aws-networking

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

AWS Networking

AWS 网络服务

Overview

概述

Routes networking requests to the correct service-specific skill. Covers 8 services across DNS and content delivery, hybrid connectivity, and network security (inspection, web application firewall, and DDoS protection). Other AWS networking services (VPC foundations, load balancing, endpoints, PrivateLink, API Gateway, and more) are out of scope for this router (see step 6).

Works best with the AWS MCP server — enables sandboxed execution, audit logging, and enterprise controls. All guidance also works with standard AWS CLI access.

将网络请求路由至特定服务对应的Skill。涵盖DNS与内容分发、混合连接、网络安全（检测、Web应用防火墙、DDoS防护）三大领域的8项服务。其他AWS网络服务（VPC基础组件、负载均衡、终端节点、PrivateLink、API Gateway等）不在本路由Skill的覆盖范围内（详见步骤6）。

最佳搭配 AWS MCP server —— 支持沙箱执行、审计日志记录和企业级管控。所有指导也适用于标准AWS CLI访问方式。

How to use this skill

如何使用本Skill

Match the user's request against the Skill Routing Table below. Match on meaning, not exact wording.
If the request matches multiple skills, use the Cross-Service Concepts tables to determine which layer the request targets, then route to the skill that owns that layer.
If still ambiguous, ask one clarifying question: "Are you looking to set up connectivity, or control/filter existing traffic?"
Load the target skill: if the AWS MCP server is available, use
```
aws___retrieve_skill(skill_name="<skill>")
```
; otherwise retrieve the skill document from this repository at
```
skills/<skill>/SKILL.md
```
.
If a request spans multiple of these skills (e.g., inspecting east-west traffic between VPCs joined by a Transit Gateway), route to each in dependency order: the connectivity skill first (
```
transitgateway
```
), then the inspection skill (
```
networkfirewall
```
). When routing to an internet-facing service (
```
cloudfront
```
), also route to
```
shieldadvanced
```
for DDoS protection and to
```
waf
```
for L7 filtering (AWS WAF attaches to CloudFront, Application Load Balancer, API Gateway, and AppSync), if the user has not already addressed L7 filtering and DDoS protection. When routing to a connectivity skill (
```
directconnect
```
,
```
sitetositevpn
```
,
```
transitgateway
```
), confirm encryption in transit is addressed (MACsec for Direct Connect, IPsec for VPN, inter-region peering encryption for Transit Gateway). When the request involves custom domains or TLS on
```
cloudfront
```
, note that ACM certificate provisioning is part of the implementation. When routing to
```
cloudfront
```
for a web-facing distribution, note that the target skill should address security response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) via a CloudFront Response Headers Policy, including the managed
```
SecurityHeadersPolicy
```
. The target skill handles the configuration.
If the request is an AWS networking task that is not in the Skill Routing Table (for example VPC subnets or route tables, security groups, load balancers, VPC endpoints, PrivateLink, or API Gateway), tell the user that service is not available in this skill set rather than routing to the closest listed skill. This skill set does not cover every AWS networking service.
This skill triages — it does not implement. Do not answer service-specific configuration questions from this skill alone.

将用户请求与下方的Skill路由表进行匹配。匹配依据为请求含义，而非精确措辞。
若请求匹配多个Skill，使用跨服务概念表确定请求针对的层级，然后路由至负责该层级的Skill。
若仍存在歧义，提出一个澄清问题："您是想要设置连接，还是控制/过滤现有流量？"
加载目标Skill：若AWS MCP server可用，使用
```
aws___retrieve_skill(skill_name="<skill>")
```
；否则从本代码库的
```
skills/<skill>/SKILL.md
```
路径获取Skill文档。
若请求涉及多个上述Skill（例如，检查由Transit Gateway连接的VPC之间的东西向流量），按依赖顺序路由：先路由至连接类Skill（
```
transitgateway
```
），再路由至检测类Skill（
```
networkfirewall
```
）。当路由至面向互联网的服务（
```
cloudfront
```
）时，若用户尚未处理L7过滤和DDoS防护，还需路由至
```
shieldadvanced
```
进行DDoS防护，以及
```
waf
```
进行L7过滤（AWS WAF可附加至CloudFront、应用负载均衡器、API Gateway和AppSync）。当路由至连接类Skill（
```
directconnect
```
、
```
sitetositevpn
```
、
```
transitgateway
```
）时，确认已处理传输加密（Direct Connect使用MACsec，VPN使用IPsec，Transit Gateway使用跨区域对等连接加密）。当请求涉及
```
cloudfront
```
的自定义域名或TLS时，需注意ACM证书配置属于实现环节的一部分。当路由至
```
cloudfront
```
以搭建面向Web的分发时，需注意目标Skill应通过CloudFront响应头策略处理安全响应头（CSP、HSTS、X-Frame-Options、X-Content-Type-Options），包括托管的
```
SecurityHeadersPolicy
```
。具体配置由目标Skill完成。
若请求属于AWS网络任务但未列入Skill路由表（例如VPC子网或路由表、安全组、负载均衡器、VPC终端节点、PrivateLink或API Gateway），告知用户该服务不在本Skill集合的覆盖范围内，而非路由至最接近的已列出Skill。本Skill集合并未覆盖所有AWS网络服务。
本Skill仅负责分流，不负责实现功能。请勿仅通过本Skill回答特定服务的配置问题。

Connectivity vs Security

连接性 vs 安全性

Dimension	Connectivity	Security
Answers	Can traffic reach its destination?	Should traffic be allowed?
Failure symptom	Timeout, unreachable, black hole	Rejected, denied, dropped
Dependency	Independent of policy — path exists or it doesn't	Assumes connectivity exists — can only filter reachable traffic
Granularity	Affects all flows on a path	Targets specific flows by match criteria

维度	连接性	安全性
解决问题	流量能否到达目标？	是否应允许流量通过？
故障症状	超时、无法访问、黑洞	被拒绝、被阻止、被丢弃
依赖关系	独立于策略——路径存在与否	假设连接已建立——仅能过滤可到达的流量
粒度	影响路径上的所有流量流	通过匹配标准针对特定流量流

Skill Routing Table

Skill路由表

Skill	Choose when…
`transitgateway`	Connecting more than two VPCs or on-premises networks in a hub, routing segmentation, cross-account/cross-region connectivity at scale, centralized egress/inspection, multicast
`directconnect`	Dedicated private link to on-premises — consistent latency, high throughput, MACsec encryption, LAGs, Direct Connect Gateway for multi-VPC, SiteLink for site-to-site bypass, production hybrid workloads
`sitetositevpn`	Encrypted IPsec tunnel over internet — quick setup, DX backup, static or BGP routing, accelerated option via Global Accelerator backbone, standard or large tunnel bandwidth
`route53`	DNS management (public/private zones, records), health checks, routing policies (weighted, failover, geo, latency), domain registration, Resolver (hybrid DNS forwarding), DNS Firewall, Route 53 Profiles, Global Resolver
`cloudfront`	Caching, TLS termination at edge, origin protection (OAC), custom domains, cache policies/behaviors, signed URLs, CloudFront Functions, viewer mTLS, VPC origins, multi-tenant distributions
`networkfirewall`	Stateful L3–L7 inspection, IDS/IPS, outbound domain filtering by FQDN, TLS inspection, Suricata rules, centralized inspection via TGW — for traffic at the network layer, east-west, or egress
`waf`	Web application firewall (L7) — web ACLs on CloudFront/ALB/API Gateway/AppSync, AWS Managed Rules, rate-based rules for HTTP floods, IP/geo match, Bot Control, Fraud Control (account takeover/creation), for protecting web apps and APIs from exploits, bots, and credential stuffing
`shieldadvanced`	L3/L4 DDoS protection for internet-facing resources, automatic application-layer (L7) mitigation via WAF, health-based detection, Shield Response Team access, and DDoS cost-protection credits

Skill	适用场景…
`transitgateway`	以中心模式连接两个以上VPC或本地网络、路由分段、大规模跨账户/跨区域连接、集中式出站/检测、多播
`directconnect`	连接本地环境的专用私有链路——延迟稳定、高吞吐量、MACsec加密、链路聚合组（LAG）、用于多VPC的Direct Connect Gateway、用于站点间旁路的SiteLink、生产级混合工作负载
`sitetositevpn`	基于互联网的加密IPsec隧道——快速部署、Direct Connect备份、静态或BGP路由、通过Global Accelerator骨干网的加速选项、标准或大隧道带宽
`route53`	DNS管理（公网/私网区域、记录）、健康检查、路由策略（加权、故障转移、地理、延迟）、域名注册、Resolver（混合DNS转发）、DNS防火墙、Route 53配置文件、全局Resolver
`cloudfront`	缓存、边缘节点TLS终止、源站保护（OAC）、自定义域名、缓存策略/行为、签名URL、CloudFront Functions、查看器mTLS、VPC源站、多租户分发
`networkfirewall`	有状态L3–L7检测、IDS/IPS、基于FQDN的出站域名过滤、TLS检测、Suricata规则、通过TGW实现的集中式检测——适用于网络层、东西向或出站流量
`waf`	Web应用防火墙（L7）——在CloudFront/ALB/API Gateway/AppSync上配置Web ACL、AWS托管规则、针对HTTP洪水的基于速率的规则、IP/地理匹配、机器人控制、欺诈控制（账户接管/创建），用于保护Web应用和API免受漏洞利用、机器人攻击和凭证填充
`shieldadvanced`	面向互联网资源的L3/L4 DDoS防护、通过WAF实现自动应用层（L7）缓解、基于健康状态的检测、Shield响应团队访问权限、DDoS成本保护额度

Cross-Service Concepts

跨服务概念

Same concept, different service depending on layer. Use these to disambiguate when the Skill Routing Table matches multiple skills.

同一概念，根据层级不同对应不同服务。当Skill路由表匹配多个Skill时，使用这些内容消除歧义。

Filtering / Blocking

过滤 / 拦截

Use when the user says "block", "deny", "filter", or "restrict traffic" — determines which layer the filtering operates at.

Layer	Service	What it filters on	Skill
L7 (HTTP/HTTPS, web apps and APIs)	AWS WAF	HTTP request attributes, AWS Managed Rules, rate-based and bot rules, IP/geo match	`waf`
L3/L4 (DDoS volumetric/state-exhaustion)	Shield Advanced	Network/transport-layer DDoS floods on internet-facing resources	`shieldadvanced`
L3-L7 (stateful, domain, geo)	Network Firewall	5-tuple, FQDN, Suricata rules, TLS SNI	`networkfirewall`
DNS (resolution)	Route 53 DNS Firewall	Domain name patterns — blocks resolution, not traffic	`route53`

When routing to

waf

cloudfront

for an internet-facing API or website, treat WAF rate-based rules as a default protective measure, not only when the user asks: note that the target skill should add WAF rate-based rules to bound request volume per client — the target skill implements it.

当用户提及"拦截"、"拒绝"、"过滤"或"限制流量"时使用——确定过滤操作所处的层级。

层级	服务	过滤依据	Skill
L7（HTTP/HTTPS、Web应用和API）	AWS WAF	HTTP请求属性、AWS托管规则、基于速率和机器人的规则、IP/地理匹配	`waf`
L3/L4（DDoS流量耗尽/状态耗尽）	Shield Advanced	面向互联网资源的网络/传输层DDoS洪水	`shieldadvanced`
L3-L7（有状态、域名、地理）	Network Firewall	5元组、FQDN、Suricata规则、TLS SNI	`networkfirewall`
DNS（解析）	Route 53 DNS防火墙	域名模式——阻止解析，而非流量	`route53`

当路由至

waf

或

cloudfront

以处理面向互联网的API或网站时，默认将WAF基于速率的规则视为防护措施，而非仅在用户要求时才配置：需注意目标Skill应添加WAF基于速率的规则，以限制每个客户端的请求量——具体实现由目标Skill完成。

Logging / Visibility

日志 / 可见性

Use when the user says "logs", "visibility", "what's being blocked", or "can I see the traffic" — identifies which log source to check.

What you need to see	Service	Log type	Skill
Stateful inspection alerts + drops	Network Firewall	Alert logs, flow logs	`networkfirewall`
DNS queries from VPC	Route 53 Resolver	Query logs	`route53`
Blocked/allowed HTTP requests	AWS WAF	web ACL logs (S3, CloudWatch Logs, or Kinesis Data Firehose)	`waf`
DDoS events and attack detail	Shield Advanced	CloudWatch metrics, DDoS event detection	`shieldadvanced`
Edge/CDN request access	CloudFront	Standard logs (S3), real-time logs (Kinesis Data Streams)	`cloudfront`
Tunnel state and traffic	Site-to-Site VPN	Tunnel telemetry, CloudWatch metrics	`sitetositevpn`

When routing to any of these services, remind the user to enable the corresponding logging (above) for security visibility and incident response — the target skill implements it. These logs can contain sensitive data (request query strings, internal hostnames in DNS queries), so also remind the user that the log destination (S3, CloudWatch Logs, Kinesis Data Firehose, or Kinesis Data Streams) MUST have encryption at rest enabled and access restricted to authorized personnel — the target skill implements it.

当用户提及"日志"、"可见性"、"哪些流量被拦截"或"能否查看流量"时使用——确定应查看的日志来源。

需要查看的内容	服务	日志类型	Skill
有状态检测告警 + 丢弃记录	Network Firewall	告警日志、流量日志	`networkfirewall`
VPC中的DNS查询	Route 53 Resolver	查询日志	`route53`
被拦截/允许的HTTP请求	AWS WAF	Web ACL日志（S3、CloudWatch Logs或Kinesis Data Firehose）	`waf`
DDoS事件和攻击详情	Shield Advanced	CloudWatch指标、DDoS事件检测	`shieldadvanced`
边缘/CDN请求访问记录	CloudFront	标准日志（S3）、实时日志（Kinesis Data Streams）	`cloudfront`
隧道状态和流量	Site-to-Site VPN	隧道遥测数据、CloudWatch指标	`sitetositevpn`

当路由至上述任一服务时，提醒用户启用相应的日志（如上表所示），以保障安全可见性和事件响应——具体实现由目标Skill完成。这些日志可能包含敏感数据（请求查询字符串、DNS查询中的内部主机名），因此还需提醒用户日志存储目标（S3、CloudWatch Logs、Kinesis Data Firehose或Kinesis Data Streams）必须启用静态加密，并限制授权人员的访问权限——具体实现由目标Skill完成。

Traffic Shifting

流量切换

Use when the user says "shift traffic", "blue/green", "failover", "canary", or "weighted routing" — determines the granularity and which service controls it.

Granularity	Service	Mechanism	Skill
DNS-level (global)	Route 53	Weighted, failover, geolocation, latency routing	`route53`
Edge (HTTP)	CloudFront	Origin failover, origin groups	`cloudfront`

当用户提及"流量切换"、"蓝绿部署"、"故障转移"、"金丝雀发布"或"加权路由"时使用——确定粒度和负责控制的服务。

粒度	服务	机制	Skill
DNS层级（全局）	Route 53	加权、故障转移、地理定位、延迟路由	`route53`
边缘（HTTP）	CloudFront	源站故障转移、源站组	`cloudfront`

Security Considerations

安全注意事项

These services are security-sensitive, so raise the relevant risk and control when routing regardless of which skill you hand off to — the target skill implements the control:

Risk	Control the target skill should address	Skills
Unencrypted traffic in transit	MACsec ( `directconnect` ), IPsec tunnels ( `sitetositevpn` ), inter-region peering encryption ( `transitgateway` ), TLS termination and viewer mTLS ( `cloudfront` )	`directconnect` , `sitetositevpn` , `transitgateway` , `cloudfront`
Missing DDoS protection on internet-facing resources	Shield Advanced L3/L4 protection plus WAF L7 mitigation	`shieldadvanced` , `waf`
Web/API exploits, bots, and request floods	WAF web ACLs, AWS Managed Rules, and rate-based rules; application-layer input validation (request body size limits, schema validation); security response headers	`waf` , `cloudfront`
Overly permissive filtering rules	Least-privilege stateful rules, FQDN egress filtering, DNS Firewall domain blocking	`networkfirewall` , `route53`
Over-privileged IAM policies for service resources	Least-privilege IAM roles scoped to specific resources and actions; avoid `FullAccess` managed policies and `Action: *` ; prefer IAM roles with ephemeral credentials (instance profiles, IRSA, task roles, `sts assume-role` ) over IAM users with long-lived access keys	all
Hardcoded credentials and shared secrets	Let AWS auto-generate secrets where supported (for example Site-to-Site VPN pre-shared keys), or store customer-managed secrets in AWS Secrets Manager rather than hardcoding them	`sitetositevpn` , `directconnect`
Confused-deputy in cross-service resource policies	Include `aws:SourceArn` and/or `aws:SourceAccount` condition keys in S3 bucket policies, KMS key policies, and log-destination resource policies (CloudFront OAC, log delivery to S3/CloudWatch Logs/Kinesis) so only the intended resource and account can invoke them	`cloudfront` , `waf` , `networkfirewall` , all
Insufficient visibility for incident response	Enable the service logging in the Logging / Visibility table, with encryption at rest and restricted access on the log destination	all
No audit trail or alerting on control-plane changes	Enable AWS CloudTrail to audit control-plane API calls (record, rule, policy, and firewall changes) and set CloudWatch Alarms on security-relevant events (Shield Advanced DDoS detection, WAF blocked/counted spikes, unexpected rule or record modifications); restrict the SNS topics that receive alarm notifications to authorized personnel and enable encryption at rest (SSE-KMS) on those topics, since the notifications can contain sensitive event detail	all

For authoritative guidance, point users to the AWS Well-Architected Framework Security Pillar and the service-specific security documentation for the target skill.

这些服务属于安全敏感型，因此无论路由至哪个Skill，都需提出相关风险和管控要求——具体管控措施由目标Skill实现：

风险	目标Skill应处理的管控措施	涉及Skill
传输中流量未加密	MACsec（ `directconnect` ）、IPsec隧道（ `sitetositevpn` ）、跨区域对等连接加密（ `transitgateway` ）、TLS终止和查看器mTLS（ `cloudfront` ）	`directconnect` , `sitetositevpn` , `transitgateway` , `cloudfront`
面向互联网的资源缺少DDoS防护	Shield Advanced L3/L4防护 + WAF L7缓解	`shieldadvanced` , `waf`
Web/API漏洞利用、机器人攻击和请求洪水	WAF Web ACL、AWS托管规则和基于速率的规则；应用层输入验证（请求体大小限制、 schema验证）；安全响应头	`waf` , `cloudfront`
过滤规则过于宽松	最小权限的有状态规则、FQDN出站过滤、DNS防火墙域名拦截	`networkfirewall` , `route53`
服务资源的IAM权限过于宽泛	针对特定资源和操作的最小权限IAM角色；避免使用 `FullAccess` 托管策略和 `Action: *` ；优先使用带有临时凭证的IAM角色（实例配置文件、IRSA、任务角色、 `sts assume-role` ），而非带有长期访问密钥的IAM用户	所有
硬编码凭证和共享密钥	在支持的情况下让AWS自动生成密钥（例如Site-to-Site VPN预共享密钥），或将客户管理的密钥存储在AWS Secrets Manager中，而非硬编码	`sitetositevpn` , `directconnect`
跨服务资源策略中的混淆代理问题	在S3存储桶策略、KMS密钥策略和日志存储目标资源策略（CloudFront OAC、日志投递至S3/CloudWatch Logs/Kinesis）中添加 `aws:SourceArn` 和/或 `aws:SourceAccount` 条件键，确保只有预期的资源和账户可以调用它们	`cloudfront` , `waf` , `networkfirewall` , 所有
事件响应的可见性不足	启用日志/可见性表中的服务日志，并对日志存储目标启用静态加密和访问限制	所有
管控平面变更缺少审计追踪或告警	启用AWS CloudTrail以审计管控平面API调用（记录、规则、策略和防火墙变更），并针对安全相关事件（Shield Advanced DDoS检测、WAF拦截/计数峰值、意外规则或记录修改）设置CloudWatch告警；限制接收告警通知的SNS主题的授权人员访问权限，并对这些主题启用静态加密（SSE-KMS），因为通知可能包含敏感事件详情	所有

如需权威指导，请引导用户查看AWS Well-Architected Framework安全支柱以及目标Skill对应的服务特定安全文档。