transitgateway

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: aws, hub-and-spoke, hybrid-cloud, networking, routing.

What it does

Configures AWS Transit Gateway: creating a hub and attaching VPCs, segmenting traffic with route tables, centralizing egress and inspection through a hub (appliances or a Gateway Load Balancer endpoint), forcing east-west traffic between VPCs through AWS Network Firewall, connecting on-premises networks over the transit-gateway side of a Site-to-Site VPN or Direct Connect attachment (including ECMP to aggregate bandwidth across multiple VPN tunnels), peering transit gateways across Regions, migrating from a VPC peering mesh, and routing IP multicast. Applicable when connecting many VPCs through one router, isolating environments, forcing VPC-to-VPC traffic through a central Network Firewall, reaching on-premises over the hub, linking Regions, or moving off a peering mesh. Not applicable for single-VPC routing, VPC peering between two VPCs (vpcpeering skill), Direct Connect gateway or virtual interface setup (directconnect skill), or Route 53 DNS work.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill transitgateway

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/networking-and-content-delivery-skills/transitgateway ~/.claude/skills/transitgateway

Safety box score

Grade D, elevated risk: 33 of 100 risk points, rated 2026-10-23. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill configures AWS Transit Gateway networking across VPCs, Regions, VPN/Direct Connect, multicast, and firewall/egress paths. Its main risk is broad, immediate traffic rerouting in an AWS account, including operations that can drop connectivity or delete peering links if the wrong routes or CIDRs are used.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It drives real AWS operations via explicit commands such as `aws ec2 create-transit-gateway`, `aws ec2 create-transit-gateway-route`, and `aws directconnect create-direct-connect-gateway-association`, but it does not ship or evaluate arbitrary code.
Network access	3 (high)	The skill is entirely about configuring transit gateways, VPC attachments, VPN/Direct Connect, peering, multicast, and inspection paths, so it can reroute traffic across many networks and Regions.
Filesystem reach	0 (none)	The files only describe AWS API/CLI actions; they do not read, write, or delete local files, dotfiles, or system paths.
Secrets & credentials	1 (low)	It touches AWS identity and sensitive connection material by requiring `aws sts get-caller-identity` and, for VPN PSKs, `TunnelOptions[].PreSharedKey` to be stored in Secrets Manager.
Privilege & persistence	0 (none)	There is no sudo, service installation, shell startup editing, or other local privilege change in the files.
Instruction hijack surface	0 (none)	I found no instructions to ignore higher-priority rules, hide actions, fetch remote instructions, or use obfuscated/hidded payloads.
Irreversible actions	3 (high)	The skill can create, modify, and delete live networking resources; for example it includes `delete-vpc-peering-connection` and multiple `create-*`/route-edit steps that take effect immediately.
Transparency	0 (none)	All shipped files are readable Markdown with explicit command examples; there are no binaries, base64 blobs, or downloaded installers.

Before installing

Read `references/migrating-from-vpc-peering.md` if you may cut over or remove peering; it can delete rollback links.
Confirm the AWS principal is an assumed role with least-privilege TGW permissions, not a broad admin user.
Test in a scratch account/region first, especially for route-table changes and any VPN or peering cutover.
Make sure your Flow Logs/CloudTrail destinations already use KMS-encrypted CloudWatch Logs or S3 before running it.

Rated 2026-10-23 by an automated review of 9 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/networking-and-content-delivery-skills/transitgateway/SKILL.md
Branch: main
Updated: 2026-09-19

directconnect — Configures AWS Direct Connect: choosing a connection model (dedicated, hosted, or a link aggregation group) and completing the cross connect; creating private.
connecting-vpcs-with-peering — Establishes VPC peering connections between two VPCs for direct private network connectivity.
route53 — Configures Amazon Route 53 DNS: public and private records, traffic-steering routing policies, health checks, DNS Firewall, Route 53 Profiles.
sitetositevpn — Configures AWS Site-to-Site VPN: creating an IPsec VPN connection between an on-premises network and a VPC.
app-platform-networking — Configure domains, routing, CORS, VPC, static IPs, and inter-service communication for DigitalOcean App Platform.
aws-network-monitoring — Installs, configures, and troubleshoots Network Flow Monitor agents on EC2 instances to monitor network path health.