AI agent skill · by @automateyournetwork

Aws Network Ops

AWS cloud networking — VPC, Transit Gateway, Cloud WAN, VPN, Network Firewall, ENI, flow logs. Use when auditing AWS VPCs, troubleshooting connectivity between EC2 instances, checking Transit Gateway routes, or investigating VPN tunnel status.

Archived 2026-10-23 · Source updated 2026-10-11 · License: Apache-2.0. Check the original repository for the latest version.

SKILL.md instructions

# AWS Network Operations

## MCP Server

- **Command**: `uvx awslabs.aws-network-mcp-server@latest` (stdio transport)
- **Requires**: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION` (or `AWS_PROFILE`)
- **Read-only**: All operations are Describe/Get/List — no create/modify/delete

## Available Tools (27)

### General (3)

| Tool | What It Does |
|------|-------------|
| `get_path_trace_methodology` | Guidance for tracing network paths across AWS resources |
| `find_ip_address` | Find which VPC/subnet/ENI an IP address belongs to |
| `get_eni_details` | Get Elastic Network Interface details — security groups, subnet, routes |

### VPC (3)

| Tool | What It Does |
|------|-------------|
| `list_vpcs` | List all VPCs in the account/region |
| `get_vpc_network_details` | Full VPC details — subnets, route tables, IGW, NAT GW, endpoints, NACLs |
| `get_vpc_flow_logs` | Query VPC flow logs for traffic analysis |

### Transit Gateway (7)

| Tool | What It Does |
|------|-------------|
| `list_transit_gateways` | List all Transit Gateways |
| `get_tgw_details` | Transit Gateway details — attachments, route tables, associations |
| `get_tgw_routes` | Get routes from a specific TGW route table |
| `get_all_tgw_routes` | Get routes from all TGW route tables |
| `get_tgw_flow_logs` | Query Transit Gateway flow logs |
| `list_tgw_peerings` | List TGW peering connections |
| `detect_tgw_inspection` | Detect if traffic inspection is configured on a TGW |

### Cloud WAN (10)

| Tool | What It Does |
|------|-------------|
| `list_core_networks` | List all Cloud WAN core networks |
| `get_cloudwan_details` | Core network details — segments, policies, attachments |
| `get_cloudwan_routes` | Get routes from a Cloud WAN segment |
| `get_all_cloudwan_routes` | Get routes from all Cloud WAN segments |
| `get_cloudwan_attachment_details` | Details for a specific Cloud WAN attachment |
| `detect_cloudwan_inspection` | Detect inspection configuration on Cloud WAN |
| `list_cloudwan_peerings` | List Cloud WAN peering connections |
| `get_cloudwan_peering_details` | Details for a specific Cloud WAN peering |
| `get_cloudwan_logs` | Query Cloud WAN logs |
| `simulate_cloud_wan_route_change` | Simulate a route change and predict impact |

### VPN (1)

| Tool | What It Does |
|------|-------------|
| `list_vpn_connections` | List all site-to-site VPN connections with tunnel status |

### Network Firewall (3)

| Tool | What It Does |
|------|-------------|
| `list_network_firewalls` | List all AWS Network Firewalls |
| `get_firewall_rules` | Get firewall rule groups and policies |
| `get_network_firewall_flow_logs` | Query Network Firewall flow logs |

## Workflow: VPC Network Audit

When a user asks "show me our AWS network" or "audit the VPCs":

1. **List VPCs**: `list_vpcs` to see all VPCs in the region
2. **For each VPC**: `get_vpc_network_details` — subnets, route tables, gateways, NACLs
3. **Check TGW**: `list_transit_gateways` to see cross-VPC connectivity
4. **Check VPN**: `list_vpn_connections` for hybrid connectivity
5. **Check firewalls**: `list_network_firewalls` for security posture
6. **Report**: Formatted summary of the cloud network architecture

## Workflow: Troubleshoot Connectivity

When a user asks "why can't EC2 instance X reach Y?":

1. **Find the IPs**: `find_ip_address` for both source and destination
2. **Get ENI details**: `get_eni_details` to check security groups, subnet, routes
3. **Check route tables**: `get_vpc_network_details` to see routing
4. **Check flow logs**: `get_vpc_flow_logs` to see if traffic is being dropped
5. **Check firewalls**: `get_firewall_rules` if traffic crosses a Network Firewall
6. **Check TGW**: `get_tgw_routes` if traffic crosses Transit Gateway
7. **Report**: Root cause analysis with fix recommendation

## Workflow: Transit Gateway Health

When checking multi-VPC connectivity:

1. **List TGWs**: `list_transit_gateways`
2. **Get details**: `get_tgw_details` for attachments and route tables
3. **Check routes**: `get_all_tgw_routes` for route table completeness
4. **Check peerings**: `list_tgw_peerings` for cross-region/cross-account
5. **Check inspection**: `detect_tgw_inspection` for security posture
6. **Flow logs**: `get_tgw_flow_logs` for traffic analysis

## Workflow: VPN Tunnel Monitoring

When checking hybrid connectivity:

1. **List VPNs**: `list_vpn_connections`
2. **Check tunnel status**: Up/Down for each tunnel (redundancy check)
3. **Check routes**: TGW or VGW routes for the VPN prefixes
4. **Flow logs**: VPC flow logs for traffic across VPN
5. **Report**: VPN health summary with any down tunnels flagged

## Important Rules

- **Read-only** — this MCP cannot create, modify, or delete any AWS resources
- **Region-specific** — results are scoped to the configured AWS_REGION
- **IAM permissions required** — EC2 Describe, Network Manager, Network Firewall Describe, CloudWatch Logs
- **Record in GAIT** — log all AWS network investigations for audit trail

## Environment Variables

- `AWS_ACCESS_KEY_ID` — AWS access key
- `AWS_SECRET_ACCESS_KEY` — AWS secret key
- `AWS_REGION` — AWS region (e.g., us-east-1)
- Or `AWS_PROFILE` — Named AWS CLI profile

## Failure Behavior

- On a tool error (timeout, unreachable host, malformed response), report the failure and its error message directly to the user rather than fabricating or guessing at results.
- For a confirmed read-only call, check connectivity and retry once if appropriate. For any call that changes state or sends a message, a timeout does not prove the action failed: inspect current state or delivery status before retrying, preserve the required approval/change gates, and do not repeat an action whose outcome is unknown.