creating-production-vpc-multi-az

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: architecture, aws, high-availability, networking, vpc.

What it does

Creates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables, and security groups following AWS Well-Architected principles. Use when deploying multi-AZ VPC infrastructure with automatic CIDR planning and DNS resolution.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill creating-production-vpc-multi-az

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/networking-and-content-delivery-skills/creating-production-vpc-multi-az ~/.claude/skills/creating-production-vpc-multi-az

Safety box score

Grade C, moderate risk: 40 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill provisions a full multi-AZ AWS VPC stack: VPC, internet gateway, public/private subnets, NAT gateways, route tables, security groups, IAM role, and VPC Flow Logs. The main risks are broad autonomous cloud changes, account-level IAM/CloudWatch modifications, and network exposure if permissive CIDRs are used.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It requires live command execution via `call_aws` and many AWS CLI calls such as `aws ec2 create-vpc --cidr-block {vpc_cidr} --region {region}`.
Network access	2 (moderate)	It talks to AWS APIs throughout and also sends VPC traffic metadata to CloudWatch Logs via `aws ec2 create-flow-logs ... --log-destination-type cloud-watch-logs`.
Filesystem reach	0 (none)	The files only describe AWS operations; there are no local file reads, writes, or deletes outside the project.
Secrets & credentials	1 (low)	It does not ask for passwords, but it does operate with the active AWS identity and explicitly runs `aws sts get-caller-identity --region {region}`.
Privilege & persistence	2 (moderate)	Step 10 creates and tags an IAM role and inline policy with `aws iam create-role` and `aws iam put-role-policy`, which changes account permissions.
Instruction hijack surface	0 (none)	I found no hidden prompts, instruction to ignore safeguards, or fetched external instructions; the text is procedural AWS setup guidance.
Irreversible actions	3 (high)	Its purpose is to automatically create production networking infrastructure and associated AWS resources, including NAT gateways, routes, security groups, and flow logs, without a human approval gate in the procedure.
Transparency	0 (none)	The skill is plain markdown with readable commands and no binaries, generated blobs, or hidden runtime code.

Before installing

Confirm `call_aws` is available and that the intended AWS profile/account is active.
Read step 10 first: it creates an IAM role and CloudWatch Logs permissions.
Estimate NAT gateway and Elastic IP costs for the requested AZ count before running.
Test with restrictive `allowed_web_cidrs` and `enable_ssh_access=false` in a scratch account first.

Rated 2026-10-20 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/networking-and-content-delivery-skills/creating-production-vpc-multi-az/SKILL.md
Branch: main
Updated: 2026-09-19

configuring-vpc-endpoints-for-private-aws-service-access — Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink.
connecting-vpcs-with-peering — Establishes VPC peering connections between two VPCs for direct private network connectivity.
enabling-lambda-vpc-internet-access — Enables internet access for AWS Lambda functions deployed in VPC subnets by creating NAT Gateway infrastructure, configuring public/private subnet routing.
app-platform-networking — Configure domains, routing, CORS, VPC, static IPs, and inter-service communication for DigitalOcean App Platform.
aws-network-monitoring — Installs, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor network path health.
directconnect — Configures AWS Direct Connect: choosing a connection model (dedicated, hosted, or a link aggregation group) and completing the cross connect; creating private.