Skip to main content
Glama
deenesjakoruzh
patelketul1230

Enterprise Secure AWS MCP Server

by patelketul1230
OverviewSchemaRelated ServersScoreDiscussions
Python
Remote

企业级安全 AWS 模型上下文协议（MCP）服务器

生产级模型上下文协议（MCP）服务器，部署于 AWS Lambda 与 API Gateway，采用 100% Terraform IaC、零信任 IAM RBAC，并具备 OWASP LLM Top 10 防御护栏。

AWS 架构概览

AWS 企业级 MCP 服务器 Figma 架构图

Related MCP server: AWS Sage

功能特性

  • 标准 MCP 规范： 完全支持 Anthropic 模型上下文协议（MCP）工具发现（/mcp/tools）与工具执行（/mcp/tools/call）。

  • 基于 IAM 角色的访问控制（RBAC）： 按角色（sre_read_only、security_auditor、sre_admin）限制工具执行权限。

  • OWASP LLM02 防御： 边缘净化，拦截子 shell 元字符注入（[;&|'$]）。

  • OWASP LLM06 防御： 自动输出缓冲区脱敏器，清除 AWS 访问密钥（AKIA...）及 PII 个人信息。

  • 交互式 Web UI 测试平台： 运行于 http://localhost:8080 的深色模式测试界面（make ui）。

  • 零闲置云成本： 通过 Terraform 预置，单命令部署（make deploy），即时拆除（make destroy）。

Web UI 测试平台演示

以下是高清晰度自动化交互式演示，展示 RBAC 访问拒绝、命令注入防御，以及 sre_admin 角色下的服务器重启执行成功：

AWS MCP 服务器安全测试 UI 演示

前置条件与系统设置

在开始项目设置之前，请确保您的环境已安装 Python 3.11+、Terraform 和 AWS CLI。

1. 系统依赖（Linux / Ubuntu / Debian）

sudo apt update && sudo apt install python3-venv python3-pip terraform awscli -y

2. 环境设置

克隆仓库并将项目依赖安装到隔离的虚拟环境（.venv）中：

git clone https://github.com/patelketul1230/aws-mcp-enterprise-server.git
cd aws-mcp-enterprise-server

# Create .venv and install dependencies
make install

仓库结构

aws-mcp-enterprise-server/
├── docs/
│   ├── assets/                    # Centralized PNG images & HD animations
│   │   ├── mcp_aws_figma_architecture_diagram.png
│   │   ├── mcp_ui_testing_demo.webp
│   │   ├── mcp_ui_testing_demo.gif
│   │   ├── mcp_ui_playground_success_screenshot.png
│   │   ├── mcp_ui_playground_admin_success_screenshot.png
│   │   └── mcp_ui_playground_blocked_screenshot.png
│   ├── blogs/                     # 3 Medium Sub-Blogs ready for publication
│   │   ├── blog_1_1_mcp_decoded.md
│   │   ├── blog_1_2_mcp_rbac_python.md
│   │   └── blog_1_3_mcp_tool_poisoning.md
│   ├── architecture.md            # Figma diagrams & sequence flows
│   ├── 5w_and_how.md              # 5 Ws + 1 H problem statement & threat model
│   └── demo_execution.log         # Verified test execution log
├── src/
│   ├── clients/                   # AWS Bedrock Converse API integration client
│   ├── middleware/                # MCPSecurityValidator (RBAC & DLP)
│   ├── tools/                     # CloudWatch & Terraform tool modules
│   ├── ui/                        # Interactive Web UI Playground (index.html)
│   └── server.py                  # AWS Lambda & FastAPI server handler
├── terraform/                     # 100% Terraform IaC (API Gateway, IAM, Lambda)
├── tests/                         # Pytest suite & live verification scripts
├── Makefile                       # Lifecycle hooks (make deploy / make destroy / make ui)
└── README.md                      # Project documentation

快速入门指南

1. 安装依赖

make install

2. 运行测试

make test

3. 部署基础设施到 AWS

make deploy

输出项：

  • API 端点： 由 Terraform 动态生成

  • CloudWatch 日志组： /aws/mcp/aws-mcp-enterprise-server-dev

4. 启动交互式 Web UI 测试平台

make ui

在您的网页浏览器中打开 http://localhost:8080，即可可视化测试工具调用、RBAC 角色和注入防御！

5. 通过终端（curl）进行测试

# Health Check
curl -s <YOUR_API_ENDPOINT>/health

# Tool Discovery Catalog
curl -s <YOUR_API_ENDPOINT>/mcp/tools

# Valid Tool Call (CloudWatch Query)
curl -s -X POST <YOUR_API_ENDPOINT>/mcp/tools/call \
  -H "Content-Type: application/json" \
  -H "X-User-Role: sre_read_only" \
  -d '{"tool_name": "query_cloudwatch_logs", "arguments": {"log_group": "/aws/lambda/payment-dev", "filter_pattern": "ERROR"}}'

# Command Injection Attack (Returns 403 Forbidden)
curl -s -X POST <YOUR_API_ENDPOINT>/mcp/tools/call \
  -H "Content-Type: application/json" \
  -H "X-User-Role: sre_read_only" \
  -d '{"tool_name": "query_cloudwatch_logs", "arguments": {"log_group": "/aws/lambda/payment-dev; rm -rf /", "filter_pattern": "ERROR"}}'

6. 拆除 AWS 资源

make destroy

技术文档链接

This server cannot be installed

F
license - not found
Not graded
quality - not tested
B
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

  • MCP2Lambda

    danilop
    A
    license
    B
    quality
    D
    maintenance
    Enables AI models to interact with AWS Lambda functions via the MCP protocol, allowing access to private resources, real-time data, and custom computation in a secure environment.
    2
    109
    MIT

  • AWS Sage

    arunsanna
    A
    license
    Not graded
    quality
    C
    maintenance
    A unified MCP server for AWS that enables natural language infrastructure management, cross-service resource discovery, and dependency mapping. It features 30 intelligent tools for cost optimization, incident investigation, and multi-account operations protected by a robust safety system.
    5
    MIT

  • MCP Airlock

    lara-muhanna
    A
    license
    C
    quality
    D
    maintenance
    Enables secure, zero-trust access to MCP tools through short-lived, signed capability leases that bind tool execution to specific sessions, intents, and constraints. Prevents prompt injection attacks and privilege escalation with dynamic risk scoring, policy enforcement, and tamper-evident audit logging.
    4
    1
    MIT

  • aws-safe-mcp

    harryhazza77
    A
    license
    Not graded
    quality
    C
    maintenance
    A read-only MCP server for safe, structured investigation of AWS serverless resources, providing curated tools for tracing dependencies, permissions, and failures without exposing raw SDK access.
    MIT

View all related MCP servers

Related MCP Connectors

  • copilotcliswitchgate-mcp

    Remote MCP for Copilot CLI switch gate MCP, structured receipts, audit logs, and reviewer-ready evid

  • futureagievals-mcp

    A paid remote MCP for AI SDK eval dashboard, built to return verdicts, receipts, usage logs, and aud

  • clawmanagerfleet-mcp

    A paid remote MCP for ClawManager, built to return verdicts, receipts, usage logs, and audit-ready J

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/patelketul1230/aws-mcp-enterprise-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server