What problem does it solve? AWS work in GCC, GovTech, restricted, or private-only network lanes can accidentally introduce public Internet exposure through Internet Gateways, NAT Gateways, public IPs, or internet-facing load balancers. This Skill enforces a default-deny guardrail that stops such changes before they are applied. ## Core Features & Use Cases - Hard Block List: Refuses to create or propose Internet Gateways, NAT Gateways, public subnets, Elastic IPs, public EC2 IPs, internet-facing ALB/NLB, 0.0.0.0/0 routes to IGW/NAT, and public SSH/RDP access. - Scoped Preflight Triggers: Runs the full public-exposure preflight only when the task touches VPCs, subnets, route tables, gateways, public IPs, load balancers, Transit Gateway, VPC peering, PrivateLink, or security group exposure. - Lightweight EC2-Only Check: For EC2 launches in an already-approved private subnet, verifies only AssociatePublicIpAddress=false, the correct private subnet, and PublicIpAddress=null. - Use Case: Before applying a Terraform change that adds a new subnet and route table in a GovTech private lane, run this preflight to confirm no IGW, NAT, public IP, or internet-facing load balancer is introduced, and record the required public-exposure check line in the plan. ## Quick Start Use the aws-private-network-preflight skill to check this planned VPC and subnet change for any public Internet exposure before applying it.
