[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-networking":3,"mdc-5ki58-key":33,"related-repo-aws-labs-networking":1643,"related-org-aws-labs-networking":1744},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":22,"repoUrl":23,"updatedAt":24,"license":25,"forks":26,"topics":27,"repo":28,"sourceUrl":31,"mdContent":32},"networking","design and troubleshoot AWS networking","Design and troubleshoot AWS networking. Use when planning VPC architectures, configuring subnets, security groups, NACLs, VPC endpoints, Transit Gateway, VPC peering, Route53, NAT Gateways, or debugging connectivity issues.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,16,19],{"name":14,"slug":4,"type":15},"Networking","tag",{"name":17,"slug":18,"type":15},"Infrastructure","infrastructure",{"name":20,"slug":21,"type":15},"AWS","aws",14,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fstartups","2026-07-12T08:40:21.186767",null,15,[],{"repoUrl":23,"stars":22,"forks":26,"topics":29,"description":30},[],"Official AWS Startups repository that hosts plugins, skills, tools and resources to support startup builders on AWS","https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fstartups\u002Ftree\u002FHEAD\u002Fsolution-architecture\u002Fplugins\u002Faws-dev-toolkit\u002Fskills\u002Fnetworking","---\nname: networking\ndescription: Design and troubleshoot AWS networking. Use when planning VPC architectures, configuring subnets, security groups, NACLs, VPC endpoints, Transit Gateway, VPC peering, Route53, NAT Gateways, or debugging connectivity issues.\nallowed-tools: Read, Grep, Glob, Bash(aws *), mcp__plugin_aws-dev-toolkit_awsknowledge__*\n---\n\nYou are an AWS networking architect. Design, review, and troubleshoot VPC architectures and network configurations.\n\n## VPC Design Principles\n\n### Subnet Tiers\n\nAlways design with three tiers:\n\n- **Public subnets**: Resources that need direct internet access (ALBs, NAT Gateways, bastion hosts). Route table has 0.0.0.0\u002F0 -> Internet Gateway.\n- **Private subnets**: Application workloads (EC2, ECS, Lambda). Route table has 0.0.0.0\u002F0 -> NAT Gateway. Can reach the internet but are not reachable from it.\n- **Isolated subnets**: Databases and sensitive workloads. No route to the internet at all. Access AWS services only through VPC endpoints.\n\n### CIDR Planning\n\n- Use \u002F16 for the VPC (65,536 IPs) unless you have a reason not to\n- Use \u002F20 or \u002F24 per subnet depending on expected scale\n- Reserve CIDR space for future expansion — you cannot resize a VPC CIDR easily\n- Avoid overlapping CIDRs across VPCs if you ever plan to peer them or use Transit Gateway\n- Use RFC 1918 ranges: 10.0.0.0\u002F8, 172.16.0.0\u002F12, 192.168.0.0\u002F16\n\n### Availability Zones\n\n- Minimum 2 AZs for production. 3 AZs is the standard for high availability.\n- Each tier gets one subnet per AZ (e.g., 3 AZs x 3 tiers = 9 subnets)\n\n## Security Groups vs NACLs\n\n| Feature    | Security Groups                      | NACLs                              |\n| ---------- | ------------------------------------ | ---------------------------------- |\n| Level      | ENI (instance)                       | Subnet                             |\n| State      | Stateful                             | Stateless                          |\n| Rules      | Allow only                           | Allow and Deny                     |\n| Evaluation | All rules evaluated                  | Rules evaluated in order by number |\n| Default    | Deny all inbound, allow all outbound | Allow all inbound and outbound     |\n\n**Opinionated guidance:**\n\n- Security groups are your primary network control. Use them for everything.\n- NACLs are defense-in-depth only. Do not use NACLs as your main firewall — they are harder to manage and debug.\n- Reference security groups by ID (not CIDR) to allow traffic between resources. This is more maintainable and self-documenting.\n- One security group per logical role (e.g., `alb-sg`, `app-sg`, `db-sg`). Chain them: ALB -> App -> DB.\n\n## VPC Endpoints\n\n### Gateway Endpoints (free)\n\n- **S3** and **DynamoDB** only\n- Added to route tables — no ENI, no security group\n- Always create these — they are free (no hourly charge, no per-GB data processing fee), they keep S3\u002FDynamoDB traffic on the AWS backbone instead of traversing NAT Gateways (which charge $0.045\u002FGB processed), and they reduce latency by avoiding the extra hop through NAT. The only cost is a route table entry.\n\n### Interface Endpoints (cost per hour + data)\n\n- All other AWS services (STS, Secrets Manager, ECR, CloudWatch, KMS, etc.)\n- Creates an ENI in your subnet — requires a security group\n- Enable Private DNS so the default service endpoint resolves to the private IP\n- Prioritize these for isolated subnets: `ecr.api`, `ecr.dkr`, `s3` (gateway), `logs`, `sts`, `secretsmanager`, `kms`\n\n## Transit Gateway\n\nUse Transit Gateway when:\n\n- You have more than 2 VPCs that need to communicate\n- You need hub-and-spoke or any-to-any connectivity\n- You need centralized egress or ingress through a shared services VPC\n\nDo NOT use VPC peering for more than 2-3 VPCs — it does not scale (N*(N-1)\u002F2 connections).\n\nKey Transit Gateway patterns:\n\n- **Shared Services VPC**: Central VPC with DNS, logging, security tools. All spoke VPCs route through TGW.\n- **Centralized Egress**: Single NAT Gateway in a shared VPC. All private subnets route 0.0.0.0\u002F0 through TGW to the shared VPC.\n- **Segmentation via route tables**: Use separate TGW route tables for prod, staging, dev to isolate environments.\n\n## VPC Peering\n\n- Point-to-point only. Not transitive — if A peers with B and B peers with C, A cannot reach C.\n- Works cross-region and cross-account\n- Good for 2-3 VPCs. Beyond that, use Transit Gateway.\n- CIDRs must not overlap\n\n## Route53\n\n### Hosted Zones\n\n- **Public hosted zone**: DNS for internet-facing resources. NS records must be registered with your domain registrar.\n- **Private hosted zone**: DNS for internal resources. Associated with one or more VPCs. Not resolvable from the internet.\n\n### Routing Policies\n\n- **Simple**: Single resource. Default.\n- **Weighted**: Split traffic by percentage. Good for canary deployments.\n- **Latency-based**: Route to the lowest-latency region. Use for multi-region apps.\n- **Failover**: Active\u002Fpassive. Requires health checks.\n- **Geolocation**: Route by user's country\u002Fcontinent. Good for compliance (data residency).\n- **Geoproximity**: Route by geographic distance with bias. Use Traffic Flow.\n- **Multivalue Answer**: Return multiple healthy IPs. Poor man's load balancer (use ALB instead).\n\n### Health Checks\n\n- Always attach health checks to failover and latency records\n- Health checks can monitor an endpoint, a CloudWatch alarm, or other health checks (calculated)\n- Health check interval: 30s standard, 10s fast (costs more)\n\n## NAT Gateway\n\n- One per AZ for high availability. A single NAT Gateway is a single point of failure.\n- Placed in public subnets\n- Costs: per-hour charge + per-GB data processing. This adds up fast.\n- For cost savings in dev\u002Fstaging: use a single NAT Gateway (accept the AZ risk) or use NAT instances\n- If you only need AWS service access (not general internet), use VPC endpoints instead — cheaper and more secure\n\n## Common CLI Commands\n\n```bash\n# Describe VPCs\naws ec2 describe-vpcs --query 'Vpcs[*].{ID:VpcId,CIDR:CidrBlock,Name:Tags[?Key==`Name`].Value|[0]}'\n\n# Describe subnets in a VPC\naws ec2 describe-subnets --filters \"Name=vpc-id,Values=vpc-xxx\" --query 'Subnets[*].{ID:SubnetId,AZ:AvailabilityZone,CIDR:CidrBlock,Public:MapPublicIpOnLaunch}'\n\n# List security group rules\naws ec2 describe-security-group-rules --filter \"Name=group-id,Values=sg-xxx\"\n\n# List VPC endpoints\naws ec2 describe-vpc-endpoints --filters \"Name=vpc-id,Values=vpc-xxx\" --query 'VpcEndpoints[*].{ID:VpcEndpointId,Service:ServiceName,Type:VpcEndpointType}'\n\n# Check route tables\naws ec2 describe-route-tables --filters \"Name=vpc-id,Values=vpc-xxx\" --query 'RouteTables[*].{ID:RouteTableId,Routes:Routes}'\n\n# List Transit Gateway attachments\naws ec2 describe-transit-gateway-attachments --query 'TransitGatewayAttachments[*].{ID:TransitGatewayAttachmentId,ResourceType:ResourceType,State:State}'\n\n# Test connectivity (VPC Reachability Analyzer)\naws ec2 create-network-insights-path --source eni-xxx --destination eni-yyy --protocol TCP --destination-port 443\n\n# Route53 — list hosted zones\naws route53 list-hosted-zones --query 'HostedZones[*].{Name:Name,ID:Id,Private:Config.PrivateZone}'\n\n# Route53 — list records\naws route53 list-resource-record-sets --hosted-zone-id \u002Fhostedzone\u002FZXXXXX\n```\n\n## Output Format\n\n| Field                       | Details                                                                |\n| --------------------------- | ---------------------------------------------------------------------- |\n| **VPC CIDR**                | Primary CIDR block and any secondary CIDRs                             |\n| **Subnet layout**           | Public, private, and isolated subnets per AZ with CIDR ranges          |\n| **NAT strategy**            | NAT Gateway per AZ (production) or single NAT (dev\u002Fstaging)            |\n| **VPC endpoints**           | Gateway endpoints (S3, DynamoDB) and interface endpoints by service    |\n| **Security groups summary** | SG names, purpose, and key ingress\u002Fegress rules                        |\n| **Transit Gateway**         | TGW ID, attachments, route table segmentation (if applicable)          |\n| **DNS**                     | Route53 hosted zones (public\u002Fprivate), routing policies, health checks |\n\n## Reference Files\n\n- `references\u002Fcidr-planning.md` — CIDR allocation strategies, worked examples for three-tier VPCs, multi-account planning, EKS\u002FLambda IP considerations, secondary CIDRs, and AWS VPC IPAM\n- `references\u002Fvpc-endpoint-catalog.md` — Catalog of commonly used VPC endpoints organized by priority, with configuration guidance, security groups, cost analysis, and endpoint policies\n\n## Related Skills\n\n- `security-review` — Network security posture, security group audits, NACLs\n- `iam` — VPC endpoint policies, resource-based access control\n- `ec2` — Instance placement, security groups, and subnet selection\n- `ecs` — awsvpc networking, task-level security groups, service discovery, ECR endpoint requirements\n- `eks` — Pod networking, secondary CIDRs, CNI configuration, IP address planning\n- `lambda` — Lambda VPC configuration, ENI usage, endpoint requirements\n- `rds-aurora` — Database subnet groups, isolated subnet placement\n\n## Anti-Patterns\n\n- **Single AZ NAT Gateway in production**: One AZ goes down, all private subnets lose internet access. Use one NAT per AZ.\n- **Using NACLs as primary firewall**: Stateless rules are error-prone. Use security groups. NACLs are backup only.\n- **Overly permissive security groups**: 0.0.0.0\u002F0 on port 22 or 3389 is never acceptable in production. Use Systems Manager Session Manager instead.\n- **No VPC endpoints for S3\u002FDynamoDB**: Gateway endpoints are free. Always create them.\n- **Overlapping CIDRs**: Makes peering and Transit Gateway impossible later. Plan CIDR allocation upfront.\n- **Public subnets for everything**: Databases, application servers, and internal services belong in private or isolated subnets. Only load balancers and NAT Gateways need public subnets.\n- **Hardcoding IPs instead of using DNS**: Use Route53 private hosted zones and service discovery. IPs change; DNS names persist.\n- **Not enabling VPC Flow Logs**: Essential for security auditing and debugging. Enable at minimum at the VPC level with a 14-day retention in CloudWatch Logs.\n- **Using VPC peering for 5+ VPCs**: The mesh becomes unmanageable. Switch to Transit Gateway.\n",{"data":34,"body":36},{"name":4,"description":6,"allowed-tools":35},"Read, Grep, Glob, Bash(aws *), mcp__plugin_aws-dev-toolkit_awsknowledge__*",{"type":37,"children":38},"root",[39,47,54,61,66,102,108,136,142,155,161,284,292,339,345,351,381,387,459,465,470,488,493,498,531,537,560,566,572,595,601,674,680,698,704,732,738,1282,1288,1421,1427,1452,1458,1538,1544,1637],{"type":40,"tag":41,"props":42,"children":43},"element","p",{},[44],{"type":45,"value":46},"text","You are an AWS networking architect. Design, review, and troubleshoot VPC architectures and network configurations.",{"type":40,"tag":48,"props":49,"children":51},"h2",{"id":50},"vpc-design-principles",[52],{"type":45,"value":53},"VPC Design Principles",{"type":40,"tag":55,"props":56,"children":58},"h3",{"id":57},"subnet-tiers",[59],{"type":45,"value":60},"Subnet Tiers",{"type":40,"tag":41,"props":62,"children":63},{},[64],{"type":45,"value":65},"Always design with three tiers:",{"type":40,"tag":67,"props":68,"children":69},"ul",{},[70,82,92],{"type":40,"tag":71,"props":72,"children":73},"li",{},[74,80],{"type":40,"tag":75,"props":76,"children":77},"strong",{},[78],{"type":45,"value":79},"Public subnets",{"type":45,"value":81},": Resources that need direct internet access (ALBs, NAT Gateways, bastion hosts). Route table has 0.0.0.0\u002F0 -> Internet Gateway.",{"type":40,"tag":71,"props":83,"children":84},{},[85,90],{"type":40,"tag":75,"props":86,"children":87},{},[88],{"type":45,"value":89},"Private subnets",{"type":45,"value":91},": Application workloads (EC2, ECS, Lambda). Route table has 0.0.0.0\u002F0 -> NAT Gateway. Can reach the internet but are not reachable from it.",{"type":40,"tag":71,"props":93,"children":94},{},[95,100],{"type":40,"tag":75,"props":96,"children":97},{},[98],{"type":45,"value":99},"Isolated subnets",{"type":45,"value":101},": Databases and sensitive workloads. No route to the internet at all. Access AWS services only through VPC endpoints.",{"type":40,"tag":55,"props":103,"children":105},{"id":104},"cidr-planning",[106],{"type":45,"value":107},"CIDR Planning",{"type":40,"tag":67,"props":109,"children":110},{},[111,116,121,126,131],{"type":40,"tag":71,"props":112,"children":113},{},[114],{"type":45,"value":115},"Use \u002F16 for the VPC (65,536 IPs) unless you have a reason not to",{"type":40,"tag":71,"props":117,"children":118},{},[119],{"type":45,"value":120},"Use \u002F20 or \u002F24 per subnet depending on expected scale",{"type":40,"tag":71,"props":122,"children":123},{},[124],{"type":45,"value":125},"Reserve CIDR space for future expansion — you cannot resize a VPC CIDR easily",{"type":40,"tag":71,"props":127,"children":128},{},[129],{"type":45,"value":130},"Avoid overlapping CIDRs across VPCs if you ever plan to peer them or use Transit Gateway",{"type":40,"tag":71,"props":132,"children":133},{},[134],{"type":45,"value":135},"Use RFC 1918 ranges: 10.0.0.0\u002F8, 172.16.0.0\u002F12, 192.168.0.0\u002F16",{"type":40,"tag":55,"props":137,"children":139},{"id":138},"availability-zones",[140],{"type":45,"value":141},"Availability Zones",{"type":40,"tag":67,"props":143,"children":144},{},[145,150],{"type":40,"tag":71,"props":146,"children":147},{},[148],{"type":45,"value":149},"Minimum 2 AZs for production. 3 AZs is the standard for high availability.",{"type":40,"tag":71,"props":151,"children":152},{},[153],{"type":45,"value":154},"Each tier gets one subnet per AZ (e.g., 3 AZs x 3 tiers = 9 subnets)",{"type":40,"tag":48,"props":156,"children":158},{"id":157},"security-groups-vs-nacls",[159],{"type":45,"value":160},"Security Groups vs NACLs",{"type":40,"tag":162,"props":163,"children":164},"table",{},[165,189],{"type":40,"tag":166,"props":167,"children":168},"thead",{},[169],{"type":40,"tag":170,"props":171,"children":172},"tr",{},[173,179,184],{"type":40,"tag":174,"props":175,"children":176},"th",{},[177],{"type":45,"value":178},"Feature",{"type":40,"tag":174,"props":180,"children":181},{},[182],{"type":45,"value":183},"Security Groups",{"type":40,"tag":174,"props":185,"children":186},{},[187],{"type":45,"value":188},"NACLs",{"type":40,"tag":190,"props":191,"children":192},"tbody",{},[193,212,230,248,266],{"type":40,"tag":170,"props":194,"children":195},{},[196,202,207],{"type":40,"tag":197,"props":198,"children":199},"td",{},[200],{"type":45,"value":201},"Level",{"type":40,"tag":197,"props":203,"children":204},{},[205],{"type":45,"value":206},"ENI (instance)",{"type":40,"tag":197,"props":208,"children":209},{},[210],{"type":45,"value":211},"Subnet",{"type":40,"tag":170,"props":213,"children":214},{},[215,220,225],{"type":40,"tag":197,"props":216,"children":217},{},[218],{"type":45,"value":219},"State",{"type":40,"tag":197,"props":221,"children":222},{},[223],{"type":45,"value":224},"Stateful",{"type":40,"tag":197,"props":226,"children":227},{},[228],{"type":45,"value":229},"Stateless",{"type":40,"tag":170,"props":231,"children":232},{},[233,238,243],{"type":40,"tag":197,"props":234,"children":235},{},[236],{"type":45,"value":237},"Rules",{"type":40,"tag":197,"props":239,"children":240},{},[241],{"type":45,"value":242},"Allow only",{"type":40,"tag":197,"props":244,"children":245},{},[246],{"type":45,"value":247},"Allow and Deny",{"type":40,"tag":170,"props":249,"children":250},{},[251,256,261],{"type":40,"tag":197,"props":252,"children":253},{},[254],{"type":45,"value":255},"Evaluation",{"type":40,"tag":197,"props":257,"children":258},{},[259],{"type":45,"value":260},"All rules evaluated",{"type":40,"tag":197,"props":262,"children":263},{},[264],{"type":45,"value":265},"Rules evaluated in order by number",{"type":40,"tag":170,"props":267,"children":268},{},[269,274,279],{"type":40,"tag":197,"props":270,"children":271},{},[272],{"type":45,"value":273},"Default",{"type":40,"tag":197,"props":275,"children":276},{},[277],{"type":45,"value":278},"Deny all inbound, allow all outbound",{"type":40,"tag":197,"props":280,"children":281},{},[282],{"type":45,"value":283},"Allow all inbound and outbound",{"type":40,"tag":41,"props":285,"children":286},{},[287],{"type":40,"tag":75,"props":288,"children":289},{},[290],{"type":45,"value":291},"Opinionated guidance:",{"type":40,"tag":67,"props":293,"children":294},{},[295,300,305,310],{"type":40,"tag":71,"props":296,"children":297},{},[298],{"type":45,"value":299},"Security groups are your primary network control. Use them for everything.",{"type":40,"tag":71,"props":301,"children":302},{},[303],{"type":45,"value":304},"NACLs are defense-in-depth only. Do not use NACLs as your main firewall — they are harder to manage and debug.",{"type":40,"tag":71,"props":306,"children":307},{},[308],{"type":45,"value":309},"Reference security groups by ID (not CIDR) to allow traffic between resources. This is more maintainable and self-documenting.",{"type":40,"tag":71,"props":311,"children":312},{},[313,315,322,324,330,331,337],{"type":45,"value":314},"One security group per logical role (e.g., ",{"type":40,"tag":316,"props":317,"children":319},"code",{"className":318},[],[320],{"type":45,"value":321},"alb-sg",{"type":45,"value":323},", ",{"type":40,"tag":316,"props":325,"children":327},{"className":326},[],[328],{"type":45,"value":329},"app-sg",{"type":45,"value":323},{"type":40,"tag":316,"props":332,"children":334},{"className":333},[],[335],{"type":45,"value":336},"db-sg",{"type":45,"value":338},"). Chain them: ALB -> App -> DB.",{"type":40,"tag":48,"props":340,"children":342},{"id":341},"vpc-endpoints",[343],{"type":45,"value":344},"VPC Endpoints",{"type":40,"tag":55,"props":346,"children":348},{"id":347},"gateway-endpoints-free",[349],{"type":45,"value":350},"Gateway Endpoints (free)",{"type":40,"tag":67,"props":352,"children":353},{},[354,371,376],{"type":40,"tag":71,"props":355,"children":356},{},[357,362,364,369],{"type":40,"tag":75,"props":358,"children":359},{},[360],{"type":45,"value":361},"S3",{"type":45,"value":363}," and ",{"type":40,"tag":75,"props":365,"children":366},{},[367],{"type":45,"value":368},"DynamoDB",{"type":45,"value":370}," only",{"type":40,"tag":71,"props":372,"children":373},{},[374],{"type":45,"value":375},"Added to route tables — no ENI, no security group",{"type":40,"tag":71,"props":377,"children":378},{},[379],{"type":45,"value":380},"Always create these — they are free (no hourly charge, no per-GB data processing fee), they keep S3\u002FDynamoDB traffic on the AWS backbone instead of traversing NAT Gateways (which charge $0.045\u002FGB processed), and they reduce latency by avoiding the extra hop through NAT. The only cost is a route table entry.",{"type":40,"tag":55,"props":382,"children":384},{"id":383},"interface-endpoints-cost-per-hour-data",[385],{"type":45,"value":386},"Interface Endpoints (cost per hour + data)",{"type":40,"tag":67,"props":388,"children":389},{},[390,395,400,405],{"type":40,"tag":71,"props":391,"children":392},{},[393],{"type":45,"value":394},"All other AWS services (STS, Secrets Manager, ECR, CloudWatch, KMS, etc.)",{"type":40,"tag":71,"props":396,"children":397},{},[398],{"type":45,"value":399},"Creates an ENI in your subnet — requires a security group",{"type":40,"tag":71,"props":401,"children":402},{},[403],{"type":45,"value":404},"Enable Private DNS so the default service endpoint resolves to the private IP",{"type":40,"tag":71,"props":406,"children":407},{},[408,410,416,417,423,424,430,432,438,439,445,446,452,453],{"type":45,"value":409},"Prioritize these for isolated subnets: ",{"type":40,"tag":316,"props":411,"children":413},{"className":412},[],[414],{"type":45,"value":415},"ecr.api",{"type":45,"value":323},{"type":40,"tag":316,"props":418,"children":420},{"className":419},[],[421],{"type":45,"value":422},"ecr.dkr",{"type":45,"value":323},{"type":40,"tag":316,"props":425,"children":427},{"className":426},[],[428],{"type":45,"value":429},"s3",{"type":45,"value":431}," (gateway), ",{"type":40,"tag":316,"props":433,"children":435},{"className":434},[],[436],{"type":45,"value":437},"logs",{"type":45,"value":323},{"type":40,"tag":316,"props":440,"children":442},{"className":441},[],[443],{"type":45,"value":444},"sts",{"type":45,"value":323},{"type":40,"tag":316,"props":447,"children":449},{"className":448},[],[450],{"type":45,"value":451},"secretsmanager",{"type":45,"value":323},{"type":40,"tag":316,"props":454,"children":456},{"className":455},[],[457],{"type":45,"value":458},"kms",{"type":40,"tag":48,"props":460,"children":462},{"id":461},"transit-gateway",[463],{"type":45,"value":464},"Transit Gateway",{"type":40,"tag":41,"props":466,"children":467},{},[468],{"type":45,"value":469},"Use Transit Gateway when:",{"type":40,"tag":67,"props":471,"children":472},{},[473,478,483],{"type":40,"tag":71,"props":474,"children":475},{},[476],{"type":45,"value":477},"You have more than 2 VPCs that need to communicate",{"type":40,"tag":71,"props":479,"children":480},{},[481],{"type":45,"value":482},"You need hub-and-spoke or any-to-any connectivity",{"type":40,"tag":71,"props":484,"children":485},{},[486],{"type":45,"value":487},"You need centralized egress or ingress through a shared services VPC",{"type":40,"tag":41,"props":489,"children":490},{},[491],{"type":45,"value":492},"Do NOT use VPC peering for more than 2-3 VPCs — it does not scale (N*(N-1)\u002F2 connections).",{"type":40,"tag":41,"props":494,"children":495},{},[496],{"type":45,"value":497},"Key Transit Gateway patterns:",{"type":40,"tag":67,"props":499,"children":500},{},[501,511,521],{"type":40,"tag":71,"props":502,"children":503},{},[504,509],{"type":40,"tag":75,"props":505,"children":506},{},[507],{"type":45,"value":508},"Shared Services VPC",{"type":45,"value":510},": Central VPC with DNS, logging, security tools. All spoke VPCs route through TGW.",{"type":40,"tag":71,"props":512,"children":513},{},[514,519],{"type":40,"tag":75,"props":515,"children":516},{},[517],{"type":45,"value":518},"Centralized Egress",{"type":45,"value":520},": Single NAT Gateway in a shared VPC. All private subnets route 0.0.0.0\u002F0 through TGW to the shared VPC.",{"type":40,"tag":71,"props":522,"children":523},{},[524,529],{"type":40,"tag":75,"props":525,"children":526},{},[527],{"type":45,"value":528},"Segmentation via route tables",{"type":45,"value":530},": Use separate TGW route tables for prod, staging, dev to isolate environments.",{"type":40,"tag":48,"props":532,"children":534},{"id":533},"vpc-peering",[535],{"type":45,"value":536},"VPC Peering",{"type":40,"tag":67,"props":538,"children":539},{},[540,545,550,555],{"type":40,"tag":71,"props":541,"children":542},{},[543],{"type":45,"value":544},"Point-to-point only. Not transitive — if A peers with B and B peers with C, A cannot reach C.",{"type":40,"tag":71,"props":546,"children":547},{},[548],{"type":45,"value":549},"Works cross-region and cross-account",{"type":40,"tag":71,"props":551,"children":552},{},[553],{"type":45,"value":554},"Good for 2-3 VPCs. Beyond that, use Transit Gateway.",{"type":40,"tag":71,"props":556,"children":557},{},[558],{"type":45,"value":559},"CIDRs must not overlap",{"type":40,"tag":48,"props":561,"children":563},{"id":562},"route53",[564],{"type":45,"value":565},"Route53",{"type":40,"tag":55,"props":567,"children":569},{"id":568},"hosted-zones",[570],{"type":45,"value":571},"Hosted Zones",{"type":40,"tag":67,"props":573,"children":574},{},[575,585],{"type":40,"tag":71,"props":576,"children":577},{},[578,583],{"type":40,"tag":75,"props":579,"children":580},{},[581],{"type":45,"value":582},"Public hosted zone",{"type":45,"value":584},": DNS for internet-facing resources. NS records must be registered with your domain registrar.",{"type":40,"tag":71,"props":586,"children":587},{},[588,593],{"type":40,"tag":75,"props":589,"children":590},{},[591],{"type":45,"value":592},"Private hosted zone",{"type":45,"value":594},": DNS for internal resources. Associated with one or more VPCs. Not resolvable from the internet.",{"type":40,"tag":55,"props":596,"children":598},{"id":597},"routing-policies",[599],{"type":45,"value":600},"Routing Policies",{"type":40,"tag":67,"props":602,"children":603},{},[604,614,624,634,644,654,664],{"type":40,"tag":71,"props":605,"children":606},{},[607,612],{"type":40,"tag":75,"props":608,"children":609},{},[610],{"type":45,"value":611},"Simple",{"type":45,"value":613},": Single resource. Default.",{"type":40,"tag":71,"props":615,"children":616},{},[617,622],{"type":40,"tag":75,"props":618,"children":619},{},[620],{"type":45,"value":621},"Weighted",{"type":45,"value":623},": Split traffic by percentage. Good for canary deployments.",{"type":40,"tag":71,"props":625,"children":626},{},[627,632],{"type":40,"tag":75,"props":628,"children":629},{},[630],{"type":45,"value":631},"Latency-based",{"type":45,"value":633},": Route to the lowest-latency region. Use for multi-region apps.",{"type":40,"tag":71,"props":635,"children":636},{},[637,642],{"type":40,"tag":75,"props":638,"children":639},{},[640],{"type":45,"value":641},"Failover",{"type":45,"value":643},": Active\u002Fpassive. Requires health checks.",{"type":40,"tag":71,"props":645,"children":646},{},[647,652],{"type":40,"tag":75,"props":648,"children":649},{},[650],{"type":45,"value":651},"Geolocation",{"type":45,"value":653},": Route by user's country\u002Fcontinent. Good for compliance (data residency).",{"type":40,"tag":71,"props":655,"children":656},{},[657,662],{"type":40,"tag":75,"props":658,"children":659},{},[660],{"type":45,"value":661},"Geoproximity",{"type":45,"value":663},": Route by geographic distance with bias. Use Traffic Flow.",{"type":40,"tag":71,"props":665,"children":666},{},[667,672],{"type":40,"tag":75,"props":668,"children":669},{},[670],{"type":45,"value":671},"Multivalue Answer",{"type":45,"value":673},": Return multiple healthy IPs. Poor man's load balancer (use ALB instead).",{"type":40,"tag":55,"props":675,"children":677},{"id":676},"health-checks",[678],{"type":45,"value":679},"Health Checks",{"type":40,"tag":67,"props":681,"children":682},{},[683,688,693],{"type":40,"tag":71,"props":684,"children":685},{},[686],{"type":45,"value":687},"Always attach health checks to failover and latency records",{"type":40,"tag":71,"props":689,"children":690},{},[691],{"type":45,"value":692},"Health checks can monitor an endpoint, a CloudWatch alarm, or other health checks (calculated)",{"type":40,"tag":71,"props":694,"children":695},{},[696],{"type":45,"value":697},"Health check interval: 30s standard, 10s fast (costs more)",{"type":40,"tag":48,"props":699,"children":701},{"id":700},"nat-gateway",[702],{"type":45,"value":703},"NAT Gateway",{"type":40,"tag":67,"props":705,"children":706},{},[707,712,717,722,727],{"type":40,"tag":71,"props":708,"children":709},{},[710],{"type":45,"value":711},"One per AZ for high availability. A single NAT Gateway is a single point of failure.",{"type":40,"tag":71,"props":713,"children":714},{},[715],{"type":45,"value":716},"Placed in public subnets",{"type":40,"tag":71,"props":718,"children":719},{},[720],{"type":45,"value":721},"Costs: per-hour charge + per-GB data processing. This adds up fast.",{"type":40,"tag":71,"props":723,"children":724},{},[725],{"type":45,"value":726},"For cost savings in dev\u002Fstaging: use a single NAT Gateway (accept the AZ risk) or use NAT instances",{"type":40,"tag":71,"props":728,"children":729},{},[730],{"type":45,"value":731},"If you only need AWS service access (not general internet), use VPC endpoints instead — cheaper and more secure",{"type":40,"tag":48,"props":733,"children":735},{"id":734},"common-cli-commands",[736],{"type":45,"value":737},"Common CLI Commands",{"type":40,"tag":739,"props":740,"children":745},"pre",{"className":741,"code":742,"language":743,"meta":744,"style":744},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Describe VPCs\naws ec2 describe-vpcs --query 'Vpcs[*].{ID:VpcId,CIDR:CidrBlock,Name:Tags[?Key==`Name`].Value|[0]}'\n\n# Describe subnets in a VPC\naws ec2 describe-subnets --filters \"Name=vpc-id,Values=vpc-xxx\" --query 'Subnets[*].{ID:SubnetId,AZ:AvailabilityZone,CIDR:CidrBlock,Public:MapPublicIpOnLaunch}'\n\n# List security group rules\naws ec2 describe-security-group-rules --filter \"Name=group-id,Values=sg-xxx\"\n\n# List VPC endpoints\naws ec2 describe-vpc-endpoints --filters \"Name=vpc-id,Values=vpc-xxx\" --query 'VpcEndpoints[*].{ID:VpcEndpointId,Service:ServiceName,Type:VpcEndpointType}'\n\n# Check route tables\naws ec2 describe-route-tables --filters \"Name=vpc-id,Values=vpc-xxx\" --query 'RouteTables[*].{ID:RouteTableId,Routes:Routes}'\n\n# List Transit Gateway attachments\naws ec2 describe-transit-gateway-attachments --query 'TransitGatewayAttachments[*].{ID:TransitGatewayAttachmentId,ResourceType:ResourceType,State:State}'\n\n# Test connectivity (VPC Reachability Analyzer)\naws ec2 create-network-insights-path --source eni-xxx --destination eni-yyy --protocol TCP --destination-port 443\n\n# Route53 — list hosted zones\naws route53 list-hosted-zones --query 'HostedZones[*].{Name:Name,ID:Id,Private:Config.PrivateZone}'\n\n# Route53 — list records\naws route53 list-resource-record-sets --hosted-zone-id \u002Fhostedzone\u002FZXXXXX\n","bash","",[746],{"type":40,"tag":316,"props":747,"children":748},{"__ignoreMap":744},[749,761,802,812,821,875,883,892,928,936,945,995,1003,1012,1061,1068,1077,1111,1119,1128,1186,1194,1203,1238,1246,1255],{"type":40,"tag":750,"props":751,"children":754},"span",{"class":752,"line":753},"line",1,[755],{"type":40,"tag":750,"props":756,"children":758},{"style":757},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[759],{"type":45,"value":760},"# Describe VPCs\n",{"type":40,"tag":750,"props":762,"children":764},{"class":752,"line":763},2,[765,770,776,781,786,792,797],{"type":40,"tag":750,"props":766,"children":768},{"style":767},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[769],{"type":45,"value":21},{"type":40,"tag":750,"props":771,"children":773},{"style":772},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[774],{"type":45,"value":775}," ec2",{"type":40,"tag":750,"props":777,"children":778},{"style":772},[779],{"type":45,"value":780}," describe-vpcs",{"type":40,"tag":750,"props":782,"children":783},{"style":772},[784],{"type":45,"value":785}," --query",{"type":40,"tag":750,"props":787,"children":789},{"style":788},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[790],{"type":45,"value":791}," '",{"type":40,"tag":750,"props":793,"children":794},{"style":772},[795],{"type":45,"value":796},"Vpcs[*].{ID:VpcId,CIDR:CidrBlock,Name:Tags[?Key==`Name`].Value|[0]}",{"type":40,"tag":750,"props":798,"children":799},{"style":788},[800],{"type":45,"value":801},"'\n",{"type":40,"tag":750,"props":803,"children":805},{"class":752,"line":804},3,[806],{"type":40,"tag":750,"props":807,"children":809},{"emptyLinePlaceholder":808},true,[810],{"type":45,"value":811},"\n",{"type":40,"tag":750,"props":813,"children":815},{"class":752,"line":814},4,[816],{"type":40,"tag":750,"props":817,"children":818},{"style":757},[819],{"type":45,"value":820},"# Describe subnets in a VPC\n",{"type":40,"tag":750,"props":822,"children":824},{"class":752,"line":823},5,[825,829,833,838,843,848,853,858,862,866,871],{"type":40,"tag":750,"props":826,"children":827},{"style":767},[828],{"type":45,"value":21},{"type":40,"tag":750,"props":830,"children":831},{"style":772},[832],{"type":45,"value":775},{"type":40,"tag":750,"props":834,"children":835},{"style":772},[836],{"type":45,"value":837}," describe-subnets",{"type":40,"tag":750,"props":839,"children":840},{"style":772},[841],{"type":45,"value":842}," --filters",{"type":40,"tag":750,"props":844,"children":845},{"style":788},[846],{"type":45,"value":847}," \"",{"type":40,"tag":750,"props":849,"children":850},{"style":772},[851],{"type":45,"value":852},"Name=vpc-id,Values=vpc-xxx",{"type":40,"tag":750,"props":854,"children":855},{"style":788},[856],{"type":45,"value":857},"\"",{"type":40,"tag":750,"props":859,"children":860},{"style":772},[861],{"type":45,"value":785},{"type":40,"tag":750,"props":863,"children":864},{"style":788},[865],{"type":45,"value":791},{"type":40,"tag":750,"props":867,"children":868},{"style":772},[869],{"type":45,"value":870},"Subnets[*].{ID:SubnetId,AZ:AvailabilityZone,CIDR:CidrBlock,Public:MapPublicIpOnLaunch}",{"type":40,"tag":750,"props":872,"children":873},{"style":788},[874],{"type":45,"value":801},{"type":40,"tag":750,"props":876,"children":878},{"class":752,"line":877},6,[879],{"type":40,"tag":750,"props":880,"children":881},{"emptyLinePlaceholder":808},[882],{"type":45,"value":811},{"type":40,"tag":750,"props":884,"children":886},{"class":752,"line":885},7,[887],{"type":40,"tag":750,"props":888,"children":889},{"style":757},[890],{"type":45,"value":891},"# List security group rules\n",{"type":40,"tag":750,"props":893,"children":895},{"class":752,"line":894},8,[896,900,904,909,914,918,923],{"type":40,"tag":750,"props":897,"children":898},{"style":767},[899],{"type":45,"value":21},{"type":40,"tag":750,"props":901,"children":902},{"style":772},[903],{"type":45,"value":775},{"type":40,"tag":750,"props":905,"children":906},{"style":772},[907],{"type":45,"value":908}," describe-security-group-rules",{"type":40,"tag":750,"props":910,"children":911},{"style":772},[912],{"type":45,"value":913}," --filter",{"type":40,"tag":750,"props":915,"children":916},{"style":788},[917],{"type":45,"value":847},{"type":40,"tag":750,"props":919,"children":920},{"style":772},[921],{"type":45,"value":922},"Name=group-id,Values=sg-xxx",{"type":40,"tag":750,"props":924,"children":925},{"style":788},[926],{"type":45,"value":927},"\"\n",{"type":40,"tag":750,"props":929,"children":931},{"class":752,"line":930},9,[932],{"type":40,"tag":750,"props":933,"children":934},{"emptyLinePlaceholder":808},[935],{"type":45,"value":811},{"type":40,"tag":750,"props":937,"children":939},{"class":752,"line":938},10,[940],{"type":40,"tag":750,"props":941,"children":942},{"style":757},[943],{"type":45,"value":944},"# List VPC endpoints\n",{"type":40,"tag":750,"props":946,"children":948},{"class":752,"line":947},11,[949,953,957,962,966,970,974,978,982,986,991],{"type":40,"tag":750,"props":950,"children":951},{"style":767},[952],{"type":45,"value":21},{"type":40,"tag":750,"props":954,"children":955},{"style":772},[956],{"type":45,"value":775},{"type":40,"tag":750,"props":958,"children":959},{"style":772},[960],{"type":45,"value":961}," describe-vpc-endpoints",{"type":40,"tag":750,"props":963,"children":964},{"style":772},[965],{"type":45,"value":842},{"type":40,"tag":750,"props":967,"children":968},{"style":788},[969],{"type":45,"value":847},{"type":40,"tag":750,"props":971,"children":972},{"style":772},[973],{"type":45,"value":852},{"type":40,"tag":750,"props":975,"children":976},{"style":788},[977],{"type":45,"value":857},{"type":40,"tag":750,"props":979,"children":980},{"style":772},[981],{"type":45,"value":785},{"type":40,"tag":750,"props":983,"children":984},{"style":788},[985],{"type":45,"value":791},{"type":40,"tag":750,"props":987,"children":988},{"style":772},[989],{"type":45,"value":990},"VpcEndpoints[*].{ID:VpcEndpointId,Service:ServiceName,Type:VpcEndpointType}",{"type":40,"tag":750,"props":992,"children":993},{"style":788},[994],{"type":45,"value":801},{"type":40,"tag":750,"props":996,"children":998},{"class":752,"line":997},12,[999],{"type":40,"tag":750,"props":1000,"children":1001},{"emptyLinePlaceholder":808},[1002],{"type":45,"value":811},{"type":40,"tag":750,"props":1004,"children":1006},{"class":752,"line":1005},13,[1007],{"type":40,"tag":750,"props":1008,"children":1009},{"style":757},[1010],{"type":45,"value":1011},"# Check route tables\n",{"type":40,"tag":750,"props":1013,"children":1014},{"class":752,"line":22},[1015,1019,1023,1028,1032,1036,1040,1044,1048,1052,1057],{"type":40,"tag":750,"props":1016,"children":1017},{"style":767},[1018],{"type":45,"value":21},{"type":40,"tag":750,"props":1020,"children":1021},{"style":772},[1022],{"type":45,"value":775},{"type":40,"tag":750,"props":1024,"children":1025},{"style":772},[1026],{"type":45,"value":1027}," describe-route-tables",{"type":40,"tag":750,"props":1029,"children":1030},{"style":772},[1031],{"type":45,"value":842},{"type":40,"tag":750,"props":1033,"children":1034},{"style":788},[1035],{"type":45,"value":847},{"type":40,"tag":750,"props":1037,"children":1038},{"style":772},[1039],{"type":45,"value":852},{"type":40,"tag":750,"props":1041,"children":1042},{"style":788},[1043],{"type":45,"value":857},{"type":40,"tag":750,"props":1045,"children":1046},{"style":772},[1047],{"type":45,"value":785},{"type":40,"tag":750,"props":1049,"children":1050},{"style":788},[1051],{"type":45,"value":791},{"type":40,"tag":750,"props":1053,"children":1054},{"style":772},[1055],{"type":45,"value":1056},"RouteTables[*].{ID:RouteTableId,Routes:Routes}",{"type":40,"tag":750,"props":1058,"children":1059},{"style":788},[1060],{"type":45,"value":801},{"type":40,"tag":750,"props":1062,"children":1063},{"class":752,"line":26},[1064],{"type":40,"tag":750,"props":1065,"children":1066},{"emptyLinePlaceholder":808},[1067],{"type":45,"value":811},{"type":40,"tag":750,"props":1069,"children":1071},{"class":752,"line":1070},16,[1072],{"type":40,"tag":750,"props":1073,"children":1074},{"style":757},[1075],{"type":45,"value":1076},"# List Transit Gateway attachments\n",{"type":40,"tag":750,"props":1078,"children":1080},{"class":752,"line":1079},17,[1081,1085,1089,1094,1098,1102,1107],{"type":40,"tag":750,"props":1082,"children":1083},{"style":767},[1084],{"type":45,"value":21},{"type":40,"tag":750,"props":1086,"children":1087},{"style":772},[1088],{"type":45,"value":775},{"type":40,"tag":750,"props":1090,"children":1091},{"style":772},[1092],{"type":45,"value":1093}," describe-transit-gateway-attachments",{"type":40,"tag":750,"props":1095,"children":1096},{"style":772},[1097],{"type":45,"value":785},{"type":40,"tag":750,"props":1099,"children":1100},{"style":788},[1101],{"type":45,"value":791},{"type":40,"tag":750,"props":1103,"children":1104},{"style":772},[1105],{"type":45,"value":1106},"TransitGatewayAttachments[*].{ID:TransitGatewayAttachmentId,ResourceType:ResourceType,State:State}",{"type":40,"tag":750,"props":1108,"children":1109},{"style":788},[1110],{"type":45,"value":801},{"type":40,"tag":750,"props":1112,"children":1114},{"class":752,"line":1113},18,[1115],{"type":40,"tag":750,"props":1116,"children":1117},{"emptyLinePlaceholder":808},[1118],{"type":45,"value":811},{"type":40,"tag":750,"props":1120,"children":1122},{"class":752,"line":1121},19,[1123],{"type":40,"tag":750,"props":1124,"children":1125},{"style":757},[1126],{"type":45,"value":1127},"# Test connectivity (VPC Reachability Analyzer)\n",{"type":40,"tag":750,"props":1129,"children":1131},{"class":752,"line":1130},20,[1132,1136,1140,1145,1150,1155,1160,1165,1170,1175,1180],{"type":40,"tag":750,"props":1133,"children":1134},{"style":767},[1135],{"type":45,"value":21},{"type":40,"tag":750,"props":1137,"children":1138},{"style":772},[1139],{"type":45,"value":775},{"type":40,"tag":750,"props":1141,"children":1142},{"style":772},[1143],{"type":45,"value":1144}," create-network-insights-path",{"type":40,"tag":750,"props":1146,"children":1147},{"style":772},[1148],{"type":45,"value":1149}," --source",{"type":40,"tag":750,"props":1151,"children":1152},{"style":772},[1153],{"type":45,"value":1154}," eni-xxx",{"type":40,"tag":750,"props":1156,"children":1157},{"style":772},[1158],{"type":45,"value":1159}," --destination",{"type":40,"tag":750,"props":1161,"children":1162},{"style":772},[1163],{"type":45,"value":1164}," eni-yyy",{"type":40,"tag":750,"props":1166,"children":1167},{"style":772},[1168],{"type":45,"value":1169}," --protocol",{"type":40,"tag":750,"props":1171,"children":1172},{"style":772},[1173],{"type":45,"value":1174}," TCP",{"type":40,"tag":750,"props":1176,"children":1177},{"style":772},[1178],{"type":45,"value":1179}," --destination-port",{"type":40,"tag":750,"props":1181,"children":1183},{"style":1182},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[1184],{"type":45,"value":1185}," 443\n",{"type":40,"tag":750,"props":1187,"children":1189},{"class":752,"line":1188},21,[1190],{"type":40,"tag":750,"props":1191,"children":1192},{"emptyLinePlaceholder":808},[1193],{"type":45,"value":811},{"type":40,"tag":750,"props":1195,"children":1197},{"class":752,"line":1196},22,[1198],{"type":40,"tag":750,"props":1199,"children":1200},{"style":757},[1201],{"type":45,"value":1202},"# Route53 — list hosted zones\n",{"type":40,"tag":750,"props":1204,"children":1206},{"class":752,"line":1205},23,[1207,1211,1216,1221,1225,1229,1234],{"type":40,"tag":750,"props":1208,"children":1209},{"style":767},[1210],{"type":45,"value":21},{"type":40,"tag":750,"props":1212,"children":1213},{"style":772},[1214],{"type":45,"value":1215}," route53",{"type":40,"tag":750,"props":1217,"children":1218},{"style":772},[1219],{"type":45,"value":1220}," list-hosted-zones",{"type":40,"tag":750,"props":1222,"children":1223},{"style":772},[1224],{"type":45,"value":785},{"type":40,"tag":750,"props":1226,"children":1227},{"style":788},[1228],{"type":45,"value":791},{"type":40,"tag":750,"props":1230,"children":1231},{"style":772},[1232],{"type":45,"value":1233},"HostedZones[*].{Name:Name,ID:Id,Private:Config.PrivateZone}",{"type":40,"tag":750,"props":1235,"children":1236},{"style":788},[1237],{"type":45,"value":801},{"type":40,"tag":750,"props":1239,"children":1241},{"class":752,"line":1240},24,[1242],{"type":40,"tag":750,"props":1243,"children":1244},{"emptyLinePlaceholder":808},[1245],{"type":45,"value":811},{"type":40,"tag":750,"props":1247,"children":1249},{"class":752,"line":1248},25,[1250],{"type":40,"tag":750,"props":1251,"children":1252},{"style":757},[1253],{"type":45,"value":1254},"# Route53 — list records\n",{"type":40,"tag":750,"props":1256,"children":1258},{"class":752,"line":1257},26,[1259,1263,1267,1272,1277],{"type":40,"tag":750,"props":1260,"children":1261},{"style":767},[1262],{"type":45,"value":21},{"type":40,"tag":750,"props":1264,"children":1265},{"style":772},[1266],{"type":45,"value":1215},{"type":40,"tag":750,"props":1268,"children":1269},{"style":772},[1270],{"type":45,"value":1271}," list-resource-record-sets",{"type":40,"tag":750,"props":1273,"children":1274},{"style":772},[1275],{"type":45,"value":1276}," --hosted-zone-id",{"type":40,"tag":750,"props":1278,"children":1279},{"style":772},[1280],{"type":45,"value":1281}," \u002Fhostedzone\u002FZXXXXX\n",{"type":40,"tag":48,"props":1283,"children":1285},{"id":1284},"output-format",[1286],{"type":45,"value":1287},"Output Format",{"type":40,"tag":162,"props":1289,"children":1290},{},[1291,1307],{"type":40,"tag":166,"props":1292,"children":1293},{},[1294],{"type":40,"tag":170,"props":1295,"children":1296},{},[1297,1302],{"type":40,"tag":174,"props":1298,"children":1299},{},[1300],{"type":45,"value":1301},"Field",{"type":40,"tag":174,"props":1303,"children":1304},{},[1305],{"type":45,"value":1306},"Details",{"type":40,"tag":190,"props":1308,"children":1309},{},[1310,1326,1342,1358,1374,1390,1405],{"type":40,"tag":170,"props":1311,"children":1312},{},[1313,1321],{"type":40,"tag":197,"props":1314,"children":1315},{},[1316],{"type":40,"tag":75,"props":1317,"children":1318},{},[1319],{"type":45,"value":1320},"VPC CIDR",{"type":40,"tag":197,"props":1322,"children":1323},{},[1324],{"type":45,"value":1325},"Primary CIDR block and any secondary CIDRs",{"type":40,"tag":170,"props":1327,"children":1328},{},[1329,1337],{"type":40,"tag":197,"props":1330,"children":1331},{},[1332],{"type":40,"tag":75,"props":1333,"children":1334},{},[1335],{"type":45,"value":1336},"Subnet layout",{"type":40,"tag":197,"props":1338,"children":1339},{},[1340],{"type":45,"value":1341},"Public, private, and isolated subnets per AZ with CIDR ranges",{"type":40,"tag":170,"props":1343,"children":1344},{},[1345,1353],{"type":40,"tag":197,"props":1346,"children":1347},{},[1348],{"type":40,"tag":75,"props":1349,"children":1350},{},[1351],{"type":45,"value":1352},"NAT strategy",{"type":40,"tag":197,"props":1354,"children":1355},{},[1356],{"type":45,"value":1357},"NAT Gateway per AZ (production) or single NAT (dev\u002Fstaging)",{"type":40,"tag":170,"props":1359,"children":1360},{},[1361,1369],{"type":40,"tag":197,"props":1362,"children":1363},{},[1364],{"type":40,"tag":75,"props":1365,"children":1366},{},[1367],{"type":45,"value":1368},"VPC endpoints",{"type":40,"tag":197,"props":1370,"children":1371},{},[1372],{"type":45,"value":1373},"Gateway endpoints (S3, DynamoDB) and interface endpoints by service",{"type":40,"tag":170,"props":1375,"children":1376},{},[1377,1385],{"type":40,"tag":197,"props":1378,"children":1379},{},[1380],{"type":40,"tag":75,"props":1381,"children":1382},{},[1383],{"type":45,"value":1384},"Security groups summary",{"type":40,"tag":197,"props":1386,"children":1387},{},[1388],{"type":45,"value":1389},"SG names, purpose, and key ingress\u002Fegress rules",{"type":40,"tag":170,"props":1391,"children":1392},{},[1393,1400],{"type":40,"tag":197,"props":1394,"children":1395},{},[1396],{"type":40,"tag":75,"props":1397,"children":1398},{},[1399],{"type":45,"value":464},{"type":40,"tag":197,"props":1401,"children":1402},{},[1403],{"type":45,"value":1404},"TGW ID, attachments, route table segmentation (if applicable)",{"type":40,"tag":170,"props":1406,"children":1407},{},[1408,1416],{"type":40,"tag":197,"props":1409,"children":1410},{},[1411],{"type":40,"tag":75,"props":1412,"children":1413},{},[1414],{"type":45,"value":1415},"DNS",{"type":40,"tag":197,"props":1417,"children":1418},{},[1419],{"type":45,"value":1420},"Route53 hosted zones (public\u002Fprivate), routing policies, health checks",{"type":40,"tag":48,"props":1422,"children":1424},{"id":1423},"reference-files",[1425],{"type":45,"value":1426},"Reference Files",{"type":40,"tag":67,"props":1428,"children":1429},{},[1430,1441],{"type":40,"tag":71,"props":1431,"children":1432},{},[1433,1439],{"type":40,"tag":316,"props":1434,"children":1436},{"className":1435},[],[1437],{"type":45,"value":1438},"references\u002Fcidr-planning.md",{"type":45,"value":1440}," — CIDR allocation strategies, worked examples for three-tier VPCs, multi-account planning, EKS\u002FLambda IP considerations, secondary CIDRs, and AWS VPC IPAM",{"type":40,"tag":71,"props":1442,"children":1443},{},[1444,1450],{"type":40,"tag":316,"props":1445,"children":1447},{"className":1446},[],[1448],{"type":45,"value":1449},"references\u002Fvpc-endpoint-catalog.md",{"type":45,"value":1451}," — Catalog of commonly used VPC endpoints organized by priority, with configuration guidance, security groups, cost analysis, and endpoint policies",{"type":40,"tag":48,"props":1453,"children":1455},{"id":1454},"related-skills",[1456],{"type":45,"value":1457},"Related Skills",{"type":40,"tag":67,"props":1459,"children":1460},{},[1461,1472,1483,1494,1505,1516,1527],{"type":40,"tag":71,"props":1462,"children":1463},{},[1464,1470],{"type":40,"tag":316,"props":1465,"children":1467},{"className":1466},[],[1468],{"type":45,"value":1469},"security-review",{"type":45,"value":1471}," — Network security posture, security group audits, NACLs",{"type":40,"tag":71,"props":1473,"children":1474},{},[1475,1481],{"type":40,"tag":316,"props":1476,"children":1478},{"className":1477},[],[1479],{"type":45,"value":1480},"iam",{"type":45,"value":1482}," — VPC endpoint policies, resource-based access control",{"type":40,"tag":71,"props":1484,"children":1485},{},[1486,1492],{"type":40,"tag":316,"props":1487,"children":1489},{"className":1488},[],[1490],{"type":45,"value":1491},"ec2",{"type":45,"value":1493}," — Instance placement, security groups, and subnet selection",{"type":40,"tag":71,"props":1495,"children":1496},{},[1497,1503],{"type":40,"tag":316,"props":1498,"children":1500},{"className":1499},[],[1501],{"type":45,"value":1502},"ecs",{"type":45,"value":1504}," — awsvpc networking, task-level security groups, service discovery, ECR endpoint requirements",{"type":40,"tag":71,"props":1506,"children":1507},{},[1508,1514],{"type":40,"tag":316,"props":1509,"children":1511},{"className":1510},[],[1512],{"type":45,"value":1513},"eks",{"type":45,"value":1515}," — Pod networking, secondary CIDRs, CNI configuration, IP address planning",{"type":40,"tag":71,"props":1517,"children":1518},{},[1519,1525],{"type":40,"tag":316,"props":1520,"children":1522},{"className":1521},[],[1523],{"type":45,"value":1524},"lambda",{"type":45,"value":1526}," — Lambda VPC configuration, ENI usage, endpoint requirements",{"type":40,"tag":71,"props":1528,"children":1529},{},[1530,1536],{"type":40,"tag":316,"props":1531,"children":1533},{"className":1532},[],[1534],{"type":45,"value":1535},"rds-aurora",{"type":45,"value":1537}," — Database subnet groups, isolated subnet placement",{"type":40,"tag":48,"props":1539,"children":1541},{"id":1540},"anti-patterns",[1542],{"type":45,"value":1543},"Anti-Patterns",{"type":40,"tag":67,"props":1545,"children":1546},{},[1547,1557,1567,1577,1587,1597,1607,1617,1627],{"type":40,"tag":71,"props":1548,"children":1549},{},[1550,1555],{"type":40,"tag":75,"props":1551,"children":1552},{},[1553],{"type":45,"value":1554},"Single AZ NAT Gateway in production",{"type":45,"value":1556},": One AZ goes down, all private subnets lose internet access. Use one NAT per AZ.",{"type":40,"tag":71,"props":1558,"children":1559},{},[1560,1565],{"type":40,"tag":75,"props":1561,"children":1562},{},[1563],{"type":45,"value":1564},"Using NACLs as primary firewall",{"type":45,"value":1566},": Stateless rules are error-prone. Use security groups. NACLs are backup only.",{"type":40,"tag":71,"props":1568,"children":1569},{},[1570,1575],{"type":40,"tag":75,"props":1571,"children":1572},{},[1573],{"type":45,"value":1574},"Overly permissive security groups",{"type":45,"value":1576},": 0.0.0.0\u002F0 on port 22 or 3389 is never acceptable in production. Use Systems Manager Session Manager instead.",{"type":40,"tag":71,"props":1578,"children":1579},{},[1580,1585],{"type":40,"tag":75,"props":1581,"children":1582},{},[1583],{"type":45,"value":1584},"No VPC endpoints for S3\u002FDynamoDB",{"type":45,"value":1586},": Gateway endpoints are free. Always create them.",{"type":40,"tag":71,"props":1588,"children":1589},{},[1590,1595],{"type":40,"tag":75,"props":1591,"children":1592},{},[1593],{"type":45,"value":1594},"Overlapping CIDRs",{"type":45,"value":1596},": Makes peering and Transit Gateway impossible later. Plan CIDR allocation upfront.",{"type":40,"tag":71,"props":1598,"children":1599},{},[1600,1605],{"type":40,"tag":75,"props":1601,"children":1602},{},[1603],{"type":45,"value":1604},"Public subnets for everything",{"type":45,"value":1606},": Databases, application servers, and internal services belong in private or isolated subnets. Only load balancers and NAT Gateways need public subnets.",{"type":40,"tag":71,"props":1608,"children":1609},{},[1610,1615],{"type":40,"tag":75,"props":1611,"children":1612},{},[1613],{"type":45,"value":1614},"Hardcoding IPs instead of using DNS",{"type":45,"value":1616},": Use Route53 private hosted zones and service discovery. IPs change; DNS names persist.",{"type":40,"tag":71,"props":1618,"children":1619},{},[1620,1625],{"type":40,"tag":75,"props":1621,"children":1622},{},[1623],{"type":45,"value":1624},"Not enabling VPC Flow Logs",{"type":45,"value":1626},": Essential for security auditing and debugging. Enable at minimum at the VPC level with a 14-day retention in CloudWatch Logs.",{"type":40,"tag":71,"props":1628,"children":1629},{},[1630,1635],{"type":40,"tag":75,"props":1631,"children":1632},{},[1633],{"type":45,"value":1634},"Using VPC peering for 5+ VPCs",{"type":45,"value":1636},": The mesh becomes unmanageable. Switch to Transit Gateway.",{"type":40,"tag":1638,"props":1639,"children":1640},"style",{},[1641],{"type":45,"value":1642},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1644,"total":1743},[1645,1659,1674,1686,1696,1711,1728],{"slug":1646,"name":1646,"fn":1647,"description":1648,"org":1649,"tags":1650,"stars":22,"repoUrl":23,"updatedAt":1658},"agentcore","design Amazon Bedrock AgentCore architectures","Deep-dive into Amazon Bedrock AgentCore platform design, service selection, deployment, and production operations. This skill should be used when the user asks to \"design an AgentCore architecture\", \"deploy agents on AgentCore\", \"configure AgentCore Runtime\", \"set up AgentCore Memory\", \"use AgentCore Gateway\", \"configure AgentCore Identity\", \"set up AgentCore Policy\", \"plan agent observability\", \"evaluate agent quality\", \"move agent PoC to production\", or mentions AgentCore, AgentCore Runtime, AgentCore Memory, AgentCore Gateway, AgentCore Identity, AgentCore Policy, AgentCore Evaluations, AgentCore Code Interpreter, AgentCore Browser, A2A protocol, or multi-agent orchestration on AWS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1651,1654,1657],{"name":1652,"slug":1653,"type":15},"Agents","agents",{"name":1655,"slug":1656,"type":15},"Architecture","architecture",{"name":20,"slug":21,"type":15},"2026-07-12T08:40:11.108951",{"slug":1660,"name":1660,"fn":1661,"description":1662,"org":1663,"tags":1664,"stars":22,"repoUrl":23,"updatedAt":1673},"aidlc-lite","develop AI applications on AWS","Lightweight AI development lifecycle for building on AWS. A simplified take on the AI-DLC philosophy — think together, then build fast. Acts as a design partner that understands intent, proposes alternatives with trade-offs, and ships working code without the ceremony of full requirements\u002Fdesign\u002Fspec documents. Use when a founder says \"build X on AWS\", \"add Y to my stack\", \"scaffold an API\", or \"write the CDK for Z\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1665,1666,1669,1670],{"name":1652,"slug":1653,"type":15},{"name":1667,"slug":1668,"type":15},"AI Infrastructure","ai-infrastructure",{"name":20,"slug":21,"type":15},{"name":1671,"slug":1672,"type":15},"Engineering","engineering","2026-07-12T08:40:40.204103",{"slug":1675,"name":1675,"fn":1676,"description":1677,"org":1678,"tags":1679,"stars":22,"repoUrl":23,"updatedAt":1685},"architect-for-startups","advise on AWS architecture for startups","AWS architecture advisor tailored specifically for startups. Alters AWS architecture recommendations based on startup stage (pre-revenue through Series B+), team size, runway, and credits. ALWAYS use when asked about building on AWS, choosing services, planning infrastructure, managing costs with credits, or preparing architecture for fundraising.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1680,1681,1682],{"name":1655,"slug":1656,"type":15},{"name":20,"slug":21,"type":15},{"name":1683,"slug":1684,"type":15},"Strategy","strategy","2026-07-12T08:41:33.557354",{"slug":1687,"name":1687,"fn":1688,"description":1689,"org":1690,"tags":1691,"stars":22,"repoUrl":23,"updatedAt":1695},"aws-architect","design and review AWS architectures","Design and review AWS architectures following Well-Architected Framework principles. Use when planning new infrastructure, reviewing existing architectures, evaluating trade-offs between AWS services, or when asked about AWS best practices.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1692,1693,1694],{"name":1655,"slug":1656,"type":15},{"name":20,"slug":21,"type":15},{"name":17,"slug":18,"type":15},"2026-07-12T08:40:57.630086",{"slug":1697,"name":1697,"fn":1698,"description":1699,"org":1700,"tags":1701,"stars":22,"repoUrl":23,"updatedAt":1710},"aws-compare","compare AWS architecture options","Compare 2-3 AWS architecture options side-by-side across cost, complexity, performance, security, and operational burden. Use when evaluating trade-offs between approaches or when the user is deciding between options.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1702,1703,1704,1707],{"name":1655,"slug":1656,"type":15},{"name":20,"slug":21,"type":15},{"name":1705,"slug":1706,"type":15},"Cost Optimization","cost-optimization",{"name":1708,"slug":1709,"type":15},"Security","security","2026-07-12T08:40:23.960287",{"slug":1712,"name":1712,"fn":1713,"description":1714,"org":1715,"tags":1716,"stars":22,"repoUrl":23,"updatedAt":1727},"aws-debug","debug AWS infrastructure and deployment failures","Debug AWS infrastructure issues, deployment failures, and runtime errors. Use when troubleshooting CloudFormation stack failures, Lambda errors, ECS task failures, permission issues, networking problems, or any AWS service misbehavior.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1717,1718,1721,1724],{"name":20,"slug":21,"type":15},{"name":1719,"slug":1720,"type":15},"Debugging","debugging",{"name":1722,"slug":1723,"type":15},"Deployment","deployment",{"name":1725,"slug":1726,"type":15},"Observability","observability","2026-07-12T08:40:16.767171",{"slug":1729,"name":1729,"fn":1730,"description":1731,"org":1732,"tags":1733,"stars":22,"repoUrl":23,"updatedAt":1742},"aws-diagram","generate AWS architecture diagrams","Generate AWS architecture diagrams in Mermaid or ASCII from a description, existing IaC, or conversation context. Use when the user wants to visualize an architecture.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1734,1735,1736,1739],{"name":1655,"slug":1656,"type":15},{"name":20,"slug":21,"type":15},{"name":1737,"slug":1738,"type":15},"Diagrams","diagrams",{"name":1740,"slug":1741,"type":15},"Visualization","visualization","2026-07-12T08:40:43.26341",42,{"items":1745,"total":1916},[1746,1760,1781,1791,1804,1817,1827,1837,1856,1871,1886,1901],{"slug":1747,"name":1747,"fn":1748,"description":1749,"org":1750,"tags":1751,"stars":1757,"repoUrl":1758,"updatedAt":1759},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1752,1753,1754,1756],{"name":20,"slug":21,"type":15},{"name":1719,"slug":1720,"type":15},{"name":1755,"slug":437,"type":15},"Logs",{"name":1725,"slug":1726,"type":15},9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":1761,"name":1762,"fn":1763,"description":1764,"org":1765,"tags":1766,"stars":1757,"repoUrl":1758,"updatedAt":1780},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1767,1770,1771,1774,1777],{"name":1768,"slug":1769,"type":15},"Aurora","aurora",{"name":20,"slug":21,"type":15},{"name":1772,"slug":1773,"type":15},"Database","database",{"name":1775,"slug":1776,"type":15},"Serverless","serverless",{"name":1778,"slug":1779,"type":15},"SQL","sql","2026-07-12T08:36:45.053393",{"slug":1782,"name":1783,"fn":1763,"description":1764,"org":1784,"tags":1785,"stars":1757,"repoUrl":1758,"updatedAt":1790},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1786,1787,1788,1789],{"name":20,"slug":21,"type":15},{"name":1772,"slug":1773,"type":15},{"name":1775,"slug":1776,"type":15},{"name":1778,"slug":1779,"type":15},"2026-07-12T08:36:42.694299",{"slug":1792,"name":1793,"fn":1763,"description":1764,"org":1794,"tags":1795,"stars":1757,"repoUrl":1758,"updatedAt":1803},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1796,1797,1798,1801,1802],{"name":20,"slug":21,"type":15},{"name":1772,"slug":1773,"type":15},{"name":1799,"slug":1800,"type":15},"Migration","migration",{"name":1775,"slug":1776,"type":15},{"name":1778,"slug":1779,"type":15},"2026-07-12T08:36:38.584057",{"slug":1805,"name":1806,"fn":1763,"description":1764,"org":1807,"tags":1808,"stars":1757,"repoUrl":1758,"updatedAt":1816},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1809,1810,1811,1814,1815],{"name":20,"slug":21,"type":15},{"name":1772,"slug":1773,"type":15},{"name":1812,"slug":1813,"type":15},"PostgreSQL","postgresql",{"name":1775,"slug":1776,"type":15},{"name":1778,"slug":1779,"type":15},"2026-07-12T08:36:46.530743",{"slug":1818,"name":1819,"fn":1763,"description":1764,"org":1820,"tags":1821,"stars":1757,"repoUrl":1758,"updatedAt":1826},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1822,1823,1824,1825],{"name":20,"slug":21,"type":15},{"name":1772,"slug":1773,"type":15},{"name":1775,"slug":1776,"type":15},{"name":1778,"slug":1779,"type":15},"2026-07-12T08:36:48.104182",{"slug":1828,"name":1828,"fn":1763,"description":1764,"org":1829,"tags":1830,"stars":1757,"repoUrl":1758,"updatedAt":1836},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1831,1832,1833,1834,1835],{"name":20,"slug":21,"type":15},{"name":1772,"slug":1773,"type":15},{"name":1799,"slug":1800,"type":15},{"name":1775,"slug":1776,"type":15},{"name":1778,"slug":1779,"type":15},"2026-07-12T08:36:36.374512",{"slug":1838,"name":1838,"fn":1839,"description":1840,"org":1841,"tags":1842,"stars":1853,"repoUrl":1854,"updatedAt":1855},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1843,1846,1849,1850],{"name":1844,"slug":1845,"type":15},"Accounting","accounting",{"name":1847,"slug":1848,"type":15},"Analytics","analytics",{"name":1705,"slug":1706,"type":15},{"name":1851,"slug":1852,"type":15},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":1857,"name":1857,"fn":1858,"description":1859,"org":1860,"tags":1861,"stars":1853,"repoUrl":1854,"updatedAt":1870},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1862,1863,1864,1867],{"name":20,"slug":21,"type":15},{"name":1851,"slug":1852,"type":15},{"name":1865,"slug":1866,"type":15},"Management","management",{"name":1868,"slug":1869,"type":15},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":1872,"name":1872,"fn":1873,"description":1874,"org":1875,"tags":1876,"stars":1853,"repoUrl":1854,"updatedAt":1885},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1877,1878,1879,1882],{"name":1847,"slug":1848,"type":15},{"name":1851,"slug":1852,"type":15},{"name":1880,"slug":1881,"type":15},"Financial Statements","financial-statements",{"name":1883,"slug":1884,"type":15},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":1887,"name":1887,"fn":1888,"description":1889,"org":1890,"tags":1891,"stars":1853,"repoUrl":1854,"updatedAt":1900},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1892,1895,1898],{"name":1893,"slug":1894,"type":15},"Automation","automation",{"name":1896,"slug":1897,"type":15},"Documents","documents",{"name":1899,"slug":1887,"type":15},"PDF","2026-07-12T08:41:44.135656",{"slug":1902,"name":1902,"fn":1903,"description":1904,"org":1905,"tags":1906,"stars":1853,"repoUrl":1854,"updatedAt":1915},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1907,1908,1911,1912],{"name":1844,"slug":1845,"type":15},{"name":1909,"slug":1910,"type":15},"Data Analysis","data-analysis",{"name":1851,"slug":1852,"type":15},{"name":1913,"slug":1914,"type":15},"KPI","kpi","2026-07-12T08:39:59.54971",150]