filtering and DDoS protection. When routing to a connectivity skill (directconnect,sitetositevpn,transitgateway), confirm encryption in transit is addressed (MACsec for Direct Connect, IPsec for VPN, inter-region peering encryption for Transit Gateway). When the request involves custom domains or TLS oncloudfront, note that ACM certificate provisioning is part of the implementation. When routing tocloudfrontfor a web-facing distribution, note that the target skill should address security response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) via a CloudFront Response Headers Policy, including the managedSecurityHeadersPolicy. The target skill handles the configuration.If the request is an AWS networking task that is not in the Skill Routing Table (for example VPC subnets or route tables, security groups, load balancers, VPC endpoints, PrivateLink, or API Gateway), tell the user that service is not available in this skill set rather than routing to the closest listed skill. This skill set does not cover every AWS networking service.
This skill triages — it does not implement. Do not answer service-specific configuration questions from this skill alone.
Connectivity vs Security
| Dimension | Connectivity | Security |
|---|---|---|
| Answers | Can traffic reach its destination? | Should traffic be allowed? |
| Failure symptom | Timeout, unreachable, black hole | Rejected, denied, dropped |
| Dependency | Independent of policy — path exists or it doesn't | Assumes connectivity exists — can only filter reachable traffic |
| Granularity | Affects all flows on a path | Targets specific flows by match criteria |
Skill Routing Table
| Skill | Choose when… |
|---|---|
transitgateway | Connecting more than two VPCs or on-premises networks in a hub, routing segmentation, cross-account/cross-region connectivity at scale, centralized egress/inspection, multicast |
directconnect | Dedicated private link to on-premises — consistent latency, high throughput, MACsec encryption, LAGs, Direct Connect Gateway for multi-VPC, SiteLink for site-to-site bypass, production hybrid workloads |
sitetositevpn | Encrypted IPsec tunnel over internet — quick setup, DX backup, static or BGP routing, accelerated option via Global Accelerator backbone, standard or large tunnel bandwidth |
route53 | DNS management (public/private zones, records), health checks, routing policies (weighted, failover, geo, latency), domain registration, Resolver (hybrid DNS forwarding), DNS Firewall, Route 53 Profiles, Global Resolver |
cloudfront | Caching, TLS termination at edge, origin protection (OAC), custom domains, cache policies/behaviors, signed URLs, CloudFront Functions, viewer mTLS, VPC origins, multi-tenant distributions |
waf | Web application firewall (L7) — web ACLs on CloudFront/ALB/API Gateway/AppSync, AWS Managed Rules, rate-based rules for HTTP floods, IP/geo match, Bot Control, Fraud Control (account takeover/creation), for protecting web apps and APIs from exploits, bots, and credential stuffing |
shieldadvanced | L3/L4 DDoS protection for internet-facing resources, automatic application-layer (L7) mitigation via WAF, health-based detection, Shield Response Team access, and DDoS cost-protection credits |
Cross-Service Concepts
Same concept, different service depending on layer. Use these to disambiguate when the Skill Routing Table matches multiple skills.
Filtering / Blocking
Use when the user says "block", "deny", "filter", or "restrict traffic" — determines which layer the filtering operates at.
| Layer | Service | What it filters on | Skill |
|---|---|---|---|
| L7 (HTTP/HTTPS, web apps and APIs) | AWS WAF | HTTP request attributes, AWS Managed Rules, rate-based and bot rules, IP/geo match | waf |
| L3/L4 (DDoS volumetric/state-exhaustion) | Shield Advanced | Network/transport-layer DDoS floods on internet-facing resources | shieldadvanced |
| DNS (resolution) | Route 53 DNS Firewall | Domain name patterns — blocks resolution, not traffic | route53 |
When routing to waf or cloudfront for an internet-facing API or website, treat WAF rate-based rules as a default protective measure, not only when the user asks: note that the target skill should add WAF rate-based rules to bound request volume per client — the target skill implements it.
Logging / Visibility
Use when the user says "logs", "visibility", "what's being blocked", or "can I see the traffic" — identifies which log source to check.
| What you need to see | Service | Log type | Skill |
|---|---|---|---|
| DNS queries from VPC | Route 53 Resolver | Query logs | route53 |
| Blocked/allowed HTTP requests | AWS WAF | web ACL logs (S3, CloudWatch Logs, or Kinesis Data Firehose) | waf |
| DDoS events and attack detail | Shield Advanced | CloudWatch metrics, DDoS event detection | shieldadvanced |
| Edge/CDN request access | CloudFront | Standard logs (S3), real-time logs (Kinesis Data Streams) | cloudfront |
| Tunnel state and traffic | Site-to-Site VPN | Tunnel telemetry, CloudWatch metrics | sitetositevpn |
When routing to any of these services, remind the user to enable the corresponding logging (above) for security visibility and incident response — the target skill implements it. These logs can contain sensitive data (request query strings, internal hostnames in DNS queries), so also remind the user that the log destination (S3, CloudWatch Logs, Kinesis Data Firehose, or Kinesis Data Streams) MUST have encryption at rest enabled and access restricted to authorized personnel — the target skill implements it.
Traffic Shifting
Use when the user says "shift traffic", "blue/green", "failover", "canary", or "weighted routing" — determines the granularity and which service controls it.
| Granularity | Service | Mechanism | Skill |
|---|---|---|---|
| DNS-level (global) | Route 53 | Weighted, failover, geolocation, latency routing | route53 |
| Edge (HTTP) | CloudFront | Origin failover, origin groups | cloudfront |
Security Considerations
These services are security-sensitive, so raise the relevant risk and control when routing regardless of which skill you hand off to — the target skill implements the control:
| Risk | Control the target skill should address | Skills |
|---|---|---|
| Unencrypted traffic in transit | MACsec (directconnect), IPsec tunnels (sitetositevpn), inter-region peering encryption (transitgateway), TLS termination and viewer mTLS (cloudfront) | directconnect, sitetositevpn, transitgateway, cloudfront |
| Missing DDoS protection on internet-facing resources | Shield Advanced L3/L4 protection plus WAF L7 mitigation | shieldadvanced, waf |
| Web/API exploits, bots, and request floods | WAF web ACLs, AWS Managed Rules, and rate-based rules; application-layer input validation (request body size limits, schema validation); security response headers | waf, cloudfront |
| Overly permissive filtering rules | Least-privilege DNS Firewall domain blocking | route53 |
| Over-privileged IAM policies for service resources | Least-privilege IAM roles scoped to specific resources and actions; avoid FullAccess managed policies and Action: *; prefer IAM roles with ephemeral credentials (instance profiles, IRSA, task roles, sts assume-role) over IAM users with long-lived access keys | all |
| Hardcoded credentials and shared secrets | Let AWS auto-generate secrets where supported (for example Site-to-Site VPN pre-shared keys), or store customer-managed secrets in AWS Secrets Manager rather than hardcoding them | sitetositevpn, directconnect |
| Confused-deputy in cross-service resource policies | Include aws:SourceArn and/or aws:SourceAccount condition keys in S3 bucket policies, KMS key policies, and log-destination resource policies (CloudFront OAC, log delivery to S3/CloudWatch Logs/Kinesis) so only the intended resource and account can invoke them | cloudfront, waf, all |
| Insufficient visibility for incident response | Enable the service logging in the Logging / Visibility table, with encryption at rest and restricted access on the log destination | all |
| No audit trail or alerting on control-plane changes | Enable AWS CloudTrail to audit control-plane API calls (record, rule, policy, and firewall changes) and set CloudWatch Alarms on security-relevant events (Shield Advanced DDoS detection, WAF blocked/counted spikes, unexpected rule or record modifications); restrict the SNS topics that receive alarm notifications to authorized personnel and enable encryption at rest (SSE-KMS) on those topics, since the notifications can contain sensitive event detail | all |
For authoritative guidance, point users to the AWS Well-Architected Framework Security Pillar and the service-specific security documentation for the target skill.
Files
- ATTRIBUTION.mdAdded by AutoGineer893 B
- LICENSELicence file added by AutoGineer9.9 KiB
- NOTICELicence file added by AutoGineer67 B
- SKILL.md11.3 KiB
LICENSE
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
Requirements and compatibility
Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta
“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.
Needs: Needs an MCP server
Security
No issues found by our static scan· No issues found
A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.
Attribution and licence
- Published by
- AWS
- Publisher
- AWS (Official)
- Source
- aws/agent-toolkit-for-aws · skills/core-skills/aws-networking · commit 0a218f8
- Licence
- Apache License 2.0 (redistribution allowed)
- LICENSE (added by AutoGineer from LICENSE)
- NOTICE (added by AutoGineer from NOTICE)
- ATTRIBUTION.md (written by AutoGineer)
- Synced
- Also distributed in
- aws/agent-toolkit-for-aws
AutoGineer is not affiliated with or endorsed by AWS or AWS.
Download ZIP
The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download aws-networking.zip