aws-networking

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: architecture, cloud, security, troubleshooting, web.

What it does

Routes AWS networking requests to the correct service skill for implementation. Covers Route 53 (DNS, health checks, routing policies, Resolver, DNS Firewall), CloudFront (caching, edge, OAC, mTLS, signed URLs), Transit Gateway (multi-VPC hub, segmentation, centralized egress), Direct Connect (hybrid link, DX Gateway, MACsec), Site-to-Site VPN (IPsec tunnels, static or BGP), WAF (web ACLs, AWS Managed Rules, rate-based rules, Bot and Fraud Control), and Shield Advanced (L3/L4 DDoS). Applicable when creating, configuring, troubleshooting, or designing across these services, choosing between them, or diagnosing connectivity or traffic-filtering issues. Not for VPC subnets and route tables, load balancers, VPC endpoints, PrivateLink, API Gateway, IAM policy logic, container or serverless networking, or IaC authoring.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-networking

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-core/skills/aws-networking ~/.claude/skills/aws-networking

Safety box score

Grade A, minimal risk: 4 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a markdown router for AWS networking topics; it does not contain executable code, but it can steer the agent into other AWS service skills and documentation lookups. The main risks are low: cross-skill loading over the network/repo, and the fact that the target service skills may enable sensitive logging or AWS changes.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell scripts, native binaries, or code-evaluation paths are present; the file is only routing guidance in markdown.
Network access	1 (low)	It may retrieve downstream skills via `aws___retrieve_skill(skill_name="<skill>")` or from `skills/<skill>/SKILL.md`, but it does not itself download arbitrary content or send user data off-host.
Filesystem reach	0 (none)	The file does not write, delete, or modify local files; it only references repository paths for lookup.
Secrets & credentials	0 (none)	It mentions that logs can contain sensitive data, but it does not request or read tokens, keys, passwords, `.env` files, or browser sessions.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, shell startup editing, or OS configuration change in this skill.
Instruction hijack surface	0 (none)	The text gives normal routing instructions and does not tell the agent to ignore safeguards, hide actions, or follow untrusted instructions.
Irreversible actions	0 (none)	It explicitly says, "This skill triages — it does not implement," and does not send messages, deploy, publish, or delete anything.
Transparency	0 (none)	Everything provided is plain, readable markdown; there are no binaries, encoded blobs, or generated installers.

Before installing

Verify the agent will only use this router to select a downstream skill, not to implement AWS changes itself.
Read the target service skill(s) it routes to, especially any logging, WAF, CloudFront, or connectivity actions.
If you plan to use service logs, confirm the destination (S3, CloudWatch Logs, Kinesis) has encryption at rest and restricted access.
Check that your environment has the intended skill-loading path available (`aws___retrieve_skill` or the local repository path).

Rated 2026-10-15 by an automated review of 1 file from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-core/skills/aws-networking/SKILL.md
Branch: main
Collection: aws-core
Updated: 2026-09-19

aws-blocks — Guides building full-stack applications with AWS Blocks — an Infrastructure-from-Code framework.
agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.
chatting-with-aws-devops-agent — Have a fast, conversational analysis with the AWS DevOps Agent.
pentesting-with-aws-security-agent — Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain.
cloudfront — Configures Amazon CloudFront content delivery across six workflows: when to use CloudFront and how it fits with AWS WAF, Shield, CloudFront Functions.
cloudflare — Discover and choose Cloudflare products for apps, APIs, AI agents, storage, networking, and security.