directconnect

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, connectivity, hybrid-cloud, networking, routing.

What it does

Configures AWS Direct Connect: choosing a connection model (dedicated, hosted, or a link aggregation group) and completing the cross connect; creating private, public, and transit virtual interfaces and bringing up BGP; reaching many VPCs through a Direct Connect gateway including cross-account transit gateway associations; encrypting traffic with MACsec or a private IP Site-to-Site VPN; making the connection resilient and tuning failover; managing link aggregation groups; SiteLink; and migrating from a virtual private gateway to a transit gateway. Use when the user wants a private, consistent network link between a data center and AWS, or operates an existing Direct Connect setup and needs to extend, encrypt, or harden it. Routes to the right per-task procedure in references. Do NOT use for transit gateway route tables and attachments (transitgateway skill), Site-to-Site VPN without Direct Connect (sitetositevpn skill), or Route 53 DNS routing (route53 skill).

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill directconnect

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/networking-and-content-delivery-skills/directconnect ~/.claude/skills/directconnect

Safety box score

Grade D, elevated risk: 42 of 100 risk points, rated 2026-10-18. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a high-impact AWS networking operator: it can create and modify Direct Connect connections, virtual interfaces, LAGs, gateway associations, SiteLink, and VPN-based encryption paths. The main risks are production network disruption, cross-account routing changes, and handling of sensitive MACsec/BGP credentials and LOA-CFA materials.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It drives many shell/API actions such as `aws directconnect create-connection`, `create-lag`, `create-private-virtual-interface`, and even `base64 --decode > loa.pdf`, so it can execute administrative commands but not arbitrary code.
Network access	3 (high)	Its purpose is to build and alter WAN connectivity, including Direct Connect, SiteLink, Direct Connect gateway associations, and `aws ec2 create-vpn-connection`, which can reroute or expose traffic across accounts and Regions.
Filesystem reach	1 (low)	It only writes locally in a limited way, e.g. decoding LOA-CFA to `loa.pdf` and advising deletion of local copies, with no broad access to arbitrary host paths.
Secrets & credentials	2 (moderate)	It handles sensitive network credentials like the BGP MD5 key and MACsec CKN/CAK pair, and explicitly requires storing MACsec material in Secrets Manager via `--secret-arn`.
Privilege & persistence	0 (none)	The skill does not require sudo, install services, edit shell startup files, or change OS-level settings on the host machine.
Instruction hijack surface	0 (none)	I found no instructions to ignore higher-level rules, follow fetched remote content, hide actions, or otherwise subvert the agent's controls.
Irreversible actions	3 (high)	It authorizes state-changing and potentially disruptive actions like `create-connection`, `associate/disassociate-connection-from-lag`, `update-lag`, `create-direct-connect-gateway-association`, `create-vpn-connection`, and `start-bgp-failover-test`.
Transparency	0 (none)	All shipped files are readable Markdown with inline commands; there are no binaries, minified blobs, or decoded-at-runtime code.

Before installing

Review every reference that can affect live traffic, especially LAG changes, gateway associations, and migration steps.
Confirm the AWS principal uses ephemeral credentials and is limited to the exact Direct Connect actions needed.
Decide whether you will allow the skill to handle MACsec/BGP secrets and where those secrets will be stored.
Test first in a nonproduction AWS account or with a noncritical connection, since several procedures are disruptive by design.

Rated 2026-10-18 by an automated review of 9 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/networking-and-content-delivery-skills/directconnect/SKILL.md
Branch: main
Updated: 2026-09-19

transitgateway — Configures AWS Transit Gateway: creating a hub and attaching VPCs, segmenting traffic with route tables.
connecting-vpcs-with-peering — Establishes VPC peering connections between two VPCs for direct private network connectivity.
route53 — Configures Amazon Route 53 DNS: public and private records, traffic-steering routing policies, health checks, DNS Firewall, Route 53 Profiles.
sitetositevpn — Configures AWS Site-to-Site VPN: creating an IPsec VPN connection between an on-premises network and a VPC.
app-platform-networking — Configure domains, routing, CORS, VPC, static IPs, and inter-service communication for DigitalOcean App Platform.
aws-network-monitoring — Installs, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor network path health.