configuring-vpc-endpoints-for-private-aws-service-access

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, networking, private-link, security, vpc.

What it does

Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink. Use when setting up secure private connectivity to S3, DynamoDB, and other AWS services without internet gateway, NAT device, or public IP addresses. Covers endpoint creation, security groups, route tables, and DNS configuration.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill configuring-vpc-endpoints-for-private-aws-service-access

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/networking-and-content-delivery-skills/configuring-vpc-endpoints-for-private-aws-service-access ~/.claude/skills/configuring-vpc-endpoints-for-private-aws-service-access

Safety box score

Grade C, moderate risk: 33 of 100 risk points, rated 2026-10-17. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill configures AWS VPC endpoints by creating gateway/interface endpoints, security groups, route-table associations, DNS settings, and endpoint policies through AWS CLI/API calls. The main risk is broad impact inside your AWS account: it can change network reachability and requires strong AWS permissions, though it does not ship executable code or local file operations.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell scripts or code-evaluation artifacts are shipped; the files are markdown SOPs and examples only.
Network access	2 (moderate)	It mandates AWS CLI/API calls such as `describe-vpc-endpoints`, `create-vpc-endpoint`, and connectivity tests like `aws s3 ls` and `nslookup`, which send data to AWS services.
Filesystem reach	0 (none)	The skill does not read, write, or delete local files outside the docs; all actions are on AWS resources.
Secrets & credentials	1 (low)	It explicitly references AWS Secrets Manager and says to "MUST NEVER prompt for password input," but it does not directly read local secret stores or browser/OS credentials.
Privilege & persistence	2 (moderate)	It can create security groups, modify VPC DNS attributes, and associate route tables, which requires broad AWS/VPC administrative permissions.
Instruction hijack surface	0 (none)	There is no hidden text, fetched instructions, or directive to ignore safeguards; the "MUST" language is procedural rather than adversarial.
Irreversible actions	3 (high)	Its purpose is to create and potentially replace network infrastructure in the user's AWS account; it says to "create" endpoints, SGs, and policies and to ask about "skip, replace, or modify existing endpoints."
Transparency	0 (none)	All provided content is readable markdown; there are no binaries, blobs, or unpinned downloads.

Before installing

Confirm the AWS CLI profile is the intended account/region and has permissions for `ec2:CreateVpcEndpoint`, `ec2:CreateSecurityGroup`, and VPC attribute changes.
Read `references/configure-vpc-endpoints-for-private-aws-service-access.md` first; it can change route tables, security groups, and DNS settings inside a VPC.
If you may need to replace existing endpoints, test in a non-production VPC first.
Prepare the exact `vpc_id`, subnet IDs, and route table IDs so the agent does not guess or broaden the change.

Rated 2026-10-17 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/networking-and-content-delivery-skills/configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md
Branch: main
Updated: 2026-09-19

connecting-vpcs-with-peering — Establishes VPC peering connections between two VPCs for direct private network connectivity.
creating-production-vpc-multi-az — Creates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables.
enabling-lambda-vpc-internet-access — Enables internet access for AWS Lambda functions deployed in VPC subnets by creating NAT Gateway infrastructure, configuring public/private subnet routing.
sitetositevpn — Configures AWS Site-to-Site VPN: creating an IPsec VPN connection between an on-premises network and a VPC.
aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.
app-platform-networking — Configure domains, routing, CORS, VPC, static IPs, and inter-service communication for DigitalOcean App Platform.