connecting-vpcs-with-peering
aws/agent-toolkit-for-aws
Establish VPC peering connections with automatic route table and DNS configuration for both VPCs.
What is connecting-vpcs-with-peering?
Sets up private network connectivity between two VPCs using peering, handling CIDR validation, route table updates, DNS resolution, and security group guidance. Use this when creating or managing VPC peering across same-region, cross-region, or cross-account scenarios.
- Validates CIDR overlap between VPCs to prevent conflicts
- Creates and accepts VPC peering connections
- Updates all route tables in both VPCs automatically
- Configures DNS resolution for cross-VPC communication
- Provides security group guidance for cross-VPC traffic
- Supports same-region, cross-region, and cross-account peering
How to install connecting-vpcs-with-peering
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill connecting-vpcs-with-peering- AWS credentials configured with permissions to create VPC peering connections and modify route tables
- VPC IDs for both the requester and accepter VPCs
- For cross-account peering: access to both AWS accounts
How to use connecting-vpcs-with-peering
- 1.Gather the VPC IDs for both VPCs you want to connect
- 2.Verify that CIDR blocks do not overlap between the two VPCs
- 3.Run the skill with both VPC IDs as parameters
- 4.For cross-account peering, manually accept the connection from the accepter account if auto-accept is not enabled
- 5.Verify DNS resolution is enabled in both VPC settings
- 6.Test connectivity between instances in the peered VPCs using ping or similar tools
Use cases
- Connecting microservices in separate VPCs for direct private communication
- Establishing cross-account network connectivity for multi-tenant architectures
- Linking VPCs across regions while maintaining private connectivity
- Integrating legacy and new VPC environments without internet exposure
- Setting up hub-and-spoke network topologies between VPCs
- AWS network architects
- DevOps engineers managing multi-VPC deployments
- Cloud infrastructure teams
- Solutions architects designing VPC connectivity
connecting-vpcs-with-peering FAQ
CIDR overlap occurs when two VPCs have overlapping IP address ranges. This prevents peering because the routing tables cannot determine which VPC to send traffic to. The skill validates this before creating the connection.
Yes, the skill supports cross-region peering. Routes must be added in both regions and security groups must allow traffic from the peer VPC's CIDR blocks.
Cross-account connections require manual acceptance from the accepter account. Same-account connections with auto-accept enabled should transition automatically. Check account permissions if stuck.
The skill provides security group guidance, but you may need to manually adjust inbound rules to allow traffic from the peer VPC's CIDR blocks depending on your security requirements.
Route creation typically fails if a route with the same destination CIDR already exists. You must replace the existing route instead of creating a new one.
Full instructions (SKILL.md)
Source of truth, from aws/agent-toolkit-for-aws.
name: connecting-vpcs-with-peering description: Establishes VPC peering connections between two VPCs for direct private network connectivity. Always use this skill when creating or managing VPC peering — it validates CIDR overlap, updates all route tables in both VPCs, configures DNS resolution, and provides security group guidance that are critical for correct connectivity. version: 1
Connecting VPCs with Peering
Overview
Domain expertise for establishing private network connectivity between two VPCs using VPC peering. Covers the full lifecycle: creating the peering connection, accepting it, updating route tables in both VPCs, configuring DNS resolution, and adjusting security groups for cross-VPC traffic. Supports same-region, cross-region, and cross-account peering scenarios.
Create a VPC peering connection
To establish a VPC peering connection between two VPCs, follow the procedure exactly. See VPC peering connection procedure.
The procedure requires the requester and accepter VPC IDs at minimum. It validates both VPCs exist, checks for CIDR overlap, creates and accepts the peering, updates all route tables, and configures DNS resolution.
Troubleshooting
Peering stuck in pending state
Cross-account connections require manual acceptance from the accepter account. Same-account connections with auto_accept: true should transition automatically.
Route creation fails
Check for existing routes with the same destination CIDR. Replace existing routes instead of creating new ones.
DNS resolution not working
Both VPCs must have DNS resolution and DNS hostnames enabled in their VPC settings, not just the peering connection options.
Cross-region connectivity issues
Verify routes are added in both regions and security groups allow traffic from the peer VPC's CIDR blocks.
Related skills
More from aws/agent-toolkit-for-aws and the wider catalog.
coordinating-multi-space-devops-agent
Agent skill from aws/agent-toolkit-for-aws.
creating-amazon-aurora-db-cluster-with-instances
Create production-ready Amazon Aurora database clusters with instances and managed passwords.
creating-api-gateway-stage
Create fully configured API Gateway stages with logging, tracing, throttling, and security controls.
creating-data-lake-table
Create managed Iceberg tables on Amazon S3 with automatic compaction and snapshot management.
creating-ec2-image-builder-pipeline
Automate custom AMI creation with EC2 Image Builder pipelines, IAM roles, and cross-region distribution.
creating-production-vpc-multi-az
Create production-ready multi-AZ VPCs with public/private subnets, NAT gateways, and security groups.