Skip to main content
Glama
deenesjakoruzh
patelketul1230

Enterprise Secure AWS MCP Server

by patelketul1230
OverviewSchemaRelated ServersScoreDiscussions
Python
Remote

Enterprise Secure AWS Model Context Protocol (MCP) Server

Production-grade Model Context Protocol (MCP) Server deployed on AWS Lambda & API Gateway with 100% Terraform IaC, zero-trust IAM RBAC, and OWASP LLM Top 10 defense guardrails.

AWS Architecture Overview

AWS Enterprise MCP Server Figma Architecture Diagram

Related MCP server: AWS Sage

Features

  • Standard MCP Specs: Full support for Anthropic Model Context Protocol (MCP) Tool Discovery (/mcp/tools) and Tool Execution (/mcp/tools/call).

  • IAM Role-Based Access Control (RBAC): Restricts tool execution by role (sre_read_only, security_auditor, sre_admin).

  • OWASP LLM02 Defense: Edge sanitization blocking subshell metacharacter injections ([;&|'$]).

  • OWASP LLM06 Defense: Automatic output buffer redactor scrubbing AWS access keys (AKIA...) and PII.

  • Interactive Web UI Playground: Dark-mode test interface running on http://localhost:8080 (make ui).

  • Zero Idle Cloud Cost: Provisioned via Terraform with single-command deployment (make deploy) and instant teardown (make destroy).

Web UI Playground Demo

Below is the automated high-definition interactive demonstration showing RBAC access denial, command injection defense, and successful server restart execution under the sre_admin role:

AWS MCP Server Web UI Security Testing Demo

Prerequisites & System Setup

Before setting up the project, ensure your environment has Python 3.11+, Terraform, and AWS CLI installed.

1. System Dependencies (Linux / Ubuntu / Debian)

sudo apt update && sudo apt install python3-venv python3-pip terraform awscli -y

2. Environment Setup

Clone the repository and install project dependencies into an isolated virtual environment (.venv):

git clone https://github.com/patelketul1230/aws-mcp-enterprise-server.git
cd aws-mcp-enterprise-server

# Create .venv and install dependencies
make install

Repository Structure

aws-mcp-enterprise-server/
├── docs/
│   ├── assets/                    # Centralized PNG images & HD animations
│   │   ├── mcp_aws_figma_architecture_diagram.png
│   │   ├── mcp_ui_testing_demo.webp
│   │   ├── mcp_ui_testing_demo.gif
│   │   ├── mcp_ui_playground_success_screenshot.png
│   │   ├── mcp_ui_playground_admin_success_screenshot.png
│   │   └── mcp_ui_playground_blocked_screenshot.png
│   ├── blogs/                     # 3 Medium Sub-Blogs ready for publication
│   │   ├── blog_1_1_mcp_decoded.md
│   │   ├── blog_1_2_mcp_rbac_python.md
│   │   └── blog_1_3_mcp_tool_poisoning.md
│   ├── architecture.md            # Figma diagrams & sequence flows
│   ├── 5w_and_how.md              # 5 Ws + 1 H problem statement & threat model
│   └── demo_execution.log         # Verified test execution log
├── src/
│   ├── clients/                   # AWS Bedrock Converse API integration client
│   ├── middleware/                # MCPSecurityValidator (RBAC & DLP)
│   ├── tools/                     # CloudWatch & Terraform tool modules
│   ├── ui/                        # Interactive Web UI Playground (index.html)
│   └── server.py                  # AWS Lambda & FastAPI server handler
├── terraform/                     # 100% Terraform IaC (API Gateway, IAM, Lambda)
├── tests/                         # Pytest suite & live verification scripts
├── Makefile                       # Lifecycle hooks (make deploy / make destroy / make ui)
└── README.md                      # Project documentation

Quick Start Guide

1. Install Dependencies

make install

2. Run Tests

make test

3. Deploy Infrastructure to AWS

make deploy

Outputs:

  • API Endpoint: Dynamic output generated by Terraform

  • CloudWatch Log Group: /aws/mcp/aws-mcp-enterprise-server-dev

4. Launch Interactive Web UI Playground

make ui

Open http://localhost:8080 in your web browser to test tool calls, RBAC roles, and injection defenses visually!

5. Test via Terminal (curl)

# Health Check
curl -s <YOUR_API_ENDPOINT>/health

# Tool Discovery Catalog
curl -s <YOUR_API_ENDPOINT>/mcp/tools

# Valid Tool Call (CloudWatch Query)
curl -s -X POST <YOUR_API_ENDPOINT>/mcp/tools/call \
  -H "Content-Type: application/json" \
  -H "X-User-Role: sre_read_only" \
  -d '{"tool_name": "query_cloudwatch_logs", "arguments": {"log_group": "/aws/lambda/payment-dev", "filter_pattern": "ERROR"}}'

# Command Injection Attack (Returns 403 Forbidden)
curl -s -X POST <YOUR_API_ENDPOINT>/mcp/tools/call \
  -H "Content-Type: application/json" \
  -H "X-User-Role: sre_read_only" \
  -d '{"tool_name": "query_cloudwatch_logs", "arguments": {"log_group": "/aws/lambda/payment-dev; rm -rf /", "filter_pattern": "ERROR"}}'

6. Tear Down AWS Resources

make destroy

Technical Documentation Links

This server cannot be installed

F
license - not found
Not graded
quality - not tested
B
maintenance

How are these scores calculated?

Maintenance

–Maintainers
–Response time
–Release cycle
–Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

  • MCP2Lambda

    danilop
    A
    license
    B
    quality
    D
    maintenance
    Enables AI models to interact with AWS Lambda functions via the MCP protocol, allowing access to private resources, real-time data, and custom computation in a secure environment.
    2
    109
    MIT

  • AWS Sage

    arunsanna
    A
    license
    Not graded
    quality
    C
    maintenance
    A unified MCP server for AWS that enables natural language infrastructure management, cross-service resource discovery, and dependency mapping. It features 30 intelligent tools for cost optimization, incident investigation, and multi-account operations protected by a robust safety system.
    5
    MIT

  • MCP Airlock

    lara-muhanna
    A
    license
    C
    quality
    D
    maintenance
    Enables secure, zero-trust access to MCP tools through short-lived, signed capability leases that bind tool execution to specific sessions, intents, and constraints. Prevents prompt injection attacks and privilege escalation with dynamic risk scoring, policy enforcement, and tamper-evident audit logging.
    4
    1
    MIT

  • aws-safe-mcp

    harryhazza77
    A
    license
    Not graded
    quality
    C
    maintenance
    A read-only MCP server for safe, structured investigation of AWS serverless resources, providing curated tools for tracing dependencies, permissions, and failures without exposing raw SDK access.
    MIT

View all related MCP servers

Related MCP Connectors

  • copilotcliswitchgate-mcp

    Remote MCP for Copilot CLI switch gate MCP, structured receipts, audit logs, and reviewer-ready evid

  • futureagievals-mcp

    A paid remote MCP for AI SDK eval dashboard, built to return verdicts, receipts, usage logs, and aud

  • clawmanagerfleet-mcp

    A paid remote MCP for ClawManager, built to return verdicts, receipts, usage logs, and audit-ready J

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/patelketul1230/aws-mcp-enterprise-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server