The Agent Skills Directory

[Strong Encryption Standards]: The skill consistently mandates the use of AES-256 encryption, SHA-256 integrity algorithms, and Diffie-Hellman group 14 or higher for VPN tunnels. This ensures that the communication channel remains robust against modern cryptographic threats and avoids weaker default settings like AES-128 or SHA-1.
[Secure Secret Management]: Pre-Shared Keys (PSKs) are treated as sensitive artifacts. The instructions require the use of the --pre-shared-key-storage SecretsManager flag in AWS CLI commands, ensuring that authentication secrets are not passed in plain text via the command line and are stored securely in AWS Secrets Manager.
[Identity and Access Management]: The procedure recommends using ephemeral IAM role-based credentials (such as SSO sessions or assumed roles) rather than long-lived IAM user access keys. It also includes steps to verify the caller's identity using aws sts get-caller-identity before performing administrative tasks.
[Encrypted Monitoring and Logging]: The skill requires encryption at rest for all log destinations. Specifically, it mandates using AWS KMS for CloudWatch Logs log groups and SSE-S3 or SSE-KMS for S3 buckets holding CloudTrail logs, protecting sensitive infrastructure details contained within those logs.
[Resilient Infrastructure Patterns]: The instructions guide users toward high-availability configurations, such as using both provided VPN tunnels and deploying redundant customer gateway devices, to ensure connectivity survives maintenance cycles and hardware failures.

sitetositevpn