# Create virtual environment
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# Install the package
pip install awslabs.aws-security-posture-advisor

# Clone the repository
git clone https://github.com/timwukp/aws-security-posture-advisor-mcp
cd aws-security-posture-advisor-mcp

# Create virtual environment
python -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate

# Install in development mode
pip install -e .

# Pull the image
docker pull awslabs/aws-security-posture-advisor:latest

# Run with AWS credentials
docker run -e AWS_REGION=us-east-1 \
           -e AWS_ACCESS_KEY_ID=AKIA... \
           -e AWS_SECRET_ACCESS_KEY=your-secret \
           awslabs/aws-security-posture-advisor:latest

# Test server health and readiness
python test_server_status.py

# Run comprehensive test suite (15 test cases)
python run_all_tests.py

# Verify deployment readiness
python verify_deployment.py

# Check AWS credentials and connectivity
aws sts get-caller-identity

# Test AWS security services
python test_assessment.py

# Run actual security assessment (replace with your account ID)
python assess_security.py

# Generate executive security report
python security_recommendations_report.py

# Enable Security Hub
aws securityhub enable-security-hub

# Enable GuardDuty
aws guardduty create-detector --enable

# Enable Config (requires S3 bucket and IAM role)
aws configservice put-configuration-recorder \
    --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/config-role

# Enable Inspector v2
aws inspector2 enable --resource-types ECR EC2

# Configure AWS profile
aws configure --profile security-advisor
AWS Access Key ID [None]: AKIA...
AWS Secret Access Key [None]: ...
Default region name [None]: us-east-1
Default output format [None]: json

# Set environment variable
export AWS_SECURITY_ADVISOR_PROFILE_NAME=security-advisor

# No additional configuration needed
# The server will automatically use the attached IAM role
export AWS_REGION=us-east-1

# Temporary credentials (recommended)
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...  # For temporary credentials
export AWS_REGION=us-east-1

# Or long-term credentials (not recommended for production)
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
export AWS_REGION=us-east-1

# AWS Configuration
export AWS_REGION=us-east-1                                    # AWS region to operate in
export AWS_SECURITY_ADVISOR_PROFILE_NAME=your-profile          # AWS profile name (optional)

# Server Configuration
export AWS_SECURITY_ADVISOR_READ_ONLY=true                     # Enable read-only mode (default: true)
export AWS_SECURITY_ADVISOR_AUDIT_LOGGING=true                 # Enable audit logging (default: true)
export FASTMCP_LOG_LEVEL=INFO                                  # Log level (DEBUG, INFO, WARNING, ERROR)

# Performance Configuration
export AWS_SECURITY_ADVISOR_MAX_CONCURRENT=10                  # Max concurrent AWS API calls
export AWS_SECURITY_ADVISOR_TIMEOUT=300                        # Request timeout in seconds
export AWS_SECURITY_ADVISOR_MAX_RETRIES=3                      # Max retry attempts
export AWS_SECURITY_ADVISOR_BACKOFF_FACTOR=2                   # Exponential backoff factor

# Caching Configuration
export AWS_SECURITY_ADVISOR_ENABLE_CACHE=true                  # Enable response caching
export AWS_SECURITY_ADVISOR_CACHE_TTL=300                      # Cache TTL in seconds
export AWS_SECURITY_ADVISOR_CACHE_SIZE=1000                    # Max cache entries

# Logging Configuration
export AWS_SECURITY_ADVISOR_LOG_TO_FILE=true                   # Enable file logging
export AWS_SECURITY_ADVISOR_LOG_DIR=/var/log/security-advisor  # Log directory
export AWS_SECURITY_ADVISOR_LOG_ROTATION=true                  # Enable log rotation
export AWS_SECURITY_ADVISOR_LOG_MAX_SIZE=100MB                 # Max log file size

# Security Configuration
export AWS_SECURITY_ADVISOR_ENCRYPT_LOGS=true                  # Encrypt log files
export AWS_SECURITY_ADVISOR_SANITIZE_LOGS=true                 # Sanitize sensitive data in logs
export AWS_SECURITY_ADVISOR_REQUIRE_TLS=true                   # Require TLS for all connections

# Create configuration directory
mkdir -p ~/.aws-security-advisor

# Create configuration file
cat > ~/.aws-security-advisor/config.yaml << EOF
aws:
  region: us-east-1
  profile: security-advisor
  
server:
  read_only: true
  audit_logging: true
  log_level: INFO
  
performance:
  max_concurrent: 10
  timeout: 300
  enable_cache: true
  cache_ttl: 300
  
security:
  encrypt_logs: true
  sanitize_logs: true
  require_tls: true
EOF

# Set configuration file path
export AWS_SECURITY_ADVISOR_CONFIG_FILE=~/.aws-security-advisor/config.yaml

# Run all 15 test cases with comprehensive validation
python run_all_tests.py

# Run specific test categories
python test_questions.py          # Structured test scenarios
python test_server_status.py      # Server health validation
python test_functionality.py      # Functionality verification

# Verify deployment readiness
python verify_deployment.py

# Test AWS service connectivity
python test_assessment.py

# Direct server testing
python direct_test.py

# Comprehensive security assessment (replace <AWS_ACCOUNT_ID> with your account)
python assess_security.py

# Real-time assessment with live AWS data
python real_assessment.py

# Advanced security audit
python comprehensive_security_audit.py

# Generate executive security report
python security_recommendations_report.py

# Detailed security review and analysis
python security_review.py

# Code-level security analysis
python code_security_analysis.py

# Test MCP client integration
python mcp_client_test.py

# Use example configuration
cp example_config.json mcp_client_config.json
# Edit with your AWS account details

# Practical usage demonstrations
python usage_example.py

# Minimal server implementation
python minimal_server.py

{
  "server_name": "aws-security-posture-advisor",
  "aws_region": "us-east-1",
  "log_level": "INFO",
  "example_usage": {
    "assess_security_posture": {
      "scope": "account",
      "target": "<YOUR_AWS_ACCOUNT_ID>",
      "frameworks": ["CIS"],
      "severity_threshold": "MEDIUM"
    }
  }
}

# Run directly
awslabs.aws-security-posture-advisor

# Or using Python module
python -m awslabs.aws_security_posture_advisor.server

# With custom configuration
python -m awslabs.aws_security_posture_advisor.server --config config.yaml

{
  "mcpServers": {
    "aws-security-posture-advisor": {
      "command": "awslabs.aws-security-posture-advisor",
      "env": {
        "AWS_REGION": "us-east-1",
        "FASTMCP_LOG_LEVEL": "INFO"
      },
      "disabled": false,
      "autoApprove": ["health_check", "get_server_info"]
    }
  }
}

{
  "mcpServers": {
    "aws-security-posture-advisor": {
      "command": "awslabs.aws-security-posture-advisor",
      "env": {
        "AWS_REGION": "us-east-1"
      }
    }
  }
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "securityhub:GetFindings",
        "securityhub:DescribeStandards",
        "securityhub:GetInsights",
        "guardduty:GetFindings",
        "guardduty:ListDetectors",
        "guardduty:GetDetector",
        "config:GetComplianceDetailsByConfigRule",
        "config:DescribeConfigRules",
        "config:GetResourceConfigHistory",
        "inspector2:ListFindings",
        "inspector2:GetFindings",
        "cloudtrail:LookupEvents",
        "macie2:GetFindings",
        "macie2:DescribeClassificationJob",
        "sts:GetCallerIdentity"
      ],
      "Resource": "*"
    }
  ]
}

git clone https://github.com/awslabs/aws-security-posture-advisor-mcp
cd aws-security-posture-advisor-mcp

# Install development dependencies
pip install -e ".[dev]"

# Run tests
pytest

# Run linting
ruff check .
black --check .
mypy .

aws-security-posture-advisor-mcp/
├── awslabs/
│   └── aws_security_posture_advisor/
│       ├── __init__.py
│       ├── server.py                    # Main FastMCP server
│       └── core/
│           ├── aws/                     # AWS service integrations
│           ├── common/                  # Common utilities and models
│           ├── intelligence/            # Risk correlation & compliance engines
│           └── kb/                      # Knowledge base
├── tests/                               # Pytest unit tests
│   ├── conftest.py                     # Shared fixtures
│   ├── test_models.py                  # Data model tests
│   ├── test_errors.py                  # Error handling tests
│   ├── test_cache.py                   # Caching system tests
│   ├── test_intelligence.py            # Intelligence engine tests
│   └── test_security.py               # Security module tests
├── scripts/                             # Utility and assessment scripts
├── examples/                            # Usage examples and configs
├── docs/                                # Documentation
│   ├── API.md
│   ├── SECURITY.md
│   └── TROUBLESHOOTING.md
├── Dockerfile                           # Multi-stage production build
├── docker-compose.yml                   # Container orchestration
├── pyproject.toml                       # Project configuration
└── README.md                           # This file

# Clone and setup development environment
git clone https://github.com/timwukp/aws-security-posture-advisor-mcp
cd aws-security-posture-advisor-mcp

# Create virtual environment
python -m venv .venv
source .venv/bin/activate

# Install in development mode
pip install -e ".[dev]"

# Run tests
pytest

# Run linting and formatting
ruff check .
black --check .
mypy .