Aws Networking

Name: Aws Networking
Author: ArieGoldkin

ASecurity

AWS networking architecture with VPC, Transit Gateway, and PrivateLink using Terraform. Covers multi-AZ VPC design, CIDR planning, Transit Gateway hub-and-spoke topology, VPC peering, PrivateLink for service exposure, VPC endpoints (Gateway and Interface), security groups, NACLs, and hybrid connectivity patterns.

6 stars
0 votes
0 copies
2 views
Added September 6, 2026

ai-agentsawsterraformapisecurity

Works with

Security analysis

A100/100

Pro scans all 7 files and shows the line behind each finding

Scanned September 6, 2026

npx -y skills add ArieGoldkin/claude-forge --skill aws-networking --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Aws Networking?

Add the live security badge to your README. It updates with every re-scan.

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/ariegoldkin-aws-networking/badge)](https://www.skillsdirectory.com/skills/ariegoldkin-aws-networking)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: aws-networking
description: >
  AWS networking architecture with VPC, Transit Gateway, and PrivateLink using Terraform.
  Covers multi-AZ VPC design, CIDR planning, Transit Gateway hub-and-spoke topology,
  VPC peering, PrivateLink for service exposure, VPC endpoints (Gateway and Interface),
  security groups, NACLs, and hybrid connectivity patterns.
effort: low
paths:
  - "terraform/**"
  - "*.tf"
  - "infra/**"
---

# AWS Networking

Terraform patterns for production AWS network architecture.

## Required Interface Endpoints

Platform services require these VPC interface endpoints:

```hcl
locals {
  interface_endpoints = [
    "secretsmanager",
    "ssm",
    "ssmmessages",
    "ec2messages",
    "logs",
    "ecr.api",
    "ecr.dkr",
    "ecs",
    "ecs-agent",
    "ecs-telemetry"
  ]
}
```

## NAT Gateway Environment Strategy

Per-AZ NAT in prod for HA; single NAT in non-prod to reduce cost:

```hcl
resource "aws_nat_gateway" "single" {
  count         = var.environment == "prod" ? length(local.azs) : 1
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}
```

## Templates

| Template | Purpose |
|----------|---------|
| `${CLAUDE_SKILL_DIR}/templates/vpc-multi-az.tf` | Production VPC layout |
| `${CLAUDE_SKILL_DIR}/templates/transit-gateway.tf` | TGW with attachments |
| `${CLAUDE_SKILL_DIR}/templates/vpc-endpoints.tf` | Common endpoint patterns |
| `${CLAUDE_SKILL_DIR}/templates/privatelink-service.tf` | Expose service via PrivateLink |

## References

- `${CLAUDE_SKILL_DIR}/references/transit-gateway-patterns.md` - TGW architectures
- `${CLAUDE_SKILL_DIR}/references/cost-optimization-networking.md` - Reduce data transfer costs