configuring-vpc-endpoints-for-private-aws-service-access
aws/agent-toolkit-for-aws
Configure VPC endpoints for private AWS service access using AWS PrivateLink
What is configuring-vpc-endpoints-for-private-aws-service-access?
Sets up secure private connectivity to AWS services (S3, DynamoDB, EC2, SSM, Secrets Manager) without internet gateways or public IPs. Use when you need to route traffic privately within your VPC to AWS services while maintaining security and compliance requirements.
- Create and configure gateway endpoints for S3 and DynamoDB
- Create and configure interface endpoints for EC2, SSM, Secrets Manager, and other AWS services
- Manage security group rules for endpoint access
- Configure route tables for gateway endpoint routing
- Enable and verify DNS resolution for private service access
How to install configuring-vpc-endpoints-for-private-aws-service-access
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill configuring-vpc-endpoints-for-private-aws-service-access- Existing VPC with subnets
- AWS credentials configured
- Understanding of security groups and route tables
How to use configuring-vpc-endpoints-for-private-aws-service-access
- 1.Identify which AWS services require private access (S3, DynamoDB, EC2, SSM, etc.)
- 2.Determine endpoint type needed: gateway (S3, DynamoDB) or interface (other services)
- 3.Create the VPC endpoint specifying the VPC and subnets
- 4.Configure security group rules to allow HTTPS traffic (port 443) for interface endpoints
- 5.Update route tables to direct traffic to gateway endpoints
- 6.Enable DNS hostnames and DNS resolution on the VPC
- 7.Verify DNS resolution works for the endpoint service names
- 8.Test connectivity from resources in private subnets
Use cases
- Setting up private connectivity to S3 from EC2 instances without NAT gateways
- Enabling secure access to Secrets Manager from Lambda functions in private subnets
- Configuring DynamoDB endpoints to reduce data transfer costs
- Establishing private SSM Session Manager access for EC2 instances
- Creating interface endpoints for compliance-required private AWS service access
- AWS infrastructure engineers
- DevOps engineers managing VPC security
- Cloud architects designing private network architectures
- Security teams implementing zero-trust networking
configuring-vpc-endpoints-for-private-aws-service-access FAQ
Gateway endpoints are for S3 and DynamoDB, use route tables for traffic routing, and have no additional charges. Interface endpoints use AWS PrivateLink, support many services, require security group configuration, and incur hourly and data processing charges.
No. VPC endpoints enable private connectivity without an internet gateway, NAT device, or public IP addresses. Traffic stays within the AWS network.
Verify that DNS hostnames and DNS resolution are enabled on the VPC, check that the DHCP options set has correct domain name servers, and confirm the endpoint is in the correct subnets.
Verify security group rules allow HTTPS traffic on port 443, confirm route tables are properly configured for gateway endpoints, and check that the service is available in your region.
Yes. By default, VPC endpoints allow all access, but you can attach custom policies to restrict which principals or actions are permitted through the endpoint.
Full instructions (SKILL.md)
Source of truth, from aws/agent-toolkit-for-aws.
name: configuring-vpc-endpoints-for-private-aws-service-access description: Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink. Use when setting up secure private connectivity to S3, DynamoDB, and other AWS services without internet gateway, NAT device, or public IP addresses. Covers endpoint creation, security groups, route tables, and DNS configuration. version: 1
Configuring VPC Endpoints for Private AWS Service Access
Overview
Domain expertise for configuring VPC endpoints to enable private access to AWS services without routing traffic through the internet. Covers both gateway endpoints (S3, DynamoDB) and interface endpoints (EC2, SSM, Secrets Manager, etc.) powered by AWS PrivateLink.
Configure VPC endpoints
To create and configure VPC endpoints for private AWS service access, follow the procedure exactly. See VPC endpoints configuration procedure.
Troubleshooting
Endpoint not available
Check security group rules, subnet configurations, and service availability in the region.
DNS resolution issues
Verify DNS hostnames and DNS resolution are enabled on the VPC and that the DHCP options set has correct domain name servers.
Connection timeouts
Verify security group rules allow HTTPS traffic (port 443) and route tables are properly configured for gateway endpoints.
Policy restrictions
Review endpoint policies — default policies allow all access, but custom policies may be restrictive.
Related skills
More from aws/agent-toolkit-for-aws and the wider catalog.
connecting-lambda-to-api-gateway
Connect AWS Lambda functions to API Gateway with CORS, security, and deployment automation.
connecting-lambda-to-dynamodb
Connect AWS Lambda to DynamoDB with IAM roles, streams, and event source mapping.
connecting-to-data-source
Create and test AWS Glue connections to JDBC databases, Redshift, Snowflake, and BigQuery.
connecting-vpcs-with-peering
Establishes VPC peering connections between two VPCs for direct private network connectivity. Always use this skill when creating or managing VPC peering — it validates CIDR overlap, updates all route tables in both VPCs, configures DNS resolution, and provides security group guidance that are critical for correct connectivity.
creating-amazon-aurora-db-cluster-with-instances
Creates a complete Amazon Aurora database cluster with instances, handling cluster creation, instance provisioning, and Secrets Manager password management in the proper sequence. Use when setting up new Aurora MySQL or PostgreSQL clusters with production-ready configuration.
creating-api-gateway-stage
Create fully configured API Gateway stages with logging, tracing, throttling, and security controls.