From aws
Provision and sync AWS networking resources — Transit Gateway, Spoke VPCs, subnets, route tables, security groups, and Route 53 hosted zones — from a networking-design.md and naming-convention.md. Uses the AWS MCP server. Use when applying or updating AWS networking after running design-networking.
How this skill is triggered — by the user, by Claude, or both
Slash command
/aws:manage-aws-networkingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Implementation
Implementation
ec2:CreateVpc, ec2:CreateSubnet, ec2:CreateRouteTable, ec2:CreateSecurityGroupec2:CreateTransitGateway, ec2:CreateTransitGatewayVpcAttachmentec2:CreateTransitGatewayRouteTable, ec2:CreateTransitGatewayRouteroute53:CreateHostedZone, route53:AssociateVPCWithHostedZoneram:CreateResourceShare (if sharing Transit Gateway across accounts via RAM)manage-aws-landing-zone).Apply the networking definition from networking-design.md to AWS. Ensure that:
(Sector, Tier, Region) with correct CIDRs and subnets.This skill is idempotent.
When writing configurations or documentation, you MUST strictly adhere to the structural notation and types defined in the book. Before proceeding, read the following reference files:
references/notation.mdreferences/types.mdnetworking-design.md. Read it first.naming-convention.md.landing-zone-design.md).Read all input documents before proceeding.
In the hub/network account:
DefaultRouteTableAssociation: disable (use custom route tables for explicit routing control)DefaultRouteTablePropagation: disableAutoAcceptSharedAttachments: enable (if accounts are within the same Organization)Create dedicated route tables on the Transit Gateway to enforce spoke isolation:
| Route Table | Purpose | Associates | Propagates From |
|---|---|---|---|
rt-hub | Hub/platform spoke routes | Hub VPC attachment | All spokes |
rt-sandbox | Tier("sandbox") isolation | Sandbox VPC attachments | Sandbox spokes only |
rt-live | Tier("live") isolation | Live VPC attachments | Live spokes only |
Key rules:
For each spoke in the networking design (operating in the spoke's Account):
For each spoke VPC, create the required subnets across Availability Zones:
| Subnet Purpose | CIDR Offset | AZ distribution |
|---|---|---|
| Public | .0.0/24 split across 3 AZs | /26 per AZ |
| Private | .1.0/22 split across 3 AZs | /24 per AZ |
| Data | .5.0/24 split across 3 AZs | /26 per AZ |
| Transit (TGW attachment) | .6.0/28 per AZ | /28 per AZ |
The Transit subnets host the TGW VPC attachment ENIs — they should be small (/28) and carry no other resources.
For each spoke VPC:
rt-hub route table so the hub can reach it.0.0.0.0/0) in the spoke's private subnet route tables pointing to the TGW attachment (for centralized egress) or to a NAT Gateway (for decentralized egress).Centralized egress: Deploy NAT Gateways in the hub account's public subnets. Configure the hub VPC's routing so all spoke traffic exits through these NATs. Update spoke private route tables to forward 0.0.0.0/0 to the TGW.
Decentralized egress: Deploy NAT Gateways in the public subnets of each spoke VPC. Update spoke private route tables to forward 0.0.0.0/0 to the local NAT Gateway.
Create baseline Security Groups in each spoke account. These are templates — applications create their own SGs but must reference these for baseline rules:
sg-platform-inbound: Allow inbound from platform/hub CIDR on management ports. Used on all EC2 and EKS nodes.sg-internal-only: Allow inbound from spoke CIDR only; deny internet. Default for data-tier resources.sg-public-lb: Allow inbound 443, 80 from 0.0.0.0/0. Used only on internet-facing load balancers.For each spoke, create a Private Hosted Zone:
eu01.live.internal.ecommerce.mountainlab.io) in the spoke account.If using Route 53 Resolver (inbound/outbound endpoints) for hybrid DNS:
Produce a summary of all resources created, already existing, or skipped.
Produce a Markdown report named aws-networking-report.md:
# AWS Networking Sync Report
**Date**: [timestamp]
**Mode**: [applied / dry-run]
## Transit Gateway
| TGW ID | Account | Region | RAM Shared | Status |
|--------|---------|--------|-----------|--------|
| tgw-xxx | network-hub (123456789012) | eu-west-1 | Yes (Org) | created |
## TGW Route Tables
| Name | Associates | Status |
|------|-----------|--------|
| rt-live | live VPC attachments | created |
| rt-sandbox | sandbox VPC attachments | created |
## Spoke VPCs
| Name | Account | CIDR | TGW Attached | Route Table | Status |
|------|---------|------|-------------|------------|--------|
| vpc-ecommerce-live-eu01 | ecommerce-live | 10.32.0.0/16 | yes | rt-live | created |
## Private Hosted Zones
| Zone | Account | VPC Associations | Status |
|------|---------|-----------------|--------|
| eu01.live.internal.ecommerce.mountainlab.io | ecommerce-live | vpc-ecommerce-live-eu01 | created |
## Direct VPC Peerings Found
[List any found — should be empty]
## Open Items
[RAM share acceptance pending, TGW attachment propagation delay, etc.]
/28 transit subnets exist solely for TGW attachment ENIs. No application resources should be placed there.This skill is grounded in Chapter 6: Infrastructure of Crafting Platforms.
npx claudepluginhub craftingplatforms/ai --plugin awsGuides AWS VPC network design: subnet tiers (public/private/database), AZ distribution, CIDR ranges, NAT gateways, private endpoints, DNS zones, API gateways.
Designs, reviews, and troubleshoots AWS network connectivity including VPCs, Transit Gateway, Direct Connect, VPN, Cloud WAN, Route 53 Resolver, private DNS, CIDRs, route tables, endpoints, segmentation, ingress, egress, inspection, and failover.
Design and build networking infrastructure — VPCs, subnets, DNS, load balancers, firewall rules. Use when asked to "set up networking", "VPC design", "configure DNS", "load balancer setup", "network architecture", or "firewall rules".