AWS Site-to-Site VPN

Overview

Domain expertise for configuring AWS Site-to-Site VPN, the managed service that builds an encrypted IP Security (IPsec) connection between an on-premises network and AWS. Covers the routing decision (static versus dynamic (BGP) routing), creating the connection and its dependent resources in the right order, sizing tunnel bandwidth, consolidating many sites through a VPN Concentrator, applying the customer gateway device configuration, building for high availability, and monitoring and troubleshooting tunnels.

This skill is a router. Each customer task maps to a procedure file under references/. Read the matching reference in full before acting, then follow its constraints and steps. The reference files are self-contained: each carries its own decision tables, constraints, procedure, and troubleshooting.

Execute commands using the AWS MCP server when connected (sandboxed execution, audit logging, observability). Fall back to the AWS CLI otherwise. Site-to-Site VPN is a regional service: pass --region {region} matching the VPC or transit gateway the connection terminates on.