AutoGineer
Generated banner for Configuring Vpc Endpoints For Private AWS Service Access
Generated logo for Configuring Vpc Endpoints For Private AWS Service Access

Configuring Vpc Endpoints For Private AWS Service Access

AWSOfficialPublished by AWS

  • Skill
  • Workflow
  • Cloud and DevOps
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink. Use when setting up secure private connectivity to S3, DynamoDB, and other AWS services without internet gateway, NAT device, or public IP addresses. Covers endpoint creation, security groups, route tables, and DNS configuration.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a standardized workflow for setting up VPC endpoints, allowing resources within an AWS VPC to communicate with AWS services privately. It covers the creation of both gateway endpoints for services like S3 and DynamoDB, and interface endpoints powered by AWS PrivateLink for services like EC2, SSM, and Secrets Manager. The process includes parameter validation, dependency checks, security group configuration, and route table updates to ensure secure network architecture without requiring internet gateways or NAT devices.

What it does

  • Validates VPC and subnet configurations for endpoint deployment.
  • Identifies and categorizes required services into gateway or interface endpoints.
  • Automates the creation of security groups for interface endpoints with appropriate HTTPS rules.
  • Checks for existing endpoints to prevent duplication.
  • Configures route tables and DNS settings for private service access.
  • Provides troubleshooting guidance for common connectivity and DNS resolution issues.

When to use it

  • When you need to access AWS services from a private subnet without an internet gateway.
  • When security requirements mandate that traffic to AWS services stays within the AWS network.
  • When you need to reduce data transfer costs by avoiding NAT gateways for AWS service traffic.
  • When setting up private access to services like S3, DynamoDB, SSM, or Secrets Manager.

Advantages

  • Enhances network security by eliminating the need for public IP addresses.
  • Reduces complexity by removing the dependency on NAT devices for service access.
  • Ensures consistent configuration through a structured, step-by-step validation process.
  • Prevents configuration errors by verifying VPC and subnet settings before deployment.

Usage examples

“Configure VPC endpoints for S3 and SSM in my VPC vpc-12345678.”
The agent will initiate the workflow to validate the VPC, check for existing endpoints, and guide you through creating the necessary gateway and interface endpoints.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/aws/configuring-vpc-endpoints-for-private-aws-service-access/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip configuring-vpc-endpoints-for-private-aws-service-access.zip -d .agents/skills

Documentation by AWS

Configuring VPC Endpoints for Private AWS Service Access

Overview

Domain expertise for configuring VPC endpoints to enable private access to AWS services without routing traffic through the internet. Covers both gateway endpoints (S3, DynamoDB) and interface endpoints (EC2, SSM, Secrets Manager, etc.) powered by AWS PrivateLink.

Configure VPC endpoints

To create and configure VPC endpoints for private AWS service access, follow the procedure exactly. See VPC endpoints configuration procedure.

Troubleshooting

Endpoint not available

Check security group rules, subnet configurations, and service availability in the region.

DNS resolution issues

Verify DNS hostnames and DNS resolution are enabled on the VPC and that the DHCP options set has correct domain name servers.

Connection timeouts

Verify security group rules allow HTTPS traffic (port 443) and route tables are properly configured for gateway endpoints.

Policy restrictions

Review endpoint policies — default policies allow all access, but custom policies may be restrictive.

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · skills/specialized-skills/networking-and-content-delivery-skills/configuring-vpc-endpoints-for-private-aws-service-access · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download configuring-vpc-endpoints-for-private-aws-service-access.zip