---
name: "aws-vpc-multi-az-subnets"
description: "Design high-availability VPC networks with public/private/database subnets and routing tables."
metadata:
  author: "Terraform AWS Modules"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "design aws multi az vpc"
  - "configure single nat gateway vpc"
  - "setup s3 vpc gateway endpoint"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# AWS Multi-AZ VPC Architecture & NAT Gateway Topologies

Architects AWS VPCs: multi-AZ subnet layout, routing through Internet Gateways and single vs multi-AZ NAT Gateways, VPC endpoints (S3, DynamoDB Gateway endpoints), and Network Access Control Lists (NACLs).

## When to Invoke
Invoke this skill whenever you need to:
- design aws multi az vpc
- configure single nat gateway vpc
- setup s3 vpc gateway endpoint

## Execution SOP & Rules
1. Allocate non-overlapping CIDR blocks: public (10.0.1.0/24, etc.), private (10.0.10.0/24), db (10.0.20.0/24).
2. Associate route tables: public subnets -> IGW; private subnets -> NAT Gateway; db subnets -> local only.
3. Create S3 Gateway Endpoint: aws ec2 create-vpc-endpoint --vpc-id <id> --service-name com.amazonaws.<region>.s3.
4. Enable VPC Flow Logs targeting CloudWatch Logs or S3 for network traffic security auditing.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.