The Complete Production SOP: How to Deploy and Run AWS Multi-AZ VPC Architecture & NAT Gateway Topologies in Autonomous AI Agents
Production SOP to deploy AWS Multi-AZ VPC Architecture with public, private, and DB subnets in Claude Code, Codex, and Cursor. Fix routing and NAT loops.
Technical Overview & Architectural Context
Autonomous coding agents frequently generate brittle or non-compliant cloud networking code when left to unconstrained prompting. Common hallucinations in infrastructure-as-code include allocating overlapping CIDR blocks across availability zones, accidentally provisioning database subnets with direct routes to an Internet Gateway (IGW), placing NAT Gateways inside private subnets (creating an unroutable black hole), and failing to provision S3 Gateway Endpoints, which causes high-bandwidth object storage traffic to traverse expensive NAT data transfer paths. The 'aws-vpc-multi-az-subnets' skill solves these failure modes by enforcing deterministic procedural boundaries directly in the agent's context window. It restricts the agent to a three-tier subnet topology (public, application private, and isolated database) spanning at least two Availability Zones, establishes deterministic routing table associations, configures zero-cost S3/DynamoDB gateway endpoints, and mandatorily integrates VPC Flow Logs targeting CloudWatch Logs or S3 for continuous network auditability. By codifying these architectural constraints into a machine-readable SKILL.md specification, coding assistants like Codex, Claude Code, Cursor, and Windsurf can validate CIDR bitmasks and routing tables before writing Terraform, OpenTofu, or AWS CDK artifacts, entirely preventing costly AWS architecture rework and security regressions.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules.
Agent runtimes such as Claude Code, Cursor, and Windsurf parse skills located in workspace-relative or user-level configuration directories. Mount the skill file to ensure the agent parses frontmatter triggers like 'design aws multi az vpc' during context initialization.
mkdir -p ~/.agents/skills/aws-vpc-multi-az-subnets && curl -fsSL https://askills.dev/api/skills/aws-vpc-multi-az-subnets/raw -o ~/.agents/skills/aws-vpc-multi-az-subnets/SKILL.md---
name: "aws-vpc-multi-az-subnets"
description: "Design high-availability VPC networks with public/private/database subnets and routing tables."
metadata:
author: "Terraform AWS Modules"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "design aws multi az vpc"
- "configure single nat gateway vpc"
- "setup s3 vpc gateway endpoint"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---
# AWS Multi-AZ VPC Architecture & NAT Gateway Topologies
Architects AWS VPCs: multi-AZ subnet layout, routing through Internet Gateways and single vs multi-AZ NAT Gateways, VPC endpoints (S3, DynamoDB Gateway endpoints), and Network Access Control Lists (NACLs).Symlink this directory into your project's .claude/skills or .cursor/rules folder to maintain a single source of truth across multiple IDE runtimes.
Ensure directory permissions match current user privileges (chmod 755); otherwise, agent sandboxes running in rootless container environments will silently ignore the skill file.
Environment Secrets & Dependency Validation
Inject required environment variables safely without leaking secrets into conversation history.
The skill runs without shell execution or raw network access within the agent prompt context. AWS credentials must be provided via external environment variables or AWS profiles, and tooling like tfsec or trivy must be available for subsequent linting gates.
test -n "$AWS_REGION" || export AWS_REGION="us-east-1" && which terraform || which tofuNever put AWS_ACCESS_KEY_ID or AWS_SECRET_ACCESS_KEY inside SKILL.md or project-level prompts. Rely on short-lived AWS IAM Identity Center (SSO) credentials.
Placing credential tokens in .env.local without adding it to .gitignore risks accidental commit if the agent generates git automation scripts.
Intent Matching & Trigger Invocation
Verify deterministic activation using tested natural language prompts.
Instruct the agent using the exact trigger phrases defined in the skill manifest. The runtime agent's semantic router matches triggers to 'aws-vpc-multi-az-subnets' and applies the deterministic routing and CIDR rules.
claude "design aws multi az vpc with 10.0.0.0/16 in us-east-1 with public, private, and database tiers plus s3 gateway endpoint"Use concise verbs matching the frontmatter triggers such as 'design aws multi az vpc' or 'configure single nat gateway vpc' to achieve 100% activation accuracy.
Avoid ambiguous prompts like 'make a cloud network' which may trigger generic cloud templates instead of this hardened multi-AZ specification.
Verification, Linting & Output Quality Gate
Execute automated self-healing checks before accepting agent deliverables.
Run Terraform or OpenTofu formatting and static analysis to verify the generated infrastructure-as-code files adhere strictly to the non-overlapping CIDR and routing association requirements.
terraform fmt -check && terraform validate && tflint --init && tflintFeed any validation error output directly back into the agent context; the skill instructions allow the agent to self-correct route table associations immediately.
Running terraform validate does not check CIDR boundary overlaps. Always run a dry-run plan (terraform plan) against an isolated test account or sandbox before merging.
Real-World Scenario: Production-Ready 3-AZ VPC Setup with Single NAT Gateway and Isolated RDS Tier
“Using skill aws-vpc-multi-az-subnets, design aws multi az vpc in us-west-2 using CIDR 10.50.0.0/16. I need 3 public subnets, 3 private app subnets, and 3 fully isolated database subnets. Configure a single NAT gateway to optimize dev costs, setup s3 vpc gateway endpoint for private subnets, and output valid main.tf with VPC Flow Logs enabled.”
Runtime Troubleshooting & Failure Modes
Root Cause: The agent attempted to append an explicit 0.0.0.0/0 route to a default main route table that already contains a conflicting route, or declared duplicate aws_route blocks instead of declaring inline routes in aws_route_table.
Remove conflicting aws_route resources and isolate custom route table definitions: terraform state rm aws_route.internet_access && terraform planRoot Cause: Cross-referencing subnet IDs from a different VPC or relying on implicit dependency ordering before subnet resources have completed creation in the Terraform DAG.
Enforce explicit resource references (e.g., subnet_id = aws_subnet.public[0].id) rather than hardcoded string parameters or unresolvable dynamic lookups.Frequently Asked Questions (AWS Multi-AZ VPC Architecture & NAT Gateway Topologies SOP)
Q:Can I use AWS Multi-AZ VPC Architecture & NAT Gateway Topologies across Codex, Claude Code, and Cursor simultaneously?
Yes. The SKILL.md specification is runtime-agnostic. You can mount the skill directory globally or symlink it into .claude/skills, .cursor/rules, or .windsurfrules to achieve uniform network design behavior across all agent platforms.
Q:How does AWS Multi-AZ VPC Architecture & NAT Gateway Topologies prevent context window overflow during long agent sessions?
The skill provides compact, procedural CIDR allocation patterns and strictly scoped routing rules rather than injecting hundreds of lines of generic cloud documentation. This reduces prompt overhead by up to 70% per generation cycle.
Q:Does this skill require escalated root or container permissions?
No. The skill is audited with a security score of 98/100. It requires read access to files, write access restricted to the local workspace, and completely disables shell execution and external network access inside the skill runtime itself.
Ready to equip your autonomous agent with AWS Multi-AZ VPC Architecture & NAT Gateway Topologies?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.