enabling-lambda-vpc-internet-access

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, lambda, nat-gateway, networking, vpc.

What it does

Enables internet access for AWS Lambda functions deployed in VPC subnets by creating NAT Gateway infrastructure, configuring public/private subnet routing, and updating security groups. Use when a VPC-attached Lambda function cannot reach the internet.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill enabling-lambda-vpc-internet-access

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/networking-and-content-delivery-skills/enabling-lambda-vpc-internet-access ~/.claude/skills/enabling-lambda-vpc-internet-access

Safety box score

Grade C, moderate risk: 28 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill provisions and re-wires AWS VPC networking for a Lambda function: Internet Gateway, public subnet, NAT Gateway, route tables, and security-group egress. The main risks are billable infrastructure creation and broad network changes that can expose or reroute traffic, all through AWS API calls under the operator’s credentials.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It requires running AWS CLI commands such as `aws lambda get-function` and `aws ec2 create-nat-gateway`, so the agent is executing shell/API operations, though no custom code or shipped scripts are included.
Network access	2 (moderate)	The skill makes outbound requests to AWS APIs to read and modify VPC, subnet, route-table, NAT Gateway, and security-group state, changing how traffic leaves the Lambda environment.
Filesystem reach	1 (low)	It says to "save the current configuration details for reference" and to "save any acquired data to a consistent location," but it does not specify any sensitive or system paths.
Secrets & credentials	0 (none)	The skill does not ask for passwords, tokens, key files, `.env` content, browser sessions, or other credential stores.
Privilege & persistence	0 (none)	It does not request sudo, global installs, services, cron jobs, or OS/shell configuration changes.
Instruction hijack surface	0 (none)	I found no instructions to ignore higher-priority policy, hide actions, follow remote instructions, or bypass confirmation; the "MUST NOT create any billable resources without user approval" line is a safety constraint, not an injection attempt.
Irreversible actions	3 (high)	Its purpose is to create and modify live cloud infrastructure—NAT Gateway, Internet Gateway, subnets, route tables, and security-group egress—with side effects that persist and incur cost, even though it asks for approval first.
Transparency	0 (none)	All shipped content is plain Markdown; there are no binaries, encoded blobs, unpinned downloads, or decoded-at-runtime code.

Before installing

Verify the AWS CLI profile and target account are the ones you intend to change.
Read the planned resource list and confirm the VPC, AZ, and Lambda function name are correct.
Estimate NAT Gateway and Elastic IP monthly cost before allowing the skill to proceed.
Test on a nonproduction VPC first if you are unsure about the subnet and route-table changes.

Rated 2026-10-20 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/networking-and-content-delivery-skills/enabling-lambda-vpc-internet-access/SKILL.md
Branch: main
Updated: 2026-09-19

configuring-vpc-endpoints-for-private-aws-service-access — Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink.
connecting-vpcs-with-peering — Establishes VPC peering connections between two VPCs for direct private network connectivity.
creating-production-vpc-multi-az — Creates a production-ready VPC with public and private subnets across multiple Availability Zones, including internet gateway, NAT gateways, route tables.
aws-serverless — Builds, deploys, manages, debugs, configures, and optimizes serverless applications on AWS using Lambda, API Gateway, Step Functions, EventBridge, and SAM/CDK.
app-platform-networking — Configure domains, routing, CORS, VPC, static IPs, and inter-service communication for DigitalOcean App Platform.
aws-lambda-durable-functions — Builds resilient, long-running, multi-step applications with AWS Lambda durable functions with automatic state persistence, retry logic.