如何安装 Aws Security？

在本页复制适用于 Cursor、Claude Desktop、Claude Code 或 VS Code 的 stdio 配置。它使用发布者的安装方式，而不是 PlugMCP 代理。

Aws Security 需要 API 密钥吗？

此记录未列出必需的环境变量。

Aws Security 使用哪种传输方式？

Aws Security 通过 stdio 在本地运行。

Aws Security MCP 服务器 | PlugMCP

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CrossAccountAccess",
      "Effect": "Allow",
      "Action": [
        "sts:AssumeRole"
      ],
      "Resource": "arn:aws:iam::*:role/aws-security-mcp-cross-account-access"
    },
    {
      "Sid": "OrganizationDiscovery",
      "Effect": "Allow",
      "Action": [
        "organizations:ListAccounts"
      ],
      "Resource": "*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AthenaQueryExecution",
      "Effect": "Allow",
      "Action": [
        "athena:BatchGetQueryExecution",
        "athena:GetQueryExecution",
        "athena:GetQueryResults",
        "athena:GetWorkGroup",
        "athena:GetTableMetadata",
        "athena:ListQueryExecutions",
        "athena:StartQueryExecution",
        "athena:GetQueryResultsStream",
        "athena:GetDataCatalog",
        "athena:ListDataCatalogs",
        "athena:ListDatabases",
        "athena:ListTableMetadata"
      ],
      "Resource": "*"
    },
    {
      "Sid": "GlueCatalogAccess",
      "Effect": "Allow",
      "Action": [
        "glue:GetDatabase",
        "glue:GetDatabases",
        "glue:GetTable",
        "glue:GetTables",
        "glue:GetPartition",
        "glue:GetPartitions",
        "glue:BatchGetPartition"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3LogDataAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::your-cloudtrail-bucket/*",
        "arn:aws:s3:::your-cloudtrail-bucket",
        "arn:aws:s3:::your-vpc-flow-logs-bucket/*",
        "arn:aws:s3:::your-vpc-flow-logs-bucket",
        "arn:aws:s3:::your-security-logs-bucket/*",
        "arn:aws:s3:::your-security-logs-bucket"
      ]
    },
    {
      "Sid": "AthenaResultsAccess",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::your-athena-results-bucket/*",
        "arn:aws:s3:::your-athena-results-bucket"
      ]
    }
  ]
}

Policy ARN: arn:aws:iam::aws:policy/SecurityAudit

aws:
  region: "us-east-1"
  profile: {profileName}
  .
  .
  .

aws sso

$ aws configure sso
SSO Session Name - [email protected]
URL - https://yourDomain.awsapps.com/start/#
Region - us-east-1

env variabls

export AWS_ACCESS_KEY_ID=
export export AWS_SECRET_ACCESS_KEY=
export export AWS_SESSION_TOKEN=

Run the following commands

git clone https://github.com/groovyBugify/aws-security-mcp.git
uv venv
source .venv/bin/activate
uv pip install -r requirements.txt

Configure MCP Client

# Install mcp-proxy
uv tool install mcp-proxy

# Check location of mcp-proxy
which mcp-proxy

# Add to Claude Desktop config
{
  "mcpServers": {
    "aws-security": {
      "command": "/path/to/mcp-proxy",
      "args": ["http://localhost:8000/sse"]
    }
  }
}

$ aws ecr get-login-password --region {region} | docker login --username AWS --password-stdin {accountID}.dkr.ecr.{region}.amazonaws.com

$ aws ecr create-repository --repository-name aws-security-mcp --region {region}

$ cd aws-security-mcp/
$ docker buildx build --platform linux/amd64 -t aws-security-mcp .
$ docker tag aws-security-mcp:latest {accountID}.dkr.ecr.{region}.amazonaws.com/aws-security-mcp:latest
$ docker push {accountID}.dkr.ecr.{region}.amazonaws.com/aws-security-mcp:latest

Deploying as AWS ECS Service
- Create a Task Definition with "2048" CPU and "4096" Memory, this is optional, you can choose any values
- Configure the Task definition to do port mapping for port 8000
- Create ECS Task Role with the following permissions
  - SecurityAudit IAM Policy
  - Athena Access (Policy mentioned above)
  - STS Assume Role permissions to assume cross account roles
- Create ECS Task Execution Role with basic permissions
- Once the Task Definition is completed.
- Create an AWS ECS Service using the Task definition
  - You can configure Load Balancer as well
  - Make Sure to turn off the Stickness Session on Load Balancers
- Register the ALB's taget group and listeners for port 80/443 -> ECS Service(8000)
- Register the ALB for Route53 domain.

Configure MCP Client

# Install mcp-proxy
uv tool install mcp-proxy

# Check location of mcp-proxy
which mcp-proxy

# Add to Claude Desktop config
{
  "mcpServers": {
    "aws-security": {
      "command": "/path/to/mcp-proxy",
      "args": ["http://{alb}/sse"]
    }
  }
}

aws:
  region: "us-east-1"
  profile: null

server:
  log_level: "info"
  startup_quiet: false
  tool_quiet: false

cross_account:
  role_name: "aws-security-mcp-cross-account-access"
  auto_setup_on_startup: true
  max_concurrent_assumptions: 5

export MCP_LOG_LEVEL=debug
export MCP_STARTUP_QUIET=false
export AWS_DEFAULT_REGION=eu-west-1

Query: "Can you share a list of running ec2 instances?"

Query: "Share all the secrets stored on env variables of Lambda functions, and share a list of functions for remediating this issue."

Query: "Check my 'prod-ecs-cluster' and share more details about the 'user-login' service, is it deployed?"

Query: "Show all GuardDuty findings from the last 7 days, and priortise based on the risk of exposure."

Query: "Analyze IAM roles with administrative privileges"

Query: "Generate blast radius analysis for IP 172.16.1.10"

Query: "Fetch more details about the ip - 172.22.141.11, and share a network map for this resource.

Query: "List all connected AWS accounts"
Query: "Refresh my AWS session"
Query: "Find resources tagged Team:Security across all accounts"
Query: "Show compliance status across organization"

{
"Version": "2012-10-17",
"Statement": [
 {
   "Effect": "Allow",
   "Principal": {
     "AWS": "arn:aws:iam::YOUR-MASTER-ACCOUNT-ID:root"
   },
   "Action": "sts:AssumeRole"
    }
]
}

Query: "Show all failed login attempts from external IPs in the last 24 hours"

Query: "Can you share what did '[email protected]' did in past 24 hours on my aws account? and share a timeline report?"

Query: "Can you check for all the 'Access Denied/Error/Forbidden' on my PCI(123456789012) aws account and share the username and userIP of the principal, and do a reverse IP checkup if this IP is coming from my own AWS Org or external party."

Query: "Correlate GuardDuty findings with CloudTrail and VPC Flow logs events"

Service	Capabilities
IAM	Users, roles, policies, access keys, permission analysis
EC2	Instances, security groups, VPCs, subnets, network interfaces
S3	Buckets, permissions, public access analysis
GuardDuty	Findings, detectors, threat intelligence
SecurityHub	Findings, compliance standards, security scores
Lambda	Functions, permissions, configurations, triggers
CloudFront	Distributions, origins, behaviors, security policies
ELB/ALB/NLB	Load balancers, target groups, listeners, health checks
Route53	Hosted zones, DNS records, health checks
WAF	Web ACLs, rules, rate limiting
Shield	DDoS protection status and metrics
Access Analyzer	IAM access analysis and findings
ECS/ECR	Container services, repositories, image scanning
Organizations	Account structure, SCPs, organizational units
Athena	Log analysis, security event correlation

server:
  host: "0.0.0.0"
  log_level: "error"
  startup_quiet: true
  tool_quiet: true
  minimal_logging: true

cross_account:
  max_concurrent_assumptions: 10
  session_duration_seconds: 7200

FROM python:3.11-slim
WORKDIR /app
COPY . .
RUN pip install -r requirements.txt
EXPOSE 8000
CMD ["python", "aws_security_mcp/main.py", "sse"]

docker build -t aws-security-mcp .
docker run -p 8000:8000 \
  -e AWS_ACCESS_KEY_ID=your_key \
  -e AWS_SECRET_ACCESS_KEY=your_secret \
  aws-security-mcp

# Check AWS credentials
aws sts get-caller-identity

# Verify cross-account role exists
aws iam get-role --role-name aws-security-mcp-cross-account-access

# Test role assumption manually
aws sts assume-role \
  --role-arn arn:aws:iam::TARGET-ACCOUNT:role/aws-security-mcp-cross-account-access \
  --role-session-name test-session

# Reduce concurrent operations
cross_account:
  max_concurrent_assumptions: 3
  
# Enable minimal logging
server:
  minimal_logging: true

export MCP_LOG_LEVEL=debug
export MCP_STARTUP_QUIET=false
python3 aws_security_mcp/main.py sse

Aws Security

Q: Aws Security 需要 API 密钥吗？

此记录未列出必需的环境变量。

Q: Aws Security 上次检查是什么时候？

上次检查时间：2026-10-27。 A Model Context Protocol server that connects AI assistants like Claude to AWS security services, allowing them to autonomously query, inspect, and analyze AWS infrastructure for security issues and misconfigurations.

groovyBugify84 个星标

A Model Context Protocol server that connects AI assistants like Claude to AWS security services, allowing them to autonomously query, inspect, and analyze AWS infrastructure for security issues and m

Cloud Infrastructure Security

安装在 PlugMCP 上运行认领此服务器

GitHub

在 PlugMCP 上运行

1# Aws Security

README.mdMCP 服务器

传输方式: stdio
状态: 本地

添加此服务器

用我们的密钥与日志托管一份副本。

服务器信息

文档

AWS Security MCP

Overview

Key Capabilities

Prerequisites

AWS Requirements

Core MCP Permissions

Athena Integration Permissions

Required AWS Managed Policies

Important Notes

Quick Start ~ local setup

Quick Start ~ as AWS ECS Service

Configuration

YAML Configuration

Environment Variable Override

Usage Examples

Basic Infrastructure Queries

Security Analysis

Cross-Account Operations

Architecture

Cross-Account Access

Required IAM Role Setup

Athena Integration

Overview

Supported Log Types

Query Capabilities

Setup Prerequisites

Supported AWS Services

Currently Available

Planned Additions

Advanced Configuration

Production Deployment

Docker Deployment

Load Balancer Configuration

Troubleshooting

Common Issues

Debug Mode

License

Support

关于 Aws Security

工具

问题

如何安装 Aws Security？

Aws Security 需要 API 密钥吗？

Aws Security 使用哪种传输方式？

Aws Security 上次检查是什么时候？