sitetositevpn

Configures AWS Site-to-Site VPN: creating an IPsec VPN connection between an on-premises network and a VPC, choosing the target gateway (virtual private gateway, transit gateway, or AWS Cloud WAN), choosing static or dynamic (BGP) routing, sizing tunnel bandwidth (Standard 1.25 Gbps or Large 5 Gbps), connecting many sites through a VPN Concentrator, applying the customer gateway device configuration, making a connection highly available, and monitoring tunnels with CloudWatch. Applicable when the user wants to connect a data center or branch office to AWS over an encrypted tunnel, choose how routes are exchanged, scale throughput, consolidate sites, or diagnose a down tunnel. Routes to the right per-task procedure in references. Not for AWS Direct Connect (its own service), Client VPN for individual remote users, the transit gateway side of a VPN attachment (transitgateway skill), or Route 53 DNS work.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured router skill: concise, clearly navigated, with verified reference files and useful cross-cutting routing notes. The body leans on references for executable detail and validation, which is appropriate for a router but leaves the body's own actionability and validation slightly thinner.

Suggestions

Add a short, explicit validation/checklist note in the body (e.g. 'confirm tunnel state is UP and BGP peers established before handing off') so the workflow carries a checkpoint even before the reader opens a reference.

Include one or two representative AWS CLI/MCP command snippets inline (e.g. describe-vpn-connections to check tunnel status) to raise the body's own actionability without duplicating the references.

Name the BGP/asymmetric routing and key-rotation caveats in the routing notes so common pitfalls are surfaced at the overview level.

Dimension	Reasoning	Score
Conciseness	Lean router/overview with no padding: it avoids explaining what IPsec or a VPN is and limits prose to genuinely useful cross-cutting context (gateway gating, bandwidth-vs-concentrator tradeoff), so every token earns its place.	5 / 5
Actionability	Gives concrete execution guidance (use the AWS MCP server, fall back to the AWS CLI, pass `--region {region}`) and a task-to-reference routing table, but the body itself delegates most executable steps to the reference files rather than carrying copy-paste commands.	4 / 5
Workflow Clarity	A clear sequence is present (read the matching reference in full, follow its constraints, execute via MCP/CLI with the right region) with an unambiguous routing table, but explicit validation checkpoints live in the references rather than the body, leaving a minor gap.	4 / 5
Progressive Disclosure	A clear overview with well-signaled, one-level-deep references — all seven linked files verified to exist — with content appropriately split and easy navigation via the goal-to-reference table.	5 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete capabilities, gives explicit trigger guidance, and draws clear boundaries against neighboring skills. The only gap is slightly thinner synonym/extension coverage in the trigger terms.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions with specifics — creating an IPsec VPN connection, choosing the target gateway (virtual private gateway, transit gateway, or AWS Cloud WAN), choosing static or dynamic (BGP) routing, sizing bandwidth (Standard 1.25 Gbps or Large 5 Gbps), applying the customer gateway device configuration, and monitoring with CloudWatch — giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both what it does (the full capability list) and when to use it via the concrete 'Applicable when the user wants to connect a data center or branch office... choose how routes are exchanged, scale throughput, consolidate sites, or diagnose a down tunnel' clause.	5 / 5
Trigger Term Quality	Includes natural phrases users would say ('connect a data center or branch office to AWS over an encrypted tunnel', 'choose how routes are exchanged', 'scale throughput', 'consolidate sites', 'diagnose a down tunnel'), but is light on synonyms and service-name variations beyond 'Site-to-Site VPN'.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (AWS Site-to-Site VPN) and explicitly fences off adjacent work — 'Not for AWS Direct Connect (its own service), Client VPN for individual remote users, the transit gateway side of a VPN attachment (transitgateway skill), or Route 53 DNS work' — minimizing conflict risk.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: aws/agent-toolkit-for-aws
Path: skills/specialized-skills/networking-and-content-delivery-skills/sitetositevpn/SKILL.md
Commit: d6ad2e4

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.