skill CX Codex

configuring-vpc-endpoints-for-private-aws-service-access

Q: How do I install this skill in Claude?

Run `npx skills add aws/agent-toolkit-for-aws --skill configuring-vpc-endpoints-for-private-aws-service-access -a claude-code`. The skill file then lives at `~/.claude/skills/configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md`.

A skill that walks the agent through VPC endpoint setup with AWS PrivateLink, so AWS services stay reachable without an internet gateway or public IPs.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓

npx skills add aws/agent-toolkit-for-aws --skill configuring-vpc-endpoints-for-private-aws-service-access -a claude-code

Open on GitHub

What configuring-vpc-endpoints-for-private-aws-service-access does

The skill hands the agent domain knowledge for VPC endpoints: gateway endpoints for S3 and DynamoDB, interface endpoints for EC2, SSM, Secrets Manager and other services on AWS PrivateLink. Ask it to set up private connectivity and it follows the procedure in references/configure-vpc-endpoints-for-private-aws-service-access.md instead of improvising a config.

Inside are the setup procedure and a troubleshooting section. If an endpoint is unreachable, it checks security group rules, subnet configuration and whether the service exists in the region. DNS problems mean verifying that DNS hostnames and DNS resolution are enabled on the VPC and that the DHCP options set points at the right name servers. Connection timeouts usually come down to port 443 or to route tables for gateway endpoints.

Endpoint policies get their own note. Default policies allow all access, but a custom one can block the calls you need, and that is the first thing to check when traffic stalls. The skill installs into Claude, Codex, Cursor, GitHub Copilot, Gemini CLI and OpenCode.

What it helps with

set up private access to S3 and DynamoDB without a NAT device
create an interface endpoint for SSM or Secrets Manager
debug an endpoint that never becomes available
fix DNS resolution inside a VPC
check route tables for a gateway endpoint

Example prompts for the agent

set up VPC endpoints for private access to S3 and DynamoDB
why does DNS not resolve for my interface endpoint
check the endpoint policy, traffic to Secrets Manager is failing

How to install configuring-vpc-endpoints-for-private-aws-service-access

1Skills CLI (Vercel)

npx skills add aws/agent-toolkit-for-aws --skill configuring-vpc-endpoints-for-private-aws-service-access -a claude-code

2Manually: put the files in place

~/.claude/skills/configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/configuring-vpc-endpoints-for-private-aws-service-access/

1Skills CLI (Vercel)

npx skills add aws/agent-toolkit-for-aws --skill configuring-vpc-endpoints-for-private-aws-service-access -a codex

2Manually: put the files in place

.agents/skills/configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md

For all projects use ~/.agents/skills/

1Skills CLI (Vercel)

npx skills add aws/agent-toolkit-for-aws --skill configuring-vpc-endpoints-for-private-aws-service-access -a cursor

2Manually: put the files in place

.cursor/skills/configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md

Cursor also reads .agents/skills/ and .claude/skills/

1GitHub CLI

gh skill install aws/agent-toolkit-for-aws configuring-vpc-endpoints-for-private-aws-service-access

2Manually: put the files in place

.github/skills/configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md

1Skills CLI (Vercel)

npx skills add aws/agent-toolkit-for-aws --skill configuring-vpc-endpoints-for-private-aws-service-access -a gemini-cli

2Platform CLI

gemini skills install https://github.com/aws/agent-toolkit-for-aws --path skills/specialized-skills/networking-and-content-delivery-skills/configuring-vpc-endpoints-for-private-aws-service-access

Manually: put the files in place

.devin/skills/configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md

The legacy .windsurf/skills/ path still works

Skills CLI (Vercel)

npx skills add aws/agent-toolkit-for-aws --skill configuring-vpc-endpoints-for-private-aws-service-access -a opencode

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about configuring-vpc-endpoints-for-private-aws-service-access

How do I install this skill in Claude?

Run npx skills add aws/agent-toolkit-for-aws --skill configuring-vpc-endpoints-for-private-aws-service-access -a claude-code. The skill file then lives at ~/.claude/skills/configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md.

What does this skill do?

It guides the agent through creating and configuring VPC endpoints: gateway endpoints for S3 and DynamoDB, interface endpoints via AWS PrivateLink for other services. It also covers security groups, route tables and DNS.

Why is my endpoint still not working?

The skill says to check security group rules, subnet configuration and service availability in the region. For DNS, confirm that DNS hostnames and DNS resolution are enabled on the VPC and that the DHCP options set has the correct name servers.

Source text

SKILL.md · Apache-2.0

---
name: configuring-vpc-endpoints-for-private-aws-service-access
description: Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink. Use when setting up secure private connectivity to S3, DynamoDB, and other AWS services without internet gateway, NAT device, or public IP addresses. Covers endpoint creation, security groups, route tables, and DNS configuration.
version: 1
---

# Configuring VPC Endpoints for Private AWS Service Access

## Overview

Domain expertise for configuring VPC endpoints to enable private access to AWS services
without routing traffic through the internet. Covers both gateway endpoints (S3, DynamoDB)
and interface endpoints (EC2, SSM, Secrets Manager, etc.) powered by AWS PrivateLink.

## Configure VPC endpoints

To create and configure VPC endpoints for private AWS service access, follow the procedure exactly.
See [VPC endpoints configuration procedure](references/configure-vpc-endpoints-for-private-aws-service-access.md).

## Troubleshooting

### Endpoint not available

Check security group rules, subnet configurations, and service availability in the region.

### DNS resolution issues

Verify DNS hostnames and DNS resolution are enabled on the VPC and that the DHCP options set has correct domain name servers.

### Connection timeouts

Verify security group rules allow HTTPS traffic (port 443) and route tables are properly configured for gateway endpoints.

### Policy restrictions

Review endpoint policies — default policies allow all access, but custom policies may be restrictive.

Similar skills

Everything for Cloud: AWS, Azure, GCP →

aws-vpc devops-skills Designs and provisions multi-tier AWS VPC networks with isolated subnets and routing. Useful when setting up cloud network infrastructure. CX Codex +1 328installs private-connectivity grafana Sets up private network connectivity to Grafana Cloud over AWS PrivateLink, Azure Private Link, GCP Private Service Connect and PDC. Useful when telemetry must stay off the public internet. CX Codex +1 4,100installs huawei-cloud-network-query huaweicloud Read-only queries for Huawei Cloud network resources like VPC, ELB, NAT, and DNS using local Python scripts. Built to inspect topology and security settings without cloud mutations. CX Codex +1 17,000installs aws-s3 devops-skills Hardens Amazon S3 buckets with SSE-KMS encryption, lifecycle transitions, bucket policies, and cross-region replication via AWS CLI. CX Codex +1 345installs aws-cloud-expert official github Subagent for designing, deploying, and optimizing AWS workloads. Covers serverless, containers, databases, networking, IaC, and security through the AWS Well-Architected Framework lens. ★ 40,418repo stars aws-sdk-java-v2-kms giuseppe-trisciuoglio This skill provides AWS KMS patterns for AWS SDK for Java 2.x, covering keys, encryption, data keys, signatures, and Spring Boot integration. CX Codex +1 3,700installs

From the same set133

troubleshooting-s3-files Diagnoses Amazon S3 Files issues, from mount timeouts and IAM permission errors to sync delays and file conflicts. CX Codex +1 6,300installs launching-ec2-instance-with-best-practices This skill launches EC2 instances with security and cost controls in place. Use it when deploying a new AWS instance and checking its setup after launch. CX Codex +1 6,300installs setting-up-cloudwatch-alarm-notifications Wires CloudWatch alarms to notification channels through SNS: encrypted topics, subscriptions, access policies and alarm actions. CX Codex +1 6,300installs debugging-lambda-timeouts Investigates AWS Lambda timeout failures by inspecting CloudWatch logs, metrics, and configurations. Use it when function runs hit or approach execution limits. CX Codex +1 6,400installs setting-up-ec2-instance-profiles Configures EC2 instance profiles and IAM roles so applications call AWS services without hardcoded credentials. Useful when an instance needs temporary access to S3, DynamoDB, or SQS. CX Codex +1 6,200installs routing-traffic-with-route53-and-cloudfront Sets up Route 53 to send a custom domain to a CloudFront distribution with HTTPS and IPv6. Use it when creating alias records or connecting a domain to CloudFront. CX Codex +1 6,200installs creating-api-gateway-stage Builds an API Gateway stage with CloudWatch logging, X-Ray tracing, throttling and WAF. Handy when a REST API ships to dev, test or production. CX Codex +1 6,200installs creating-production-vpc-multi-az Plan a VPC across multiple Availability Zones, with public and private subnets, NAT gateways, routing, and security groups. Use it when setting up AWS network infrastructure. CX Codex +1 6,100installs