[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-aws-networking":3,"mdc--wn9bxx-key":35,"related-repo-aws-aws-networking":1264,"related-org-aws-aws-networking":1369},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"aws-networking","configure AWS networking services","Routes AWS networking requests to the correct service skill for implementation. Covers Route 53 (DNS, health checks, routing policies, Resolver, DNS Firewall), CloudFront (caching, edge, OAC, mTLS, signed URLs), Transit Gateway (multi-VPC hub, segmentation, centralized egress), Direct Connect (hybrid link, DX Gateway, MACsec), Site-to-Site VPN (IPsec tunnels, static or BGP), WAF (web ACLs, AWS Managed Rules, rate-based rules, Bot and Fraud Control), and Shield Advanced (L3\u002FL4 DDoS). Applicable when creating, configuring, troubleshooting, or designing across these services, choosing between them, or diagnosing connectivity or traffic-filtering issues. Not for VPC subnets and route tables, load balancers, VPC endpoints, PrivateLink, API Gateway, IAM policy logic, container or serverless networking, or IaC authoring.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"aws","AWS (Amazon)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Operations","operations","tag",{"name":17,"slug":18,"type":15},"Networking","networking",{"name":20,"slug":21,"type":15},"DNS","dns",{"name":23,"slug":8,"type":15},"AWS",1822,"https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws","2026-07-25T05:30:34.221936",null,157,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"Official, AWS-supported MCP servers, skills, and plugins to help AI agents build on AWS","https:\u002F\u002Fgithub.com\u002Faws\u002Fagent-toolkit-for-aws\u002Ftree\u002FHEAD\u002Fskills\u002Fcore-skills\u002Faws-networking","---\nname: aws-networking\ndescription: \"Routes AWS networking requests to the correct service skill for implementation. Covers Route 53 (DNS, health checks, routing policies, Resolver, DNS Firewall), CloudFront (caching, edge, OAC, mTLS, signed URLs), Transit Gateway (multi-VPC hub, segmentation, centralized egress), Direct Connect (hybrid link, DX Gateway, MACsec), Site-to-Site VPN (IPsec tunnels, static or BGP), WAF (web ACLs, AWS Managed Rules, rate-based rules, Bot and Fraud Control), and Shield Advanced (L3\u002FL4 DDoS). Applicable when creating, configuring, troubleshooting, or designing across these services, choosing between them, or diagnosing connectivity or traffic-filtering issues. Not for VPC subnets and route tables, load balancers, VPC endpoints, PrivateLink, API Gateway, IAM policy logic, container or serverless networking, or IaC authoring.\"\nversion: 1\n---\n\n# AWS Networking\n\n## Overview\n\nRoutes networking requests to the correct service-specific skill. Covers 7 services across DNS and content delivery, hybrid connectivity, and network security (web application firewall and DDoS protection). Other AWS networking services (VPC foundations, load balancing, endpoints, PrivateLink, API Gateway, and more) are out of scope for this router (see step 6).\n\n**Works best with** the [AWS MCP server](https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002F) — enables sandboxed execution, audit logging, and enterprise controls. All guidance also works with standard AWS CLI access.\n\n## How to use this skill\n\n1. Match the user's request against the **Skill Routing Table** below. Match on meaning, not exact wording.\n2. **If the request matches multiple skills**, use the Cross-Service Concepts tables to determine which layer the request targets, then route to the skill that owns that layer.\n3. **If still ambiguous**, ask one clarifying question: \"Are you looking to set up connectivity, or control\u002Ffilter existing traffic?\"\n4. Load the target skill: if the AWS MCP server is available, use `aws___retrieve_skill(skill_name=\"\u003Cskill>\")`; otherwise retrieve the skill document from this repository at `skills\u002F\u003Cskill>\u002FSKILL.md`.\n5. **If a request spans multiple of these skills**, route to each in dependency order. When routing to an internet-facing service (`cloudfront`), also route to `shieldadvanced` for DDoS protection and to `waf` for L7 filtering (AWS WAF attaches to CloudFront, Application Load Balancer, API Gateway, and AppSync), if the user has not already addressed L7 filtering and DDoS protection. When routing to a connectivity skill (`directconnect`, `sitetositevpn`, `transitgateway`), confirm encryption in transit is addressed (MACsec for Direct Connect, IPsec for VPN, inter-region peering encryption for Transit Gateway). When the request involves custom domains or TLS on `cloudfront`, note that ACM certificate provisioning is part of the implementation. When routing to `cloudfront` for a web-facing distribution, note that the target skill should address security response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) via a CloudFront Response Headers Policy, including the managed `SecurityHeadersPolicy`. The target skill handles the configuration.\n6. **If the request is an AWS networking task that is not in the Skill Routing Table** (for example VPC subnets or route tables, security groups, load balancers, VPC endpoints, PrivateLink, or API Gateway), tell the user that service is not available in this skill set rather than routing to the closest listed skill. This skill set does not cover every AWS networking service.\n7. This skill triages — it does not implement. Do not answer service-specific configuration questions from this skill alone.\n\n## Connectivity vs Security\n\n| Dimension | Connectivity | Security |\n| --- | --- | --- |\n| **Answers** | Can traffic reach its destination? | Should traffic be allowed? |\n| **Failure symptom** | Timeout, unreachable, black hole | Rejected, denied, dropped |\n| **Dependency** | Independent of policy — path exists or it doesn't | Assumes connectivity exists — can only filter reachable traffic |\n| **Granularity** | Affects all flows on a path | Targets specific flows by match criteria |\n\n## Skill Routing Table\n\n| Skill | Choose when… |\n| --- | --- |\n| `transitgateway` | Connecting more than two VPCs or on-premises networks in a hub, routing segmentation, cross-account\u002Fcross-region connectivity at scale, centralized egress\u002Finspection, multicast |\n| `directconnect` | Dedicated private link to on-premises — consistent latency, high throughput, MACsec encryption, LAGs, Direct Connect Gateway for multi-VPC, SiteLink for site-to-site bypass, production hybrid workloads |\n| `sitetositevpn` | Encrypted IPsec tunnel over internet — quick setup, DX backup, static or BGP routing, accelerated option via Global Accelerator backbone, standard or large tunnel bandwidth |\n| `route53` | DNS management (public\u002Fprivate zones, records), health checks, routing policies (weighted, failover, geo, latency), domain registration, Resolver (hybrid DNS forwarding), DNS Firewall, Route 53 Profiles, Global Resolver |\n| `cloudfront` | Caching, TLS termination at edge, origin protection (OAC), custom domains, cache policies\u002Fbehaviors, signed URLs, CloudFront Functions, viewer mTLS, VPC origins, multi-tenant distributions |\n| `waf` | Web application firewall (L7) — web ACLs on CloudFront\u002FALB\u002FAPI Gateway\u002FAppSync, AWS Managed Rules, rate-based rules for HTTP floods, IP\u002Fgeo match, Bot Control, Fraud Control (account takeover\u002Fcreation), for protecting web apps and APIs from exploits, bots, and credential stuffing |\n| `shieldadvanced` | L3\u002FL4 DDoS protection for internet-facing resources, automatic application-layer (L7) mitigation via WAF, health-based detection, Shield Response Team access, and DDoS cost-protection credits |\n\n## Cross-Service Concepts\n\nSame concept, different service depending on layer. Use these to disambiguate when the Skill Routing Table matches multiple skills.\n\n### Filtering \u002F Blocking\n\nUse when the user says \"block\", \"deny\", \"filter\", or \"restrict traffic\" — determines which layer the filtering operates at.\n\n| Layer | Service | What it filters on | Skill |\n| --- | --- | --- | --- |\n| L7 (HTTP\u002FHTTPS, web apps and APIs) | AWS WAF | HTTP request attributes, AWS Managed Rules, rate-based and bot rules, IP\u002Fgeo match | `waf` |\n| L3\u002FL4 (DDoS volumetric\u002Fstate-exhaustion) | Shield Advanced | Network\u002Ftransport-layer DDoS floods on internet-facing resources | `shieldadvanced` |\n| DNS (resolution) | Route 53 DNS Firewall | Domain name patterns — blocks resolution, not traffic | `route53` |\n\nWhen routing to `waf` or `cloudfront` for an internet-facing API or website, treat WAF rate-based rules as a default protective measure, not only when the user asks: note that the target skill should add WAF rate-based rules to bound request volume per client — the target skill implements it.\n\n### Logging \u002F Visibility\n\nUse when the user says \"logs\", \"visibility\", \"what's being blocked\", or \"can I see the traffic\" — identifies which log source to check.\n\n| What you need to see | Service | Log type | Skill |\n| --- | --- | --- | --- |\n| DNS queries from VPC | Route 53 Resolver | Query logs | `route53` |\n| Blocked\u002Fallowed HTTP requests | AWS WAF | web ACL logs (S3, CloudWatch Logs, or Kinesis Data Firehose) | `waf` |\n| DDoS events and attack detail | Shield Advanced | CloudWatch metrics, DDoS event detection | `shieldadvanced` |\n| Edge\u002FCDN request access | CloudFront | Standard logs (S3), real-time logs (Kinesis Data Streams) | `cloudfront` |\n| Tunnel state and traffic | Site-to-Site VPN | Tunnel telemetry, CloudWatch metrics | `sitetositevpn` |\n\nWhen routing to any of these services, remind the user to enable the corresponding logging (above) for security visibility and incident response — the target skill implements it. These logs can contain sensitive data (request query strings, internal hostnames in DNS queries), so also remind the user that the log destination (S3, CloudWatch Logs, Kinesis Data Firehose, or Kinesis Data Streams) MUST have encryption at rest enabled and access restricted to authorized personnel — the target skill implements it.\n\n### Traffic Shifting\n\nUse when the user says \"shift traffic\", \"blue\u002Fgreen\", \"failover\", \"canary\", or \"weighted routing\" — determines the granularity and which service controls it.\n\n| Granularity | Service | Mechanism | Skill |\n| --- | --- | --- | --- |\n| DNS-level (global) | Route 53 | Weighted, failover, geolocation, latency routing | `route53` |\n| Edge (HTTP) | CloudFront | Origin failover, origin groups | `cloudfront` |\n\n## Security Considerations\n\nThese services are security-sensitive, so raise the relevant risk and control when routing regardless of which skill you hand off to — the target skill implements the control:\n\n| Risk | Control the target skill should address | Skills |\n| --- | --- | --- |\n| Unencrypted traffic in transit | MACsec (`directconnect`), IPsec tunnels (`sitetositevpn`), inter-region peering encryption (`transitgateway`), TLS termination and viewer mTLS (`cloudfront`) | `directconnect`, `sitetositevpn`, `transitgateway`, `cloudfront` |\n| Missing DDoS protection on internet-facing resources | Shield Advanced L3\u002FL4 protection plus WAF L7 mitigation | `shieldadvanced`, `waf` |\n| Web\u002FAPI exploits, bots, and request floods | WAF web ACLs, AWS Managed Rules, and rate-based rules; application-layer input validation (request body size limits, schema validation); security response headers | `waf`, `cloudfront` |\n| Overly permissive filtering rules | Least-privilege DNS Firewall domain blocking | `route53` |\n| Over-privileged IAM policies for service resources | Least-privilege IAM roles scoped to specific resources and actions; avoid `FullAccess` managed policies and `Action: *`; prefer IAM roles with ephemeral credentials (instance profiles, IRSA, task roles, `sts assume-role`) over IAM users with long-lived access keys | all |\n| Hardcoded credentials and shared secrets | Let AWS auto-generate secrets where supported (for example Site-to-Site VPN pre-shared keys), or store customer-managed secrets in AWS Secrets Manager rather than hardcoding them | `sitetositevpn`, `directconnect` |\n| Confused-deputy in cross-service resource policies | Include `aws:SourceArn` and\u002For `aws:SourceAccount` condition keys in S3 bucket policies, KMS key policies, and log-destination resource policies (CloudFront OAC, log delivery to S3\u002FCloudWatch Logs\u002FKinesis) so only the intended resource and account can invoke them | `cloudfront`, `waf`, all |\n| Insufficient visibility for incident response | Enable the service logging in the Logging \u002F Visibility table, with encryption at rest and restricted access on the log destination | all |\n| No audit trail or alerting on control-plane changes | Enable AWS CloudTrail to audit control-plane API calls (record, rule, policy, and firewall changes) and set CloudWatch Alarms on security-relevant events (Shield Advanced DDoS detection, WAF blocked\u002Fcounted spikes, unexpected rule or record modifications); restrict the SNS topics that receive alarm notifications to authorized personnel and enable encryption at rest (SSE-KMS) on those topics, since the notifications can contain sensitive event detail | all |\n\nFor authoritative guidance, point users to the [AWS Well-Architected Framework Security Pillar](https:\u002F\u002Fdocs.aws.amazon.com\u002Fwellarchitected\u002Flatest\u002Fsecurity-pillar\u002F) and the service-specific security documentation for the target skill.\n",{"data":36,"body":38},{"name":4,"description":6,"version":37},1,{"type":39,"children":40},"root",[41,49,56,62,84,90,243,249,366,371,506,512,517,524,529,638,657,663,668,826,831,837,842,922,928,933,1250],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":48},"text","AWS Networking",{"type":42,"tag":50,"props":51,"children":53},"h2",{"id":52},"overview",[54],{"type":47,"value":55},"Overview",{"type":42,"tag":57,"props":58,"children":59},"p",{},[60],{"type":47,"value":61},"Routes networking requests to the correct service-specific skill. Covers 7 services across DNS and content delivery, hybrid connectivity, and network security (web application firewall and DDoS protection). Other AWS networking services (VPC foundations, load balancing, endpoints, PrivateLink, API Gateway, and more) are out of scope for this router (see step 6).",{"type":42,"tag":57,"props":63,"children":64},{},[65,71,73,82],{"type":42,"tag":66,"props":67,"children":68},"strong",{},[69],{"type":47,"value":70},"Works best with",{"type":47,"value":72}," the ",{"type":42,"tag":74,"props":75,"children":79},"a",{"href":76,"rel":77},"https:\u002F\u002Fdocs.aws.amazon.com\u002Faws-mcp\u002F",[78],"nofollow",[80],{"type":47,"value":81},"AWS MCP server",{"type":47,"value":83}," — enables sandboxed execution, audit logging, and enterprise controls. All guidance also works with standard AWS CLI access.",{"type":42,"tag":50,"props":85,"children":87},{"id":86},"how-to-use-this-skill",[88],{"type":47,"value":89},"How to use this skill",{"type":42,"tag":91,"props":92,"children":93},"ol",{},[94,107,117,127,149,228,238],{"type":42,"tag":95,"props":96,"children":97},"li",{},[98,100,105],{"type":47,"value":99},"Match the user's request against the ",{"type":42,"tag":66,"props":101,"children":102},{},[103],{"type":47,"value":104},"Skill Routing Table",{"type":47,"value":106}," below. Match on meaning, not exact wording.",{"type":42,"tag":95,"props":108,"children":109},{},[110,115],{"type":42,"tag":66,"props":111,"children":112},{},[113],{"type":47,"value":114},"If the request matches multiple skills",{"type":47,"value":116},", use the Cross-Service Concepts tables to determine which layer the request targets, then route to the skill that owns that layer.",{"type":42,"tag":95,"props":118,"children":119},{},[120,125],{"type":42,"tag":66,"props":121,"children":122},{},[123],{"type":47,"value":124},"If still ambiguous",{"type":47,"value":126},", ask one clarifying question: \"Are you looking to set up connectivity, or control\u002Ffilter existing traffic?\"",{"type":42,"tag":95,"props":128,"children":129},{},[130,132,139,141,147],{"type":47,"value":131},"Load the target skill: if the AWS MCP server is available, use ",{"type":42,"tag":133,"props":134,"children":136},"code",{"className":135},[],[137],{"type":47,"value":138},"aws___retrieve_skill(skill_name=\"\u003Cskill>\")",{"type":47,"value":140},"; otherwise retrieve the skill document from this repository at ",{"type":42,"tag":133,"props":142,"children":144},{"className":143},[],[145],{"type":47,"value":146},"skills\u002F\u003Cskill>\u002FSKILL.md",{"type":47,"value":148},".",{"type":42,"tag":95,"props":150,"children":151},{},[152,157,159,165,167,173,175,181,183,189,191,197,198,204,206,211,213,218,220,226],{"type":42,"tag":66,"props":153,"children":154},{},[155],{"type":47,"value":156},"If a request spans multiple of these skills",{"type":47,"value":158},", route to each in dependency order. When routing to an internet-facing service (",{"type":42,"tag":133,"props":160,"children":162},{"className":161},[],[163],{"type":47,"value":164},"cloudfront",{"type":47,"value":166},"), also route to ",{"type":42,"tag":133,"props":168,"children":170},{"className":169},[],[171],{"type":47,"value":172},"shieldadvanced",{"type":47,"value":174}," for DDoS protection and to ",{"type":42,"tag":133,"props":176,"children":178},{"className":177},[],[179],{"type":47,"value":180},"waf",{"type":47,"value":182}," for L7 filtering (AWS WAF attaches to CloudFront, Application Load Balancer, API Gateway, and AppSync), if the user has not already addressed L7 filtering and DDoS protection. When routing to a connectivity skill (",{"type":42,"tag":133,"props":184,"children":186},{"className":185},[],[187],{"type":47,"value":188},"directconnect",{"type":47,"value":190},", ",{"type":42,"tag":133,"props":192,"children":194},{"className":193},[],[195],{"type":47,"value":196},"sitetositevpn",{"type":47,"value":190},{"type":42,"tag":133,"props":199,"children":201},{"className":200},[],[202],{"type":47,"value":203},"transitgateway",{"type":47,"value":205},"), confirm encryption in transit is addressed (MACsec for Direct Connect, IPsec for VPN, inter-region peering encryption for Transit Gateway). When the request involves custom domains or TLS on ",{"type":42,"tag":133,"props":207,"children":209},{"className":208},[],[210],{"type":47,"value":164},{"type":47,"value":212},", note that ACM certificate provisioning is part of the implementation. When routing to ",{"type":42,"tag":133,"props":214,"children":216},{"className":215},[],[217],{"type":47,"value":164},{"type":47,"value":219}," for a web-facing distribution, note that the target skill should address security response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) via a CloudFront Response Headers Policy, including the managed ",{"type":42,"tag":133,"props":221,"children":223},{"className":222},[],[224],{"type":47,"value":225},"SecurityHeadersPolicy",{"type":47,"value":227},". The target skill handles the configuration.",{"type":42,"tag":95,"props":229,"children":230},{},[231,236],{"type":42,"tag":66,"props":232,"children":233},{},[234],{"type":47,"value":235},"If the request is an AWS networking task that is not in the Skill Routing Table",{"type":47,"value":237}," (for example VPC subnets or route tables, security groups, load balancers, VPC endpoints, PrivateLink, or API Gateway), tell the user that service is not available in this skill set rather than routing to the closest listed skill. This skill set does not cover every AWS networking service.",{"type":42,"tag":95,"props":239,"children":240},{},[241],{"type":47,"value":242},"This skill triages — it does not implement. Do not answer service-specific configuration questions from this skill alone.",{"type":42,"tag":50,"props":244,"children":246},{"id":245},"connectivity-vs-security",[247],{"type":47,"value":248},"Connectivity vs Security",{"type":42,"tag":250,"props":251,"children":252},"table",{},[253,277],{"type":42,"tag":254,"props":255,"children":256},"thead",{},[257],{"type":42,"tag":258,"props":259,"children":260},"tr",{},[261,267,272],{"type":42,"tag":262,"props":263,"children":264},"th",{},[265],{"type":47,"value":266},"Dimension",{"type":42,"tag":262,"props":268,"children":269},{},[270],{"type":47,"value":271},"Connectivity",{"type":42,"tag":262,"props":273,"children":274},{},[275],{"type":47,"value":276},"Security",{"type":42,"tag":278,"props":279,"children":280},"tbody",{},[281,303,324,345],{"type":42,"tag":258,"props":282,"children":283},{},[284,293,298],{"type":42,"tag":285,"props":286,"children":287},"td",{},[288],{"type":42,"tag":66,"props":289,"children":290},{},[291],{"type":47,"value":292},"Answers",{"type":42,"tag":285,"props":294,"children":295},{},[296],{"type":47,"value":297},"Can traffic reach its destination?",{"type":42,"tag":285,"props":299,"children":300},{},[301],{"type":47,"value":302},"Should traffic be allowed?",{"type":42,"tag":258,"props":304,"children":305},{},[306,314,319],{"type":42,"tag":285,"props":307,"children":308},{},[309],{"type":42,"tag":66,"props":310,"children":311},{},[312],{"type":47,"value":313},"Failure symptom",{"type":42,"tag":285,"props":315,"children":316},{},[317],{"type":47,"value":318},"Timeout, unreachable, black hole",{"type":42,"tag":285,"props":320,"children":321},{},[322],{"type":47,"value":323},"Rejected, denied, dropped",{"type":42,"tag":258,"props":325,"children":326},{},[327,335,340],{"type":42,"tag":285,"props":328,"children":329},{},[330],{"type":42,"tag":66,"props":331,"children":332},{},[333],{"type":47,"value":334},"Dependency",{"type":42,"tag":285,"props":336,"children":337},{},[338],{"type":47,"value":339},"Independent of policy — path exists or it doesn't",{"type":42,"tag":285,"props":341,"children":342},{},[343],{"type":47,"value":344},"Assumes connectivity exists — can only filter reachable traffic",{"type":42,"tag":258,"props":346,"children":347},{},[348,356,361],{"type":42,"tag":285,"props":349,"children":350},{},[351],{"type":42,"tag":66,"props":352,"children":353},{},[354],{"type":47,"value":355},"Granularity",{"type":42,"tag":285,"props":357,"children":358},{},[359],{"type":47,"value":360},"Affects all flows on a path",{"type":42,"tag":285,"props":362,"children":363},{},[364],{"type":47,"value":365},"Targets specific flows by match criteria",{"type":42,"tag":50,"props":367,"children":369},{"id":368},"skill-routing-table",[370],{"type":47,"value":104},{"type":42,"tag":250,"props":372,"children":373},{},[374,390],{"type":42,"tag":254,"props":375,"children":376},{},[377],{"type":42,"tag":258,"props":378,"children":379},{},[380,385],{"type":42,"tag":262,"props":381,"children":382},{},[383],{"type":47,"value":384},"Skill",{"type":42,"tag":262,"props":386,"children":387},{},[388],{"type":47,"value":389},"Choose when…",{"type":42,"tag":278,"props":391,"children":392},{},[393,409,425,441,458,474,490],{"type":42,"tag":258,"props":394,"children":395},{},[396,404],{"type":42,"tag":285,"props":397,"children":398},{},[399],{"type":42,"tag":133,"props":400,"children":402},{"className":401},[],[403],{"type":47,"value":203},{"type":42,"tag":285,"props":405,"children":406},{},[407],{"type":47,"value":408},"Connecting more than two VPCs or on-premises networks in a hub, routing segmentation, cross-account\u002Fcross-region connectivity at scale, centralized egress\u002Finspection, multicast",{"type":42,"tag":258,"props":410,"children":411},{},[412,420],{"type":42,"tag":285,"props":413,"children":414},{},[415],{"type":42,"tag":133,"props":416,"children":418},{"className":417},[],[419],{"type":47,"value":188},{"type":42,"tag":285,"props":421,"children":422},{},[423],{"type":47,"value":424},"Dedicated private link to on-premises — consistent latency, high throughput, MACsec encryption, LAGs, Direct Connect Gateway for multi-VPC, SiteLink for site-to-site bypass, production hybrid workloads",{"type":42,"tag":258,"props":426,"children":427},{},[428,436],{"type":42,"tag":285,"props":429,"children":430},{},[431],{"type":42,"tag":133,"props":432,"children":434},{"className":433},[],[435],{"type":47,"value":196},{"type":42,"tag":285,"props":437,"children":438},{},[439],{"type":47,"value":440},"Encrypted IPsec tunnel over internet — quick setup, DX backup, static or BGP routing, accelerated option via Global Accelerator backbone, standard or large tunnel bandwidth",{"type":42,"tag":258,"props":442,"children":443},{},[444,453],{"type":42,"tag":285,"props":445,"children":446},{},[447],{"type":42,"tag":133,"props":448,"children":450},{"className":449},[],[451],{"type":47,"value":452},"route53",{"type":42,"tag":285,"props":454,"children":455},{},[456],{"type":47,"value":457},"DNS management (public\u002Fprivate zones, records), health checks, routing policies (weighted, failover, geo, latency), domain registration, Resolver (hybrid DNS forwarding), DNS Firewall, Route 53 Profiles, Global Resolver",{"type":42,"tag":258,"props":459,"children":460},{},[461,469],{"type":42,"tag":285,"props":462,"children":463},{},[464],{"type":42,"tag":133,"props":465,"children":467},{"className":466},[],[468],{"type":47,"value":164},{"type":42,"tag":285,"props":470,"children":471},{},[472],{"type":47,"value":473},"Caching, TLS termination at edge, origin protection (OAC), custom domains, cache policies\u002Fbehaviors, signed URLs, CloudFront Functions, viewer mTLS, VPC origins, multi-tenant distributions",{"type":42,"tag":258,"props":475,"children":476},{},[477,485],{"type":42,"tag":285,"props":478,"children":479},{},[480],{"type":42,"tag":133,"props":481,"children":483},{"className":482},[],[484],{"type":47,"value":180},{"type":42,"tag":285,"props":486,"children":487},{},[488],{"type":47,"value":489},"Web application firewall (L7) — web ACLs on CloudFront\u002FALB\u002FAPI Gateway\u002FAppSync, AWS Managed Rules, rate-based rules for HTTP floods, IP\u002Fgeo match, Bot Control, Fraud Control (account takeover\u002Fcreation), for protecting web apps and APIs from exploits, bots, and credential stuffing",{"type":42,"tag":258,"props":491,"children":492},{},[493,501],{"type":42,"tag":285,"props":494,"children":495},{},[496],{"type":42,"tag":133,"props":497,"children":499},{"className":498},[],[500],{"type":47,"value":172},{"type":42,"tag":285,"props":502,"children":503},{},[504],{"type":47,"value":505},"L3\u002FL4 DDoS protection for internet-facing resources, automatic application-layer (L7) mitigation via WAF, health-based detection, Shield Response Team access, and DDoS cost-protection credits",{"type":42,"tag":50,"props":507,"children":509},{"id":508},"cross-service-concepts",[510],{"type":47,"value":511},"Cross-Service Concepts",{"type":42,"tag":57,"props":513,"children":514},{},[515],{"type":47,"value":516},"Same concept, different service depending on layer. Use these to disambiguate when the Skill Routing Table matches multiple skills.",{"type":42,"tag":518,"props":519,"children":521},"h3",{"id":520},"filtering-blocking",[522],{"type":47,"value":523},"Filtering \u002F Blocking",{"type":42,"tag":57,"props":525,"children":526},{},[527],{"type":47,"value":528},"Use when the user says \"block\", \"deny\", \"filter\", or \"restrict traffic\" — determines which layer the filtering operates at.",{"type":42,"tag":250,"props":530,"children":531},{},[532,557],{"type":42,"tag":254,"props":533,"children":534},{},[535],{"type":42,"tag":258,"props":536,"children":537},{},[538,543,548,553],{"type":42,"tag":262,"props":539,"children":540},{},[541],{"type":47,"value":542},"Layer",{"type":42,"tag":262,"props":544,"children":545},{},[546],{"type":47,"value":547},"Service",{"type":42,"tag":262,"props":549,"children":550},{},[551],{"type":47,"value":552},"What it filters on",{"type":42,"tag":262,"props":554,"children":555},{},[556],{"type":47,"value":384},{"type":42,"tag":278,"props":558,"children":559},{},[560,586,612],{"type":42,"tag":258,"props":561,"children":562},{},[563,568,573,578],{"type":42,"tag":285,"props":564,"children":565},{},[566],{"type":47,"value":567},"L7 (HTTP\u002FHTTPS, web apps and APIs)",{"type":42,"tag":285,"props":569,"children":570},{},[571],{"type":47,"value":572},"AWS WAF",{"type":42,"tag":285,"props":574,"children":575},{},[576],{"type":47,"value":577},"HTTP request attributes, AWS Managed Rules, rate-based and bot rules, IP\u002Fgeo match",{"type":42,"tag":285,"props":579,"children":580},{},[581],{"type":42,"tag":133,"props":582,"children":584},{"className":583},[],[585],{"type":47,"value":180},{"type":42,"tag":258,"props":587,"children":588},{},[589,594,599,604],{"type":42,"tag":285,"props":590,"children":591},{},[592],{"type":47,"value":593},"L3\u002FL4 (DDoS volumetric\u002Fstate-exhaustion)",{"type":42,"tag":285,"props":595,"children":596},{},[597],{"type":47,"value":598},"Shield Advanced",{"type":42,"tag":285,"props":600,"children":601},{},[602],{"type":47,"value":603},"Network\u002Ftransport-layer DDoS floods on internet-facing resources",{"type":42,"tag":285,"props":605,"children":606},{},[607],{"type":42,"tag":133,"props":608,"children":610},{"className":609},[],[611],{"type":47,"value":172},{"type":42,"tag":258,"props":613,"children":614},{},[615,620,625,630],{"type":42,"tag":285,"props":616,"children":617},{},[618],{"type":47,"value":619},"DNS (resolution)",{"type":42,"tag":285,"props":621,"children":622},{},[623],{"type":47,"value":624},"Route 53 DNS Firewall",{"type":42,"tag":285,"props":626,"children":627},{},[628],{"type":47,"value":629},"Domain name patterns — blocks resolution, not traffic",{"type":42,"tag":285,"props":631,"children":632},{},[633],{"type":42,"tag":133,"props":634,"children":636},{"className":635},[],[637],{"type":47,"value":452},{"type":42,"tag":57,"props":639,"children":640},{},[641,643,648,650,655],{"type":47,"value":642},"When routing to ",{"type":42,"tag":133,"props":644,"children":646},{"className":645},[],[647],{"type":47,"value":180},{"type":47,"value":649}," or ",{"type":42,"tag":133,"props":651,"children":653},{"className":652},[],[654],{"type":47,"value":164},{"type":47,"value":656}," for an internet-facing API or website, treat WAF rate-based rules as a default protective measure, not only when the user asks: note that the target skill should add WAF rate-based rules to bound request volume per client — the target skill implements it.",{"type":42,"tag":518,"props":658,"children":660},{"id":659},"logging-visibility",[661],{"type":47,"value":662},"Logging \u002F Visibility",{"type":42,"tag":57,"props":664,"children":665},{},[666],{"type":47,"value":667},"Use when the user says \"logs\", \"visibility\", \"what's being blocked\", or \"can I see the traffic\" — identifies which log source to check.",{"type":42,"tag":250,"props":669,"children":670},{},[671,695],{"type":42,"tag":254,"props":672,"children":673},{},[674],{"type":42,"tag":258,"props":675,"children":676},{},[677,682,686,691],{"type":42,"tag":262,"props":678,"children":679},{},[680],{"type":47,"value":681},"What you need to see",{"type":42,"tag":262,"props":683,"children":684},{},[685],{"type":47,"value":547},{"type":42,"tag":262,"props":687,"children":688},{},[689],{"type":47,"value":690},"Log type",{"type":42,"tag":262,"props":692,"children":693},{},[694],{"type":47,"value":384},{"type":42,"tag":278,"props":696,"children":697},{},[698,724,749,774,800],{"type":42,"tag":258,"props":699,"children":700},{},[701,706,711,716],{"type":42,"tag":285,"props":702,"children":703},{},[704],{"type":47,"value":705},"DNS queries from VPC",{"type":42,"tag":285,"props":707,"children":708},{},[709],{"type":47,"value":710},"Route 53 Resolver",{"type":42,"tag":285,"props":712,"children":713},{},[714],{"type":47,"value":715},"Query logs",{"type":42,"tag":285,"props":717,"children":718},{},[719],{"type":42,"tag":133,"props":720,"children":722},{"className":721},[],[723],{"type":47,"value":452},{"type":42,"tag":258,"props":725,"children":726},{},[727,732,736,741],{"type":42,"tag":285,"props":728,"children":729},{},[730],{"type":47,"value":731},"Blocked\u002Fallowed HTTP requests",{"type":42,"tag":285,"props":733,"children":734},{},[735],{"type":47,"value":572},{"type":42,"tag":285,"props":737,"children":738},{},[739],{"type":47,"value":740},"web ACL logs (S3, CloudWatch Logs, or Kinesis Data Firehose)",{"type":42,"tag":285,"props":742,"children":743},{},[744],{"type":42,"tag":133,"props":745,"children":747},{"className":746},[],[748],{"type":47,"value":180},{"type":42,"tag":258,"props":750,"children":751},{},[752,757,761,766],{"type":42,"tag":285,"props":753,"children":754},{},[755],{"type":47,"value":756},"DDoS events and attack detail",{"type":42,"tag":285,"props":758,"children":759},{},[760],{"type":47,"value":598},{"type":42,"tag":285,"props":762,"children":763},{},[764],{"type":47,"value":765},"CloudWatch metrics, DDoS event detection",{"type":42,"tag":285,"props":767,"children":768},{},[769],{"type":42,"tag":133,"props":770,"children":772},{"className":771},[],[773],{"type":47,"value":172},{"type":42,"tag":258,"props":775,"children":776},{},[777,782,787,792],{"type":42,"tag":285,"props":778,"children":779},{},[780],{"type":47,"value":781},"Edge\u002FCDN request access",{"type":42,"tag":285,"props":783,"children":784},{},[785],{"type":47,"value":786},"CloudFront",{"type":42,"tag":285,"props":788,"children":789},{},[790],{"type":47,"value":791},"Standard logs (S3), real-time logs (Kinesis Data Streams)",{"type":42,"tag":285,"props":793,"children":794},{},[795],{"type":42,"tag":133,"props":796,"children":798},{"className":797},[],[799],{"type":47,"value":164},{"type":42,"tag":258,"props":801,"children":802},{},[803,808,813,818],{"type":42,"tag":285,"props":804,"children":805},{},[806],{"type":47,"value":807},"Tunnel state and traffic",{"type":42,"tag":285,"props":809,"children":810},{},[811],{"type":47,"value":812},"Site-to-Site VPN",{"type":42,"tag":285,"props":814,"children":815},{},[816],{"type":47,"value":817},"Tunnel telemetry, CloudWatch metrics",{"type":42,"tag":285,"props":819,"children":820},{},[821],{"type":42,"tag":133,"props":822,"children":824},{"className":823},[],[825],{"type":47,"value":196},{"type":42,"tag":57,"props":827,"children":828},{},[829],{"type":47,"value":830},"When routing to any of these services, remind the user to enable the corresponding logging (above) for security visibility and incident response — the target skill implements it. These logs can contain sensitive data (request query strings, internal hostnames in DNS queries), so also remind the user that the log destination (S3, CloudWatch Logs, Kinesis Data Firehose, or Kinesis Data Streams) MUST have encryption at rest enabled and access restricted to authorized personnel — the target skill implements it.",{"type":42,"tag":518,"props":832,"children":834},{"id":833},"traffic-shifting",[835],{"type":47,"value":836},"Traffic Shifting",{"type":42,"tag":57,"props":838,"children":839},{},[840],{"type":47,"value":841},"Use when the user says \"shift traffic\", \"blue\u002Fgreen\", \"failover\", \"canary\", or \"weighted routing\" — determines the granularity and which service controls it.",{"type":42,"tag":250,"props":843,"children":844},{},[845,868],{"type":42,"tag":254,"props":846,"children":847},{},[848],{"type":42,"tag":258,"props":849,"children":850},{},[851,855,859,864],{"type":42,"tag":262,"props":852,"children":853},{},[854],{"type":47,"value":355},{"type":42,"tag":262,"props":856,"children":857},{},[858],{"type":47,"value":547},{"type":42,"tag":262,"props":860,"children":861},{},[862],{"type":47,"value":863},"Mechanism",{"type":42,"tag":262,"props":865,"children":866},{},[867],{"type":47,"value":384},{"type":42,"tag":278,"props":869,"children":870},{},[871,897],{"type":42,"tag":258,"props":872,"children":873},{},[874,879,884,889],{"type":42,"tag":285,"props":875,"children":876},{},[877],{"type":47,"value":878},"DNS-level (global)",{"type":42,"tag":285,"props":880,"children":881},{},[882],{"type":47,"value":883},"Route 53",{"type":42,"tag":285,"props":885,"children":886},{},[887],{"type":47,"value":888},"Weighted, failover, geolocation, latency routing",{"type":42,"tag":285,"props":890,"children":891},{},[892],{"type":42,"tag":133,"props":893,"children":895},{"className":894},[],[896],{"type":47,"value":452},{"type":42,"tag":258,"props":898,"children":899},{},[900,905,909,914],{"type":42,"tag":285,"props":901,"children":902},{},[903],{"type":47,"value":904},"Edge (HTTP)",{"type":42,"tag":285,"props":906,"children":907},{},[908],{"type":47,"value":786},{"type":42,"tag":285,"props":910,"children":911},{},[912],{"type":47,"value":913},"Origin failover, origin groups",{"type":42,"tag":285,"props":915,"children":916},{},[917],{"type":42,"tag":133,"props":918,"children":920},{"className":919},[],[921],{"type":47,"value":164},{"type":42,"tag":50,"props":923,"children":925},{"id":924},"security-considerations",[926],{"type":47,"value":927},"Security Considerations",{"type":42,"tag":57,"props":929,"children":930},{},[931],{"type":47,"value":932},"These services are security-sensitive, so raise the relevant risk and control when routing regardless of which skill you hand off to — the target skill implements the control:",{"type":42,"tag":250,"props":934,"children":935},{},[936,957],{"type":42,"tag":254,"props":937,"children":938},{},[939],{"type":42,"tag":258,"props":940,"children":941},{},[942,947,952],{"type":42,"tag":262,"props":943,"children":944},{},[945],{"type":47,"value":946},"Risk",{"type":42,"tag":262,"props":948,"children":949},{},[950],{"type":47,"value":951},"Control the target skill should address",{"type":42,"tag":262,"props":953,"children":954},{},[955],{"type":47,"value":956},"Skills",{"type":42,"tag":278,"props":958,"children":959},{},[960,1027,1054,1081,1102,1144,1171,1216,1233],{"type":42,"tag":258,"props":961,"children":962},{},[963,968,1001],{"type":42,"tag":285,"props":964,"children":965},{},[966],{"type":47,"value":967},"Unencrypted traffic in transit",{"type":42,"tag":285,"props":969,"children":970},{},[971,973,978,980,985,987,992,994,999],{"type":47,"value":972},"MACsec (",{"type":42,"tag":133,"props":974,"children":976},{"className":975},[],[977],{"type":47,"value":188},{"type":47,"value":979},"), IPsec tunnels (",{"type":42,"tag":133,"props":981,"children":983},{"className":982},[],[984],{"type":47,"value":196},{"type":47,"value":986},"), inter-region peering encryption (",{"type":42,"tag":133,"props":988,"children":990},{"className":989},[],[991],{"type":47,"value":203},{"type":47,"value":993},"), TLS termination and viewer mTLS (",{"type":42,"tag":133,"props":995,"children":997},{"className":996},[],[998],{"type":47,"value":164},{"type":47,"value":1000},")",{"type":42,"tag":285,"props":1002,"children":1003},{},[1004,1009,1010,1015,1016,1021,1022],{"type":42,"tag":133,"props":1005,"children":1007},{"className":1006},[],[1008],{"type":47,"value":188},{"type":47,"value":190},{"type":42,"tag":133,"props":1011,"children":1013},{"className":1012},[],[1014],{"type":47,"value":196},{"type":47,"value":190},{"type":42,"tag":133,"props":1017,"children":1019},{"className":1018},[],[1020],{"type":47,"value":203},{"type":47,"value":190},{"type":42,"tag":133,"props":1023,"children":1025},{"className":1024},[],[1026],{"type":47,"value":164},{"type":42,"tag":258,"props":1028,"children":1029},{},[1030,1035,1040],{"type":42,"tag":285,"props":1031,"children":1032},{},[1033],{"type":47,"value":1034},"Missing DDoS protection on internet-facing resources",{"type":42,"tag":285,"props":1036,"children":1037},{},[1038],{"type":47,"value":1039},"Shield Advanced L3\u002FL4 protection plus WAF L7 mitigation",{"type":42,"tag":285,"props":1041,"children":1042},{},[1043,1048,1049],{"type":42,"tag":133,"props":1044,"children":1046},{"className":1045},[],[1047],{"type":47,"value":172},{"type":47,"value":190},{"type":42,"tag":133,"props":1050,"children":1052},{"className":1051},[],[1053],{"type":47,"value":180},{"type":42,"tag":258,"props":1055,"children":1056},{},[1057,1062,1067],{"type":42,"tag":285,"props":1058,"children":1059},{},[1060],{"type":47,"value":1061},"Web\u002FAPI exploits, bots, and request floods",{"type":42,"tag":285,"props":1063,"children":1064},{},[1065],{"type":47,"value":1066},"WAF web ACLs, AWS Managed Rules, and rate-based rules; application-layer input validation (request body size limits, schema validation); security response headers",{"type":42,"tag":285,"props":1068,"children":1069},{},[1070,1075,1076],{"type":42,"tag":133,"props":1071,"children":1073},{"className":1072},[],[1074],{"type":47,"value":180},{"type":47,"value":190},{"type":42,"tag":133,"props":1077,"children":1079},{"className":1078},[],[1080],{"type":47,"value":164},{"type":42,"tag":258,"props":1082,"children":1083},{},[1084,1089,1094],{"type":42,"tag":285,"props":1085,"children":1086},{},[1087],{"type":47,"value":1088},"Overly permissive filtering rules",{"type":42,"tag":285,"props":1090,"children":1091},{},[1092],{"type":47,"value":1093},"Least-privilege DNS Firewall domain blocking",{"type":42,"tag":285,"props":1095,"children":1096},{},[1097],{"type":42,"tag":133,"props":1098,"children":1100},{"className":1099},[],[1101],{"type":47,"value":452},{"type":42,"tag":258,"props":1103,"children":1104},{},[1105,1110,1139],{"type":42,"tag":285,"props":1106,"children":1107},{},[1108],{"type":47,"value":1109},"Over-privileged IAM policies for service resources",{"type":42,"tag":285,"props":1111,"children":1112},{},[1113,1115,1121,1123,1129,1131,1137],{"type":47,"value":1114},"Least-privilege IAM roles scoped to specific resources and actions; avoid ",{"type":42,"tag":133,"props":1116,"children":1118},{"className":1117},[],[1119],{"type":47,"value":1120},"FullAccess",{"type":47,"value":1122}," managed policies and ",{"type":42,"tag":133,"props":1124,"children":1126},{"className":1125},[],[1127],{"type":47,"value":1128},"Action: *",{"type":47,"value":1130},"; prefer IAM roles with ephemeral credentials (instance profiles, IRSA, task roles, ",{"type":42,"tag":133,"props":1132,"children":1134},{"className":1133},[],[1135],{"type":47,"value":1136},"sts assume-role",{"type":47,"value":1138},") over IAM users with long-lived access keys",{"type":42,"tag":285,"props":1140,"children":1141},{},[1142],{"type":47,"value":1143},"all",{"type":42,"tag":258,"props":1145,"children":1146},{},[1147,1152,1157],{"type":42,"tag":285,"props":1148,"children":1149},{},[1150],{"type":47,"value":1151},"Hardcoded credentials and shared secrets",{"type":42,"tag":285,"props":1153,"children":1154},{},[1155],{"type":47,"value":1156},"Let AWS auto-generate secrets where supported (for example Site-to-Site VPN pre-shared keys), or store customer-managed secrets in AWS Secrets Manager rather than hardcoding them",{"type":42,"tag":285,"props":1158,"children":1159},{},[1160,1165,1166],{"type":42,"tag":133,"props":1161,"children":1163},{"className":1162},[],[1164],{"type":47,"value":196},{"type":47,"value":190},{"type":42,"tag":133,"props":1167,"children":1169},{"className":1168},[],[1170],{"type":47,"value":188},{"type":42,"tag":258,"props":1172,"children":1173},{},[1174,1179,1200],{"type":42,"tag":285,"props":1175,"children":1176},{},[1177],{"type":47,"value":1178},"Confused-deputy in cross-service resource policies",{"type":42,"tag":285,"props":1180,"children":1181},{},[1182,1184,1190,1192,1198],{"type":47,"value":1183},"Include ",{"type":42,"tag":133,"props":1185,"children":1187},{"className":1186},[],[1188],{"type":47,"value":1189},"aws:SourceArn",{"type":47,"value":1191}," and\u002For ",{"type":42,"tag":133,"props":1193,"children":1195},{"className":1194},[],[1196],{"type":47,"value":1197},"aws:SourceAccount",{"type":47,"value":1199}," condition keys in S3 bucket policies, KMS key policies, and log-destination resource policies (CloudFront OAC, log delivery to S3\u002FCloudWatch Logs\u002FKinesis) so only the intended resource and account can invoke them",{"type":42,"tag":285,"props":1201,"children":1202},{},[1203,1208,1209,1214],{"type":42,"tag":133,"props":1204,"children":1206},{"className":1205},[],[1207],{"type":47,"value":164},{"type":47,"value":190},{"type":42,"tag":133,"props":1210,"children":1212},{"className":1211},[],[1213],{"type":47,"value":180},{"type":47,"value":1215},", all",{"type":42,"tag":258,"props":1217,"children":1218},{},[1219,1224,1229],{"type":42,"tag":285,"props":1220,"children":1221},{},[1222],{"type":47,"value":1223},"Insufficient visibility for incident response",{"type":42,"tag":285,"props":1225,"children":1226},{},[1227],{"type":47,"value":1228},"Enable the service logging in the Logging \u002F Visibility table, with encryption at rest and restricted access on the log destination",{"type":42,"tag":285,"props":1230,"children":1231},{},[1232],{"type":47,"value":1143},{"type":42,"tag":258,"props":1234,"children":1235},{},[1236,1241,1246],{"type":42,"tag":285,"props":1237,"children":1238},{},[1239],{"type":47,"value":1240},"No audit trail or alerting on control-plane changes",{"type":42,"tag":285,"props":1242,"children":1243},{},[1244],{"type":47,"value":1245},"Enable AWS CloudTrail to audit control-plane API calls (record, rule, policy, and firewall changes) and set CloudWatch Alarms on security-relevant events (Shield Advanced DDoS detection, WAF blocked\u002Fcounted spikes, unexpected rule or record modifications); restrict the SNS topics that receive alarm notifications to authorized personnel and enable encryption at rest (SSE-KMS) on those topics, since the notifications can contain sensitive event detail",{"type":42,"tag":285,"props":1247,"children":1248},{},[1249],{"type":47,"value":1143},{"type":42,"tag":57,"props":1251,"children":1252},{},[1253,1255,1262],{"type":47,"value":1254},"For authoritative guidance, point users to the ",{"type":42,"tag":74,"props":1256,"children":1259},{"href":1257,"rel":1258},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fwellarchitected\u002Flatest\u002Fsecurity-pillar\u002F",[78],[1260],{"type":47,"value":1261},"AWS Well-Architected Framework Security Pillar",{"type":47,"value":1263}," and the service-specific security documentation for the target skill.",{"items":1265,"total":1368},[1266,1283,1298,1313,1328,1338,1352],{"slug":1267,"name":1267,"fn":1268,"description":1269,"org":1270,"tags":1271,"stars":24,"repoUrl":25,"updatedAt":1282},"agents-build","add capabilities to existing agent projects","Use when adding capabilities to an existing agent project — memory, app integration, VPC, multi-agent, migration, model changes, browser, code interpreter, or resource removal. Triggers on: \"add memory\", \"remember across sessions\", \"call agent from app\", \"invoke agent from code\", \"auth to call agent\", \"streaming responses\", \"VPC\", \"VPC connectivity\", \"VPC error\", \"can't reach from VPC\", \"multi-agent\", \"A2A\", \"A2A auth\", \"orchestrator not delegating\", \"specialist not called\", \"migrate Bedrock Agent\", \"after import\", \"migration issue\", \"framework for migration\", \"change model\", \"browser tool\", \"code interpreter\", \"delete agent\", \"tear down\", \"agentcore remove\", \"cross-account memory\", \"resource-based policy on memory\", \"pay for x402 content\", \"402 Payment Required\", \"microtransactions\", \"paid API or tool\". Not for connecting to external APIs via Gateway — use agents-connect. Not for scaffolding a new project — use agents-get-started. Not for CLI\u002Fdev server errors — use agents-debug. Strands vs LangGraph in a migration context routes here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1272,1275,1278,1279],{"name":1273,"slug":1274,"type":15},"Agents","agents",{"name":1276,"slug":1277,"type":15},"Automation","automation",{"name":23,"slug":8,"type":15},{"name":1280,"slug":1281,"type":15},"Engineering","engineering","2026-07-12T08:42:53.812877",{"slug":1284,"name":1284,"fn":1285,"description":1286,"org":1287,"tags":1288,"stars":24,"repoUrl":25,"updatedAt":1297},"agents-connect","connect agents to external services","Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: \"connect to API\", \"add gateway\", \"connect to MCP server\", \"Lambda tools\", \"OpenAPI\", \"gateway target\", \"Cedar policy\", \"restrict tools\", \"policy engine\", \"gateway auth error\", \"store API key\", \"outbound credential\", \"env var API key\", \"API key None after deploy\", \"credential not available after deploy\", \"should this be a gateway target\", \"give my agent tools\", \"add tools to agent\". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1289,1290,1293,1296],{"name":1273,"slug":1274,"type":15},{"name":1291,"slug":1292,"type":15},"API Development","api-development",{"name":1294,"slug":1295,"type":15},"Authentication","authentication",{"name":23,"slug":8,"type":15},"2026-07-16T06:00:38.866147",{"slug":1299,"name":1299,"fn":1300,"description":1301,"org":1302,"tags":1303,"stars":24,"repoUrl":25,"updatedAt":1312},"agents-debug","debug agent and environment issues","Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes. Also checks prerequisites when the CLI itself isn't working. Triggers on: \"agent not working\", \"wrong answer\", \"agent error\", \"tool call failing\", \"debug agent\", \"check logs\", \"read traces\", \"broken\", \"500 error\", \"424 error\", \"model access denied\", \"command not found\", \"stuck in DELETING\", \"maxVms exceeded\", \"cold start diagnosis\", \"cold start slow\", \"agentcore create error\", \"create failed\", \"exit code 7\", \"connection refused local dev\". Not for deploy failures — use agents-deploy. Not for performance tuning without errors — use agents-optimize. Not for VPC configuration — use agents-build. Not for observability setup or missing logs — use agents-optimize.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1304,1305,1306,1309],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1307,"slug":1308,"type":15},"Debugging","debugging",{"name":1310,"slug":1311,"type":15},"Observability","observability","2026-07-16T06:00:44.679093",{"slug":1314,"name":1314,"fn":1315,"description":1316,"org":1317,"tags":1318,"stars":24,"repoUrl":25,"updatedAt":1327},"agents-deploy","deploy AI agents to AWS","Use when deploying your agent to AWS, or when a deploy has failed. Handles pre-flight validation, CDK\u002FIAM\u002Fquota error diagnosis, version management, rollback, and canary deployments. Triggers on: \"deploy my agent\", \"agentcore deploy\", \"deploy failed\", \"CDK error\", \"rollback\", \"canary deploy\", \"pin version\", \"redeploy\", \"deploy stuck\". Not for production hardening — use agents-harden. Not for adding capabilities before deploy — use agents-build or agents-connect. Not for VPC configuration errors — use agents-build.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1319,1320,1321,1324],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1322,"slug":1323,"type":15},"CI\u002FCD","ci-cd",{"name":1325,"slug":1326,"type":15},"Deployment","deployment","2026-07-12T08:42:55.059577",{"slug":1329,"name":1329,"fn":1330,"description":1331,"org":1332,"tags":1333,"stars":24,"repoUrl":25,"updatedAt":1337},"agents-get-started","scaffold and deploy new agent projects","Use when a developer wants to create a new agent project or get started with AgentCore. Handles framework selection, project scaffolding, first deploy, and first invocation. Triggers on: \"build an agent\", \"create an agent\", \"get started\", \"new project\", \"agentcore create\", \"which framework\", \"Strands vs LangGraph\", \"hello world agent\", \"first agent\", \"create MCP server\", \"host MCP server\", \"agentcore dev\", \"dev server\", \"what port\", \"local development\". Not for adding capabilities to existing projects — use agents-build or agents-connect. Strands vs LangGraph in a migration context routes to agents-build, not here. Connecting to an existing MCP server routes to agents-connect, not here.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1334,1335,1336],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1325,"slug":1326,"type":15},"2026-07-12T08:42:51.963247",{"slug":1339,"name":1339,"fn":1340,"description":1341,"org":1342,"tags":1343,"stars":24,"repoUrl":25,"updatedAt":1351},"agents-harden","harden agents for production","Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle, rate limiting, input validation, and quota guidance. Triggers on: \"production checklist\", \"harden agent\", \"production ready\", \"secure agent\", \"inbound auth\", \"going live\", \"cold start optimization\", \"session lifecycle\", \"StopRuntimeSession\", \"quota\", \"throttling\", \"maxVms\", \"rate limit\", \"security audit of outbound API calls\", \"gateway target audit for production\", \"restrict who can call\", \"lock down endpoint\", \"only our app can call\". Not for Cedar tool-restriction policies — use agents-connect. Not for quality measurement — use agents-optimize. Not for outbound credential storage or API key wiring — use agents-connect. Not for A2A agent-to-agent auth — use agents-build. Cold start observation and diagnosis (not optimization) routes to agents-debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1344,1345,1346,1349],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1347,"slug":1348,"type":15},"Best Practices","best-practices",{"name":276,"slug":1350,"type":15},"security","2026-07-16T06:00:42.174705",{"slug":1353,"name":1353,"fn":1354,"description":1355,"org":1356,"tags":1357,"stars":24,"repoUrl":25,"updatedAt":1367},"agents-optimize","optimize agent quality and performance","Use when measuring or improving agent quality and performance — set up evaluators, online monitoring, CI\u002FCD quality gates, observability, or cost optimization. Triggers on: \"evaluate my agent\", \"add evaluator\", \"measure quality\", \"quality gate\", \"run evals\", \"agent too slow\", \"why is it slow\", \"reduce latency\", \"set up observability\", \"CloudWatch dashboard\", \"how much does my agent cost\", \"cost optimization\", \"logs not showing up\", \"logs missing\", \"spans not found\", \"eval failing\", \"eval error\", \"dev traces\", \"local traces\", \"agentcore dev traces\", \"traces to CloudWatch\". Not for debugging errors or crashes — use agents-debug. Slow but correct routes here; broken routes to debug.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1358,1359,1360,1363,1364],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1361,"slug":1362,"type":15},"Evals","evals",{"name":1310,"slug":1311,"type":15},{"name":1365,"slug":1366,"type":15},"Performance","performance","2026-07-12T08:42:56.488105",114,{"items":1370,"total":1487},[1371,1378,1385,1392,1399,1405,1412,1420,1437,1450,1462,1477],{"slug":1267,"name":1267,"fn":1268,"description":1269,"org":1372,"tags":1373,"stars":24,"repoUrl":25,"updatedAt":1282},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1374,1375,1376,1377],{"name":1273,"slug":1274,"type":15},{"name":1276,"slug":1277,"type":15},{"name":23,"slug":8,"type":15},{"name":1280,"slug":1281,"type":15},{"slug":1284,"name":1284,"fn":1285,"description":1286,"org":1379,"tags":1380,"stars":24,"repoUrl":25,"updatedAt":1297},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1381,1382,1383,1384],{"name":1273,"slug":1274,"type":15},{"name":1291,"slug":1292,"type":15},{"name":1294,"slug":1295,"type":15},{"name":23,"slug":8,"type":15},{"slug":1299,"name":1299,"fn":1300,"description":1301,"org":1386,"tags":1387,"stars":24,"repoUrl":25,"updatedAt":1312},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1388,1389,1390,1391],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1307,"slug":1308,"type":15},{"name":1310,"slug":1311,"type":15},{"slug":1314,"name":1314,"fn":1315,"description":1316,"org":1393,"tags":1394,"stars":24,"repoUrl":25,"updatedAt":1327},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1395,1396,1397,1398],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1322,"slug":1323,"type":15},{"name":1325,"slug":1326,"type":15},{"slug":1329,"name":1329,"fn":1330,"description":1331,"org":1400,"tags":1401,"stars":24,"repoUrl":25,"updatedAt":1337},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1402,1403,1404],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1325,"slug":1326,"type":15},{"slug":1339,"name":1339,"fn":1340,"description":1341,"org":1406,"tags":1407,"stars":24,"repoUrl":25,"updatedAt":1351},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1408,1409,1410,1411],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1347,"slug":1348,"type":15},{"name":276,"slug":1350,"type":15},{"slug":1353,"name":1353,"fn":1354,"description":1355,"org":1413,"tags":1414,"stars":24,"repoUrl":25,"updatedAt":1367},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1415,1416,1417,1418,1419],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1361,"slug":1362,"type":15},{"name":1310,"slug":1311,"type":15},{"name":1365,"slug":1366,"type":15},{"slug":1421,"name":1421,"fn":1422,"description":1423,"org":1424,"tags":1425,"stars":24,"repoUrl":25,"updatedAt":1436},"amazon-aurora-mysql","manage Amazon Aurora MySQL clusters","Amazon Aurora MySQL — creates, modifies, and advises on Aurora MySQL clusters specifically (MySQL-compatible engine, Aurora serverless, parallel query). Trigger for Aurora MySQL cluster operations, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or MySQL upgrade planning. Aurora MySQL uses full (VPC-based) configuration — express configuration is PostgreSQL-only. For Aurora PostgreSQL, use amazon-aurora-postgresql instead. Contains safety guardrails and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1426,1427,1430,1433],{"name":23,"slug":8,"type":15},{"name":1428,"slug":1429,"type":15},"Database","database",{"name":1431,"slug":1432,"type":15},"MySQL","mysql",{"name":1434,"slug":1435,"type":15},"Serverless","serverless","2026-07-12T08:43:13.27939",{"slug":1438,"name":1438,"fn":1439,"description":1440,"org":1441,"tags":1442,"stars":24,"repoUrl":25,"updatedAt":1449},"amazon-aurora-postgresql","configure Amazon Aurora PostgreSQL clusters","Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless, express configuration, pgvector, Babelfish). Trigger for Aurora PostgreSQL cluster operations, express-configuration quick-start, ACU sizing, I\u002FO-Optimized storage, commitment pricing, or PostgreSQL upgrade planning. For Aurora MySQL, use amazon-aurora-mysql instead. Contains safety guardrails, express-first routing, and response templates that override defaults.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1443,1444,1445,1448],{"name":23,"slug":8,"type":15},{"name":1428,"slug":1429,"type":15},{"name":1446,"slug":1447,"type":15},"PostgreSQL","postgresql",{"name":1434,"slug":1435,"type":15},"2026-07-16T06:00:34.789624",{"slug":1451,"name":1451,"fn":1452,"description":1453,"org":1454,"tags":1455,"stars":24,"repoUrl":25,"updatedAt":1461},"amazon-bedrock","build generative AI apps with Amazon Bedrock","Builds generative AI applications on Amazon Bedrock. Covers model invocation (Converse API, InvokeModel), RAG with Knowledge Bases, Bedrock Agents, Guardrails, and AgentCore. Use when invoking models, setting up Knowledge Bases, creating agents, applying guardrails, deploying to AgentCore, migrating\u002Fporting\u002Fconverting a Bedrock Agent (including inline agents) to an AgentCore Harness, troubleshooting Bedrock errors (ThrottlingException, AccessDeniedException), or choosing models (Claude, Llama, Nova, Titan). ALSO USE for prompt caching setup and debugging, quota health checks and throttling diagnosis, cost attribution and tracking, migrating between Claude model generations (4.5 to 4.6 to 4.7), chunking strategies, API selection (Converse vs InvokeModel), guardrail capabilities, and model selection. Also covers AgentCore Payments setup (x402, microtransactions, Payment Manager, Connector, Instrument, Coinbase CDP, Stripe Privy, 402 Payment Required, pay for content, paid endpoint, agent payments). NOT for custom model training, Rekognition, or Comprehend.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1456,1457,1458],{"name":1273,"slug":1274,"type":15},{"name":23,"slug":8,"type":15},{"name":1459,"slug":1460,"type":15},"LLM","llm","2026-07-25T05:30:35.20899",{"slug":1463,"name":1463,"fn":1464,"description":1465,"org":1466,"tags":1467,"stars":24,"repoUrl":25,"updatedAt":1476},"amazon-documentdb","manage Amazon DocumentDB clusters","Manages Amazon DocumentDB end-to-end — serverless-on-8.0 cluster setup, TLS\u002FVPC\u002Fdriver config, flexible-schema and vector-search data modeling, MongoDB compatibility assessment, DMS-based migration, slow-query diagnosis, major version upgrades (4.0→5.0→8.0), Well-Architected reviews (41-check wa_review.py), cost estimation, and security hardening. Retrieve for every DocumentDB question and when the user asks to set up or migrate MongoDB to AWS — DocumentDB is AWS's MongoDB-compatible managed database. Triggers: JSON document store, document database, MongoDB on AWS, Nested fields, Lambda cannot connect, TLS handshake, VPC port 27017, IAM auth, Secrets Manager, encryption at rest, $graphLookup, flexible schema, COLLSCAN, compound index, DMS migration, CDC cutover, $vectorSearch, RAG, Global Clusters, DR replication, cost sizing, audit, health check, production-readiness.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1468,1469,1470,1473],{"name":23,"slug":8,"type":15},{"name":1428,"slug":1429,"type":15},{"name":1471,"slug":1472,"type":15},"MongoDB","mongodb",{"name":1474,"slug":1475,"type":15},"NoSQL","nosql","2026-07-12T08:43:00.455878",{"slug":1478,"name":1478,"fn":1479,"description":1480,"org":1481,"tags":1482,"stars":24,"repoUrl":25,"updatedAt":1486},"amazon-dynamodb","design and debug DynamoDB data layers","Designs, reviews, and debugs DynamoDB data layers from design axioms — enumerates access patterns, chooses partition\u002Fsort keys and GSIs, decides single-table vs. multi-table, configures Streams, Global Tables, TTL, and zero-ETL integrations to OpenSearch\u002FRedshift\u002FSageMaker Lakehouse, and produces a defensible data-layer design with a monthly cost estimate and optional live validation. Applies whenever a user is designing, reviewing, or refactoring anything backed by DynamoDB — schemas, access patterns, GSIs, single- vs. multi-table choices, Streams consumers, transactional outboxes, Global Tables, zero-ETL pipelines — even when they don't say \"axioms\" or \"design review.\" Also applies when debugging hot partitions, throttling, unbounded Scans, LWW conflicts, or surprise bills on DynamoDB workloads.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1483,1484,1485],{"name":23,"slug":8,"type":15},{"name":1428,"slug":1429,"type":15},{"name":1474,"slug":1475,"type":15},"2026-07-16T06:00:37.690386",115]