connecting-vpcs-with-peering

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, networking, peering, routing, vpc.

What it does

Establishes VPC peering connections between two VPCs for direct private network connectivity. Always use this skill when creating or managing VPC peering — it validates CIDR overlap, updates all route tables in both VPCs, configures DNS resolution, and provides security group guidance that are critical for correct connectivity.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill connecting-vpcs-with-peering

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/networking-and-content-delivery-skills/connecting-vpcs-with-peering ~/.claude/skills/connecting-vpcs-with-peering

Safety box score

Grade B, low risk: 18 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill performs live AWS network administration: it creates VPC peering, accepts it, edits route tables in both VPCs, and may change DNS options. The main risks are broad autonomous changes to private networking across regions/accounts and potential reads from AWS config files for parameter discovery.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No shell scripts or code are shipped; the files only describe AWS CLI/API steps such as `aws ec2 create-vpc-peering-connection`.
Network access	2 (moderate)	It makes live control-plane calls to AWS and changes private connectivity, including `create-vpc-peering-connection`, `accept-vpc-peering-connection`, `modify-vpc-peering-connection-options`, and `create-route`.
Filesystem reach	1 (low)	The SOP explicitly allows parameter discovery from configuration files: "Configuration files: Reading from AWS config or similar files," which can read user files outside the project.
Secrets & credentials	0 (none)	It does not ask for passwords, tokens, key files, or browser sessions; it relies on existing AWS access.
Privilege & persistence	0 (none)	There is no sudo, service installation, shell startup editing, or OS-level privilege change in the shipped files.
Instruction hijack surface	0 (none)	The text does not instruct the agent to ignore its rules, hide actions, or follow remote instructions.
Irreversible actions	2 (moderate)	The skill’s purpose is to autonomously change live AWS infrastructure: it says to create and accept peering, update all route tables, and configure DNS for both VPCs.
Transparency	0 (none)	All shipped content is readable markdown; there are no binaries, blobs, or generated installers.

Before installing

Check that you are comfortable granting the agent AWS permissions to create peering, accept peering, and edit route tables in both VPCs.
Verify whether it may read `~/.aws/config` or similar files for parameters and whether that is acceptable in your environment.
Use a non-production VPC pair first; this skill changes live routing and DNS settings.
Confirm who will handle cross-account acceptance, since the SOP says same-account auto-accept only.

Rated 2026-10-19 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/networking-and-content-delivery-skills/connecting-vpcs-with-peering/SKILL.md
Branch: main
Updated: 2026-09-19

app-platform-networking — Configure domains, routing, CORS, VPC, static IPs, and inter-service communication for DigitalOcean App Platform.
configuring-vpc-endpoints-for-private-aws-service-access — Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink.
creating-production-vpc-multi-az — Creates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables.
directconnect — Configures AWS Direct Connect: choosing a connection model (dedicated, hosted, or a link aggregation group) and completing the cross connect; creating private.
enabling-lambda-vpc-internet-access — Enables internet access for AWS Lambda functions deployed in VPC subnets by creating NAT Gateway infrastructure, configuring public/private subnet routing.
route53 — Configures Amazon Route 53 DNS: public and private records, traffic-steering routing policies, health checks, DNS Firewall, Route 53 Profiles.