Skip to main content
Glama
deenesjakoruzh
patelketul1230

Enterprise Secure AWS MCP Server

by patelketul1230
OverviewSchemaRelated ServersScoreDiscussions
Python
Remote

엔터프라이즈 보안 AWS Model Context Protocol (MCP) 서버

AWS Lambda 및 API Gateway에 배포된 프로덕션급 Model Context Protocol (MCP) 서버로, 100% Terraform IaC, 제로 트러스트 IAM RBAC, OWASP LLM Top 10 방어 가드레일을 갖추고 있습니다.

AWS 아키텍처 개요

AWS Enterprise MCP Server Figma Architecture Diagram

Related MCP server: AWS Sage

기능

  • 표준 MCP 사양: Anthropic Model Context Protocol (MCP) 도구 검색(/mcp/tools) 및 도구 실행(/mcp/tools/call) 완전 지원.

  • IAM 역할 기반 접근 제어(RBAC): 역할(sre_read_only, security_auditor, sre_admin)별 도구 실행을 제한합니다.

  • OWASP LLM02 방어: 서브셸 메타문자 주입([;&|'$])을 차단하는 엣지 샌니타이제이션.

  • OWASP LLM06 방어: AWS 액세스 키(AKIA...) 및 PII를 스크러빙하는 자동 출력 버퍼 리댁터.

  • 인터랙티브 웹 UI 플레이그라운드: http://localhost:8080에서 실행되는 다크 모드 테스트 인터페이스(make ui).

  • 제로 유휴 클라우드 비용: 단일 명령 배포(make deploy) 및 즉시 해체(make destroy)가 가능한 Terraform으로 프로비저닝됩니다.

웹 UI 플레이그라운드 데모

아래는 RBAC 접근 거부, 명령 주입 방어, sre_admin 역할 하의 성공적인 서버 재시작 실행을 보여주는 자동화된 고화질 인터랙티브 데모입니다:

AWS MCP Server Web UI Security Testing Demo

사전 요구 사항 및 시스템 설정

프로젝트를 설정하기 전에 환경에 Python 3.11+, Terraform, AWS CLI가 설치되어 있는지 확인하세요.

1. 시스템 종속성 (Linux / Ubuntu / Debian)

sudo apt update && sudo apt install python3-venv python3-pip terraform awscli -y

2. 환경 설정

저장소를 클론하고 격리된 가상 환경(.venv)에 프로젝트 종속성을 설치합니다:

git clone https://github.com/patelketul1230/aws-mcp-enterprise-server.git
cd aws-mcp-enterprise-server

# Create .venv and install dependencies
make install

저장소 구조

aws-mcp-enterprise-server/
├── docs/
│   ├── assets/                    # Centralized PNG images & HD animations
│   │   ├── mcp_aws_figma_architecture_diagram.png
│   │   ├── mcp_ui_testing_demo.webp
│   │   ├── mcp_ui_testing_demo.gif
│   │   ├── mcp_ui_playground_success_screenshot.png
│   │   ├── mcp_ui_playground_admin_success_screenshot.png
│   │   └── mcp_ui_playground_blocked_screenshot.png
│   ├── blogs/                     # 3 Medium Sub-Blogs ready for publication
│   │   ├── blog_1_1_mcp_decoded.md
│   │   ├── blog_1_2_mcp_rbac_python.md
│   │   └── blog_1_3_mcp_tool_poisoning.md
│   ├── architecture.md            # Figma diagrams & sequence flows
│   ├── 5w_and_how.md              # 5 Ws + 1 H problem statement & threat model
│   └── demo_execution.log         # Verified test execution log
├── src/
│   ├── clients/                   # AWS Bedrock Converse API integration client
│   ├── middleware/                # MCPSecurityValidator (RBAC & DLP)
│   ├── tools/                     # CloudWatch & Terraform tool modules
│   ├── ui/                        # Interactive Web UI Playground (index.html)
│   └── server.py                  # AWS Lambda & FastAPI server handler
├── terraform/                     # 100% Terraform IaC (API Gateway, IAM, Lambda)
├── tests/                         # Pytest suite & live verification scripts
├── Makefile                       # Lifecycle hooks (make deploy / make destroy / make ui)
└── README.md                      # Project documentation

빠른 시작 가이드

1. 종속성 설치

make install

2. 테스트 실행

make test

3. AWS에 인프라 배포

make deploy

출력:

  • API 엔드포인트: Terraform이 생성한 동적 출력

  • CloudWatch 로그 그룹: /aws/mcp/aws-mcp-enterprise-server-dev

4. 인터랙티브 웹 UI 플레이그라운드 실행

make ui

웹 브라우저에서 **http://localhost:8080**을 열어 도구 호출, RBAC 역할, 주입 방어를 시각적으로 테스트하세요!

5. 터미널(curl)로 테스트

# Health Check
curl -s <YOUR_API_ENDPOINT>/health

# Tool Discovery Catalog
curl -s <YOUR_API_ENDPOINT>/mcp/tools

# Valid Tool Call (CloudWatch Query)
curl -s -X POST <YOUR_API_ENDPOINT>/mcp/tools/call \
  -H "Content-Type: application/json" \
  -H "X-User-Role: sre_read_only" \
  -d '{"tool_name": "query_cloudwatch_logs", "arguments": {"log_group": "/aws/lambda/payment-dev", "filter_pattern": "ERROR"}}'

# Command Injection Attack (Returns 403 Forbidden)
curl -s -X POST <YOUR_API_ENDPOINT>/mcp/tools/call \
  -H "Content-Type: application/json" \
  -H "X-User-Role: sre_read_only" \
  -d '{"tool_name": "query_cloudwatch_logs", "arguments": {"log_group": "/aws/lambda/payment-dev; rm -rf /", "filter_pattern": "ERROR"}}'

6. AWS 리소스 해체

make destroy

기술 문서 링크

This server cannot be installed

F
license - not found
Not graded
quality - not tested
B
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

  • MCP2Lambda

    danilop
    A
    license
    B
    quality
    D
    maintenance
    Enables AI models to interact with AWS Lambda functions via the MCP protocol, allowing access to private resources, real-time data, and custom computation in a secure environment.
    2
    109
    MIT

  • AWS Sage

    arunsanna
    A
    license
    Not graded
    quality
    C
    maintenance
    A unified MCP server for AWS that enables natural language infrastructure management, cross-service resource discovery, and dependency mapping. It features 30 intelligent tools for cost optimization, incident investigation, and multi-account operations protected by a robust safety system.
    5
    MIT

  • MCP Airlock

    lara-muhanna
    A
    license
    C
    quality
    D
    maintenance
    Enables secure, zero-trust access to MCP tools through short-lived, signed capability leases that bind tool execution to specific sessions, intents, and constraints. Prevents prompt injection attacks and privilege escalation with dynamic risk scoring, policy enforcement, and tamper-evident audit logging.
    4
    1
    MIT

  • aws-safe-mcp

    harryhazza77
    A
    license
    Not graded
    quality
    C
    maintenance
    A read-only MCP server for safe, structured investigation of AWS serverless resources, providing curated tools for tracing dependencies, permissions, and failures without exposing raw SDK access.
    MIT

View all related MCP servers

Related MCP Connectors

  • copilotcliswitchgate-mcp

    Remote MCP for Copilot CLI switch gate MCP, structured receipts, audit logs, and reviewer-ready evid

  • futureagievals-mcp

    A paid remote MCP for AI SDK eval dashboard, built to return verdicts, receipts, usage logs, and aud

  • clawmanagerfleet-mcp

    A paid remote MCP for ClawManager, built to return verdicts, receipts, usage logs, and audit-ready J

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/patelketul1230/aws-mcp-enterprise-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server