From magic-powers
Use when designing VPC architectures, configuring subnets and routing, setting up hybrid connectivity (VPN/Direct Connect/Transit Gateway), or choosing between load balancer types. Covers AWS ANS-C01 and SAP-C02 networking domains.
npx claudepluginhub kienbui1995/magic-powers --plugin magic-powersThis skill uses the workspace's default tool permissions.
- Designing VPC architecture with public, private, and isolated subnets
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
| Subnet Type | Route Table | Internet Access | Use Case |
|---|---|---|---|
| Public | 0.0.0.0/0 → IGW | Yes (inbound + outbound) | Load balancers, bastion hosts, NAT Gateway |
| Private | 0.0.0.0/0 → NAT GW | Outbound only (via NAT) | Application servers, databases |
| Isolated | No internet route | None | Databases, secrets, compliance workloads |
Best practice 3-tier architecture:
AZ-a AZ-b
Public: 10.0.1.0/24 ←IGW→ 10.0.2.0/24 (ALB, NAT GW)
Private: 10.0.11.0/24 10.0.12.0/24 (App servers)
DB: 10.0.21.0/24 10.0.22.0/24 (RDS, isolated)
IP CIDR planning:
| Feature | Security Groups | NACLs |
|---|---|---|
| Level | Instance/ENI level | Subnet level |
| Statefulness | Stateful (return traffic automatic) | Stateless (both directions must be explicitly allowed) |
| Rule types | Allow only | Allow AND Deny |
| Rule processing | All rules evaluated | Rules evaluated in order (lowest number first); first match wins |
| Default | Deny all inbound, allow all outbound | Allow all (default NACL) |
| Best for | Fine-grained per-instance control | Subnet-level blocking (known bad IPs, port ranges) |
Stateful vs Stateless example:
NACL rule ordering: Rule 100 (allow 443) before Rule 200 (deny all) — lower numbers evaluated first.
| Option | Bandwidth | Latency | Encryption | SLA | Cost |
|---|---|---|---|---|---|
| Site-to-Site VPN | Up to 1.25Gbps per tunnel | Variable (internet) | IPsec (always) | 99.95% | Low |
| Direct Connect (DX) | 1, 10, 100 Gbps | Consistent (private fiber) | None by default (add MACSEC or VPN over DX) | 99.9% (1 DX) | Medium-High |
| Direct Connect + VPN | DX bandwidth | DX latency | IPsec over DX | Highest | Medium-High |
| Client VPN | Per-client | Variable | TLS | — | Per connection |
Direct Connect Virtual Interfaces (VIFs):
Redundancy:
TGW vs VPC Peering:
| Aspect | Transit Gateway | VPC Peering |
|---|---|---|
| Scale | Hundreds of VPCs | Bilateral only (no transitive routing) |
| Transitive routing | Yes | No (A→B, B→C does NOT allow A→C) |
| Bandwidth | 50Gbps per AZ per attachment | Limited by VPC/EC2 limits |
| Cost | Per attachment + data transfer | Data transfer only |
| Management | Centralized route tables | Decentralized; manage each peering |
| Type | Services | Cost | Use Case |
|---|---|---|---|
| Gateway endpoint | S3, DynamoDB | Free | Private S3/DynamoDB access from VPC (no NAT GW needed) |
| Interface endpoint (PrivateLink) | All other AWS services, partner services | Hourly + data transfer | Private access to AWS services, SaaS, cross-account services |
Gateway endpoint: adds route in VPC route table; traffic stays on AWS network; completely free. Interface endpoint: ENI in your VPC subnet; DNS resolves service hostname to private IP; hourly cost.
Private DNS: Interface endpoints can override public DNS → existing code using s3.amazonaws.com automatically uses private endpoint when Private DNS enabled.
| Load Balancer | Layer | Protocol | Best For |
|---|---|---|---|
| ALB (Application) | L7 | HTTP/HTTPS/HTTP2/gRPC | Path routing, host routing, content-based, microservices |
| NLB (Network) | L4 | TCP/UDP/TLS | Ultra-low latency, static IP, extreme throughput |
| GWLB (Gateway) | L3/L4 | All IP traffic | Inline network appliances (firewalls, IDS/IPS) |
ALB features: Target groups (EC2, ECS, Lambda, IP), path-based routing (/api/*), host-based routing, weighted target groups, Lambda targets, WAF integration, Cognito authentication.
NLB features: Static IP (one per AZ), Elastic IP assignment, TLS passthrough or termination, zonal isolation (sticky to AZ), PrivateLink source.
GWLB: Bumps-in-the-wire inspection; traffic transparently redirected through appliance using GENEVE protocol; appliance sees original packets.