CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

configuring-vpc-endpoints-for-private-aws-service-access

Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink. Use when setting up secure private connectivity to S3, DynamoDB, and other AWS services without internet gateway, NAT device, or public IP addresses. Covers endpoint creation, security groups, route tables, and DNS configuration.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is configuring-vpc-endpoints-for-private-aws-service-access in aws/agent-toolkit-for-aws

SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured overview body that correctly delegates the 12-step procedure to a single real, one-level-deep reference file — excellent progressive disclosure. The weaknesses are in the body itself: it offers no executable commands or step/checkpoint summary inline for the primary task, and its four troubleshooting subsections duplicate the reference file's own troubleshooting section nearly verbatim.

Suggestions

Add a minimal inline quick reference to the 'Configure VPC endpoints' section — e.g., the one or two most common AWS CLI commands (such as creating an S3 gateway endpoint) — so the body itself provides executable guidance before the reference is loaded.

Surface the procedure's validation checkpoints in the body (e.g., 'Verify endpoint state is Available and test connectivity before reporting success') so the workflow's key checkpoints are visible at the top level rather than only implicit in the referenced file.

Keep troubleshooting in only one place: the body's four troubleshooting subsections duplicate the reference file's Troubleshooting section almost verbatim, so removing one copy avoids content drift and saves tokens.

DimensionReasoningScore

Conciseness

The body is lean — the Overview is two sentences, there is no padding or explanation of concepts Claude already knows, and the main section is a two-line pointer. However, the entire Troubleshooting section ('Check security group rules, subnet configurations, and service availability...', 'Verify DNS hostnames and DNS resolution are enabled...') duplicates the reference file's own Troubleshooting section nearly verbatim, so a block of tokens could be trimmed — 'efficient; minor instances that could be trimmed' rather than 'every token earns its place'.

4 / 5

Actionability

The troubleshooting entries give specific, checkable guidance ('HTTPS traffic (port 443)', 'DHCP options set has correct domain name servers', 'route tables... for gateway endpoints'), but the body contains no executable commands or examples for the primary task — 'To create and configure VPC endpoints... follow the procedure exactly' delegates all executable detail to the reference. This fits 'some concrete guidance but incomplete; missing key details', not the score-4 anchor which requires concrete code or commands in the body.

3 / 5

Workflow Clarity

The body issues a single unambiguous directive ('follow the procedure exactly') and provides symptom-indexed recovery guidance, but the actual sequence and its validation checkpoints (verify endpoint status, test connectivity) live entirely in the referenced file and are only implicit in the body. That matches 'sequence present but checkpoints missing or implicit'; the score-4 anchor ('clear sequence with most checkpoints present') is not met by the body alone.

3 / 5

Progressive Disclosure

Textbook progressive disclosure: a concise overview, one clearly signaled one-level-deep reference ('See [VPC endpoints configuration procedure](references/configure-vpc-endpoints-for-private-aws-service-access.md)') that actually exists in the bundle and contains no nested references, and a short symptom-organized troubleshooting section appropriately kept inline. Content is correctly split between the 30-line body and the 229-line procedure file, and navigation is easy.

5 / 5

Total

15

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: third-person, concrete, and explicit about both capabilities and use triggers, with natural vocabulary like PrivateLink, NAT, and internet gateway. The only gap is that 'other AWS services' leaves common interface-endpoint service names (EC2, SSM, Secrets Manager) unstated, which keeps trigger-term coverage just short of comprehensive.

DimensionReasoningScore

Specificity

Names multiple concrete, comprehensive actions in third person: 'Configures VPC endpoints (interface and gateway)... using AWS PrivateLink', 'endpoint creation, security groups, route tables, and DNS configuration'. This covers the domain's main configuration surfaces, matching the comprehensive-action anchor rather than the score-4 anchor ('several specific actions; minor gaps').

5 / 5

Completeness

Explicitly answers both what ('Configures VPC endpoints (interface and gateway) for private AWS service access using AWS PrivateLink... Covers endpoint creation, security groups, route tables, and DNS configuration') and when ('Use when setting up secure private connectivity to S3, DynamoDB, and other AWS services without internet gateway, NAT device, or public IP addresses') with concrete trigger phrases — a direct match for the top anchor.

5 / 5

Trigger Term Quality

Good natural vocabulary users would actually say: 'VPC endpoints', 'AWS PrivateLink', 'S3', 'DynamoDB', 'internet gateway', 'NAT device', 'public IP addresses'. A few natural terms are missing — common interface-endpoint service names (EC2, SSM, Secrets Manager) are collapsed into the generic 'other AWS services', and 'endpoint policy' is absent — so it fits 'good keyword coverage; a few natural terms missing' rather than the comprehensive synonym coverage of the score-5 anchor.

4 / 5

Distinctiveness Conflict Risk

Clear niche — VPC endpoints/PrivateLink for private AWS service access — with distinct trigger vocabulary (PrivateLink, NAT, internet gateway) that no generic networking or unrelated skill would share. Minimal conflict risk, matching the 'clear niche with distinct triggers' anchor.

5 / 5

Total

19

/

20

Passed

Validation

81%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

metadata_version

'metadata.version' is missing

Warning

metadata_field

'metadata' should map string keys to string values

Warning

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

13

/

16

Passed

Repository

mreferre/aws-agent-toolkit-skills

Path

.kiro/skills/configuring-vpc-endpoints-for-private-aws-service-access/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.