Skills Explorer Add Skills

routing-traffic-with-route53-and-cloudfront

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, cloudfront, dns, routing, web.

What it does

Configures Amazon Route 53 to route traffic to a CloudFront distribution using a custom domain. Use when setting up DNS alias records, alternate domain names (CNAMEs), ACM certificates for HTTPS, and IPv6 support for CloudFront.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill routing-traffic-with-route53-and-cloudfront

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/networking-and-content-delivery-skills/routing-traffic-with-route53-and-cloudfront ~/.claude/skills/routing-traffic-with-route53-and-cloudfront

Safety box score

Grade C, moderate risk: 35 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill configures live AWS Route 53, CloudFront, and ACM resources so a custom domain routes to a CloudFront distribution. The main risk is broad account-level change to public DNS/CDN state using whatever AWS credentials are active; it does not appear to touch local files or install software.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It directs the agent to run shell commands such as `aws sts get-caller-identity`, `aws cloudfront get-distribution`, `aws route53 change-resource-record-sets`, `nslookup`, and `dig`, which is real command execution but not arbitrary code.
Network access2 (moderate)The skill makes outbound AWS API calls to Route 53, CloudFront, and ACM and uses DNS lookup tools, so configuration and query data leave the machine over the network.
Filesystem reach0 (none)No reading, writing, or deleting of local files outside the repo is described; the workflow is entirely AWS API and DNS checks.
Secrets & credentials2 (moderate)It relies on the user's active AWS credentials (`aws sts get-caller-identity`) and can act on resources in that account, but it does not ask for passwords, keys, or secret files directly.
Privilege & persistence0 (none)There is no sudo, service installation, shell startup editing, or other local privilege escalation described.
Instruction hijack surface0 (none)The markdown contains procedural instructions only; it does not ask the agent to ignore its rules, hide anything, or follow untrusted remote content.
Irreversible actions3 (high)It can create hosted zones, request ACM certificates, update CloudFront distributions, and upsert DNS records, which are live public-facing changes and can reroute traffic without an explicit human approval gate for each action.
Transparency0 (none)The skill files are plain readable markdown with no binaries, minified code, decoded blobs, or unpinned downloads.

Before installing

Rated 2026-10-19 by an automated review of 2 files from the skill's repository.

Source

Repository
aws/agent-toolkit-for-aws (all skills from this repository)
Path
skills/specialized-skills/networking-and-content-delivery-skills/routing-traffic-with-route53-and-cloudfront/SKILL.md
Branch
main
Updated
2026-09-19