configuring-vpc-endpoints-for-private-aws-service-access

Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink. Use when setting up secure private connectivity to S3, DynamoDB, and other AWS services without internet gateway, NAT device, or public IP addresses. Covers endpoint creation, security groups, route tables, and DNS configuration.

Quality

86%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

72%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean and well-structured with clean progressive disclosure to a real reference file, but it delegates the entire configuration procedure out of the body and provides no validation checkpoints, leaving the core workflow only partially actionable in-body.

Suggestions

Inline a minimal numbered configuration sequence (e.g., create endpoint → attach security group → update route table → verify) so the body is actionable without requiring the reference for the common case.

Add an explicit validation/verification checkpoint after configuration (e.g., 'Verify the endpoint is Available and DNS resolves to the private IP') to support a validate→fix→retry feedback loop.

For each troubleshooting symptom, add one concrete AWS CLI command or check (e.g., `aws ec2 describe-vpc-endpoints`) instead of only descriptive hints.

Dimension	Reasoning	Score
Conciseness	The ~30-line body is lean and efficient with no concept padding that Claude already knows; the Overview adds the gateway/interface service categorization and every section earns its tokens, matching the score-5 anchor.	5 / 5
Actionability	The core configuration task is delegated entirely ('follow the procedure exactly. See [reference]') with no in-body steps, while troubleshooting offers some concrete checks (port 443, DHCP options set, security groups); this sits between the high-level-hints (2) and incomplete-concrete-guidance (3) anchors, landing at 3.	3 / 5
Workflow Clarity	A rough structure exists (Configure then symptom-based Troubleshooting) but the body lists no explicit multi-step sequence and has no validation checkpoints, matching the score-3 anchor rather than the clearer-sequence anchor at 4.	3 / 5
Progressive Disclosure	A concise overview points to a single clearly-signaled, one-level-deep reference (references/configure-vpc-endpoints-for-private-aws-service-access.md, verified to exist) with well-organized sections, matching the score-5 anchor.	5 / 5
	Total	16 / 20 Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: it states concrete capabilities, provides an explicit 'Use when' trigger clause with natural keywords, and carves out a distinct niche with minimal conflict risk. No changes needed.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — 'Configures VPC endpoints (interface and gateway)', 'Covers endpoint creation, security groups, route tables, and DNS configuration' — with comprehensive coverage of the domain, matching the score-5 anchor rather than the minor-gaps anchor at 4.	5 / 5
Completeness	Explicitly answers 'what' (configures interface/gateway endpoints, covers creation, security groups, route tables, DNS) and 'when' via an explicit 'Use when setting up secure private connectivity to S3, DynamoDB...' clause with concrete triggers, matching the score-5 anchor.	5 / 5
Trigger Term Quality	Includes natural terms users say when needing private AWS connectivity — 'S3, DynamoDB', 'internet gateway', 'NAT device', 'public IP addresses', 'AWS PrivateLink' — comprehensive coverage with synonyms, fitting the score-5 anchor.	5 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (VPC endpoints / AWS PrivateLink for private service access) with distinct triggers and minimal overlap risk with other skills, matching the score-5 anchor.	5 / 5
	Total	20 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: aws/agent-toolkit-for-aws
Path: skills/specialized-skills/networking-and-content-delivery-skills/configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md
Commit: d6ad2e4

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.