sitetositevpn

SKILL.md

AWS Site-to-Site VPN

Overview

Domain expertise for configuring AWS Site-to-Site VPN, the managed service that builds an encrypted
IP Security (IPsec) connection between an on-premises network and AWS. Covers the routing decision
(static versus dynamic (BGP) routing), creating the connection and its dependent resources in the right order,
sizing tunnel bandwidth, consolidating many sites through a VPN Concentrator, applying the customer
gateway device configuration, building for high availability, and monitoring and troubleshooting
tunnels.

This skill is a router. Each customer task maps to a procedure file under references/. Read the
matching reference in full before acting, then follow its constraints and steps. The reference
files are self-contained: each carries its own decision tables, constraints, procedure, and
troubleshooting.

Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging,
observability). Fall back to the AWS CLI otherwise. Site-to-Site VPN is a regional service: pass
--region {region} matching the VPC or transit gateway the connection terminates on.