AWS · Cloud service
Amazon Virtual Private Cloud with OrchestrAI
Catalog exported 2026-09-02
Build Amazon VPC networking from chat: VPCs, gateways, route tables, security groups, endpoints, flow logs.
OrchestrAI exposes 11 VPC operations: 3 are low-risk (read-only or low-impact), and 8 create or modify resources and run only after you confirm the plan. 1 of them also carries a step-level approval gate.
What teams use it for
Teams use OrchestrAI to create a VPC with a CIDR block, add an internet gateway and NAT gateway, build route tables and associate them with subnets, create security groups and add ingress or egress rules, add VPC endpoints for private access to S3 or other services, and turn on flow logs. Creation operations are medium risk, and deleting a VPC is high risk with confirmation. There is no subnet creation operation and no describe operations, so subnets are created in the console and existing network layout is reviewed there too.
Every VPC operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Associate Route Table |
Associate a route table with a subnet | Low risk | No |
Attach Internet Gateway |
Attach an internet gateway to a VPC | Low risk | No |
Create VPC Flow Log |
Create a VPC flow log for network traffic monitoring | Low risk | No |
Add Security Group Rule |
Add an ingress or egress rule to a security group | Creates resources | No |
Create Internet Gateway |
Create an internet gateway and attach it to a VPC for public internet access | Creates resources | No |
Create NAT Gateway |
Create a NAT gateway for private subnet internet access | Creates resources | No |
Create Route Table |
Create a route table in a VPC with routes for traffic routing | Creates resources | No |
Create Security Group |
Create a security group in a VPC | Creates resources | No |
Create VPC |
Create a new VPC with specified CIDR block | Creates resources | No |
Create VPC Endpoint |
Create a VPC endpoint for private access to AWS services | Creates resources | No |
Delete VPC |
Delete a VPC and associated resources | Modifies existing | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
Prompts that work
- Create a VPC named app-vpc with CIDR 10.20.0.0/16 in us-east-1 and attach an internet gateway
- Create a security group web-sg in app-vpc that allows inbound 443 from 0.0.0.0/0
- Add a gateway VPC endpoint for S3 to app-vpc and enable flow logs to CloudWatch
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Can OrchestrAI create subnets in a VPC?
- No, subnet creation is not in the current operations, so create subnets in the console, then OrchestrAI can associate route tables and place resources in them.
- Does OrchestrAI remove security group rules?
- No, it can create security groups and add rules, but removing a rule is done in the console.
- Which VPC operations need an extra approval step?
- One operation carries a step-level approval gate on top of plan confirmation: Delete VPC. None of them is classed destructive.
Other AWS services
Related integrations
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.