Skip to main content

AWS Well-Architected Security Assessment Tool MCP ServerAWS Well-Architected 安全评估工具 MCP 服务器

AWS Well-Architected Security Assessment Tool MCP Server

PyPI version

A Model Context Protocol (MCP) server that provides operational tools for monitoring and assessing AWS environments against the AWS Well-Architected Framework Security Pillar. This server enables AI assistants to help operations teams evaluate security posture, monitor compliance status, and optimize security costs while maintaining operational excellence according to the Well-Architected Framework.这是一个模型上下文协议 (MCP) 服务器，提供用于根据 AWS Well-Architected 框架安全支柱监控和评估 AWS 环境的运维工具。该服务器使 AI 助手能够协助运维团队评估安全态势、监控合规状态，并在遵循 Well-Architected 框架的同时优化安全成本，从而维持卓越的运维水平。

Features​

  • Operational Security Monitoring: Monitor status of AWS security services (GuardDuty, Security Hub, Inspector, IAM Access Analyzer) across your infrastructure运维安全监控：监控基础设施中各 AWS 安全服务（GuardDuty、Security Hub、Inspector、IAM Access Analyzer）的状态
  • Security Operations Dashboard: Retrieve and analyze security findings from AWS services for operational visibility安全运维仪表板：检索并分析来自 AWS 服务的安全发现，以实现运维可见性
  • Compliance Operations: Continuously assess security posture against Well-Architected Framework for operational compliance合规运维：持续根据 Well-Architected 框架评估安全态势，以确保运维合规性
  • Resource Operations: Discover and monitor AWS resources across multiple services and regions for security operations资源运维：为安全运维发现并监控跨多个服务和区域的 AWS 资源
  • Cost-Effective Data Protection: Monitor storage configuration for encryption compliance while optimizing security costs高性价比的数据保护：监控存储配置的加密合规性，同时优化安全成本
  • Network Operations Security: Verify network configuration for encryption compliance in operational environments网络运维安全：验证运维环境中网络配置的加密合规性
  • Compliance Monitoring: Monitor compliance status of AWS resources against security standards for operational reporting合规监控：监控 AWS 资源针对安全标准的合规状态，以进行运维报告
  • Security Operations Context: Access stored security context data for operational analysis and trending安全运维上下文：访问存储的安全上下文数据，用于运维分析和趋势追踪

Operations teams can use the CheckSecurityServices tool to monitor if critical AWS security services are operational across their infrastructure. The GetSecurityFindings tool provides operational visibility into security findings, while AnalyzeSecurityPosture delivers comprehensive security operations reporting against the Well-Architected Framework. The ExploreAwsResources tool provides operational inventory capabilities across services and regions to ensure complete operational visibility and cost optimization of the AWS environment.运维团队可以使用 CheckSecurityServices 工具来监控基础设施中关键 AWS 安全服务的运行状态。GetSecurityFindings 工具提供对安全发现的运维可见性，而 AnalyzeSecurityPosture 则根据 Well-Architected 框架提供全面的安全运维报告。ExploreAwsResources 工具提供跨服务和区域的运维资产清查功能，以确保 AWS 环境的完整运维可见性和成本优化。

Installation​

# Install using uv
uv pip install awslabs.well-architected-security-mcp-server

# Or install using pip
pip install awslabs.well-architected-security-mcp-server

You can also run the MCP server directly from a local clone of the GitHub repository:您也可以直接从 GitHub 仓库的本地克隆版本运行此 MCP 服务器：

# Clone the awslabs repository
git clone https://github.com/awslabs/mcp.git

# Run the server directly using uv
uv --directory /path/to/well-architected-security-mcp-server/src/well-architected-security-mcp-server/awslabs/well_architected_security_mcp_server run server.py

Usage Environments​

The AWS Well-Architected Security Assessment Tool MCP Server is designed for operational use across the following environments:AWS Well-Architected 安全评估工具 MCP 服务器旨在用于以下环境的运维工作：

  • Production Operations: Monitor security posture and compliance status in production environments for operational excellence.生产运维：监控生产环境中的安全态势和合规状态，以实现卓越运维。
  • Compliance Operations: Perform ongoing compliance monitoring and reporting for regulatory and internal requirements.合规运维：针对监管和内部要求执行持续的合规监控与报告。
  • Security Operations Center (SOC): Integrate with SOC workflows for continuous security monitoring and incident response.安全运营中心 (SOC)：与 SOC 工作流程集成，进行持续的安全监控和事件响应。
  • Cost Optimization: Monitor security service costs and optimize security spending while maintaining compliance.成本优化：在保持合规的同时，监控安全服务成本并优化安全支出。
  • Operational Reporting: Generate security operations reports and dashboards for stakeholders and management.运维报告：为利益相关者和管理层生成安全运维报告和仪表板。

Operational Considerations:运维注意事项：

  • Automated Remediation: While the tool provides operational visibility, automated remediation should be implemented through separate operational workflows.自动修复：虽然该工具提供了运维可见性，但自动修复应通过独立的运维工作流程来实现。
  • Monitoring Integration: Designed for integration with existing monitoring and alerting systems for comprehensive operational coverage.监控集成：旨在与现有的监控和告警系统集成，以实现全面的运维覆盖。

Important Note on Security Data: When connecting to any environment, especially production, always prevent accidental exposure of sensitive security information.关于安全数据的重要说明：在连接任何环境（尤其是生产环境）时，请务必防止敏感安全信息的意外泄露。

Operational Deployment Considerations​

The AWS Well-Architected Security Assessment Tool MCP Server is designed for operational deployment across various environments with appropriate operational controls.AWS Well-Architected 安全评估工具 MCP 服务器旨在通过适当的运维控制在各种环境中进行运维部署。

Operational Use Cases​

The tool is well-suited for operational deployment in the following scenarios:该工具非常适合在以下场景中进行运维部署：

  1. Security Operations Monitoring: Continuous monitoring of security posture and compliance status安全运维监控：持续监控安全态势和合规状态
  2. Operational Compliance Reporting: Regular compliance verification and reporting workflows运维合规报告：定期的合规验证和报告工作流程
  3. Cost Operations: Monitoring security service costs and optimizing security spending成本运维：监控安全服务成本并优化安全支出
  4. Operational Dashboards: Integration with operational dashboards and monitoring systems运维仪表板：与运维仪表板和监控系统集成

Operational Best Practices​

For optimal operational deployment:为了实现最佳的运维部署：

  1. Rate Limiting: Implement appropriate rate limiting to avoid impacting AWS API limits速率限制：实施适当的速率限制，以避免影响 AWS API 的限制额度
  2. Monitoring Integration: Integrate with existing operational monitoring and alerting systems监控集成：与现有的运维监控和告警系统集成
  3. Access Controls: Implement proper IAM controls and operational access patterns访问控制：实施正确的 IAM 控制和运维访问模式
  4. Cost Monitoring: Monitor API costs and optimize query patterns for cost efficiency成本监控：监控 API 成本并优化查询模式以提高成本效率

Configuration​

KiroCursorVS Code
Add to KiroInstall MCP ServerInstall on VS Code

Add the AWS Well-Architected Security Assessment Tool MCP Server to your MCP client configuration:将 AWS Well-Architected 安全评估工具 MCP 服务器添加到您的 MCP 客户端配置中：

{
  "mcpServers": {
    "well-architected-security-mcp-server": {
      "command": "uvx",
      "args": ["--from", "awslabs.well-architected-security-mcp-server", "well-architected-security-mcp-server"],
      "env": {
        "AWS_PROFILE": "your-aws-profile", // Optional - uses your local AWS configuration if not specified
        "AWS_REGION": "your-aws-region", // Optional - uses your local AWS configuration if not specified
        "FASTMCP_LOG_LEVEL": "ERROR"
      }
    }
  }
}

If running from a local repository, configure the MCP client like this:如果从本地仓库运行，请按如下方式配置 MCP 客户端：

{
  "mcpServers": {
    "well-architected-security-mcp-server": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/well-architected-security-mcp-server/src/well-architected-security-mcp-server/awslabs/well_architected_security_mcp_server",
        "run",
        "server.py"
      ],
      "env": {
        "AWS_PROFILE": "your-aws-profile",
        "AWS_REGION": "your-aws-region",
        "FASTMCP_LOG_LEVEL": "DEBUG"
      }
    }
  }
}

Security Controls​

The AWS Well-Architected Security Assessment Tool MCP Server includes security controls in your MCP client configuration to limit access to sensitive data:AWS Well-Architected 安全评估工具 MCP 服务器在您的 MCP 客户端配置中包含安全控制，以限制对敏感数据的访问：

IAM Best Practices​

We strongly recommend creating dedicated IAM roles with least-privilege permissions when using the AWS Well-Architected Security Assessment Tool MCP Server:在使用 AWS Well-Architected 安全评估工具 MCP 服务器时，我们强烈建议创建具有最小权限的专用 IAM 角色：

  1. Create a dedicated IAM role specifically for security assessment operations专门为安全评估运维创建一个专用 IAM 角色
  2. Apply least-privilege permissions by attaching only the necessary read-only policies仅附加必要的只读策略以应用最小权限原则
  3. Use scoped-down resource policies whenever possible尽可能使用范围受限的资源策略
  4. Apply a permission boundary to limit the maximum permissions应用权限边界以限制最大权限

For detailed example IAM policies tailored for security assessment use cases, see the AWS documentation for each security service being analyzed.有关针对安全评估用例定制的详细 IAM 策略示例，请参阅所分析的每项 AWS 服务的 AWS 文档。

MCP Tools​

Security Operations Tools​

These operational tools help you monitor and manage your AWS security posture against the Well-Architected Framework Security Pillar.这些运维工具可帮助您根据 Well-Architected 框架安全支柱监控和管理您的 AWS 安全态势。

  • CheckSecurityServices: Monitor AWS security services operational statusCheckSecurityServices：监控 AWS 安全服务的运维状态

    • Monitors operational status of GuardDuty, Security Hub, Inspector, and IAM Access Analyzer监控 GuardDuty、Security Hub、Inspector 和 IAM Access Analyzer 的运维状态
    • Identifies service availability across regions for operational visibility确定跨区域的服务可用性以实现运维可见性
    • Provides operational recommendations for maintaining security service coverage提供有关维持安全服务覆盖范围的运维建议

  • GetSecurityFindings: Operational security findings retrievalGetSecurityFindings：运维安全发现检索

    • Collects operational security findings from Security Hub, GuardDuty, and Inspector从 Security Hub、GuardDuty 和 Inspector 收集运维安全发现
    • Filters findings for operational prioritization by severity, resource type, or service按严重性、资源类型或服务筛选发现，以便进行运维优先级排序
    • Provides operational context and cost-effective remediation guidance提供运维上下文和具有成本效益的修复指导

  • GetResourceComplianceStatus: Operational compliance monitoringGetResourceComplianceStatus：运维合规监控

    • Monitors resources against security standards for operational compliance根据安全标准监控资源，以实现运维合规性
    • Identifies non-compliant resources for operational remediation workflows识别不合规资源，以便进行运维修复工作流程
    • Provides compliance metrics and operational improvement recommendations提供合规性指标和运维改进建议

  • GetStoredSecurityContext: Historical security operations dataGetStoredSecurityContext：历史安全运维数据

    • Retrieves historical security operations data for trend analysis检索历史安全运维数据以进行趋势分析
    • Enables operational comparison of security posture over time支持随时间推移对安全态势进行运维比较
    • Provides operational context for security findings and cost optimization为安全发现和成本优化提供运维上下文

  • ExploreAwsResources: Operational resource inventoryExploreAwsResources：运维资源清单

    • Discovers resources across AWS services for operational visibility发现跨 AWS 服务的资源以实现运维可见性
    • Maps resource relationships for operational security context映射资源关系以提供运维安全上下文
    • Identifies resources requiring operational security attention识别需要运维安全关注的资源

  • AnalyzeSecurityPosture: Comprehensive security operations analysisAnalyzeSecurityPosture：全面的安全运维分析

    • Evaluates operational security posture against Well-Architected Framework根据 Well-Architected 框架评估运维安全态势
    • Provides operational recommendations for security improvements and cost optimization提供有关安全改进和成本优化的运维建议
    • Generates operational security metrics and prioritized action items生成运维安全指标和优先行动项

Example Prompts​

Security Operations Monitoring​

  • "Monitor the operational status of AWS security services across my account"“监控我账户中 AWS 安全服务的运维状态”
  • "Generate an operational security report against the Well-Architected Security Pillar"“根据 Well-Architected 安全支柱生成一份运维安全报告”
  • "Show me current security findings that require operational attention"“向我展示当前需要运维关注的安全发现”
  • "Monitor encryption compliance across my S3 buckets for operational reporting"“监控我的 S3 存储桶的加密合规性，以进行运维报告”
  • "Verify network encryption compliance for operational security standards"“验证网络加密合规性以符合运维安全标准”

Operational Resource Management​

  • "Provide an operational inventory of all resources in my AWS account"“提供我 AWS 账户中所有资源的运维清单”
  • "Identify resources with security issues that need operational attention"“识别需要运维关注的安全问题的资源”
  • "List all EC2 instances across regions for security operations review"“列出跨区域的所有 EC2 实例，以进行安全运维审查”
  • "Monitor which resources are not compliant with operational security standards"“监控哪些资源不符合运维安全标准”

Security Operations Analysis​

  • "Analyze operational security posture against Well-Architected best practices"“根据 Well-Architected 最佳实践分析运维安全态势”
  • "What security improvements should operations prioritize for cost optimization?"“运维部门应优先考虑哪些安全改进以实现成本优化？”
  • "Compare current security operations metrics with last month's operational baseline"“将当前的安全运维指标与上个月的运维基准进行比较”
  • "Generate an operational security dashboard for management reporting"“生成用于管理层报告的运维安全仪表板”
  • "Monitor security service costs and recommend optimization opportunities"“监控安全服务成本并推荐优化机会”

Requirements​

  • Python 3.10+Python 3.10+
  • AWS credentials with read-only permissions for security services具有安全服务只读权限的 AWS 凭证
  • AWS CLI configured with appropriate profiles (optional)已配置适当配置文件的 AWS CLI（可选）

Testing​

The AWS Well-Architected Security Assessment Tool MCP Server includes a comprehensive test suite to ensure functionality and reliability. The tests are organized by module and use pytest with mocks to avoid making actual AWS API calls.AWS Well-Architected 安全评估工具 MCP 服务器包含一套全面的测试套件，以确保功能和可靠性。测试按模块组织，并使用 pytest 和模拟 (mock) 来避免进行实际的 AWS API 调用。

Test Structure​

  • test_prompt_utils.py: Tests for prompt template utilitiestest_prompt_utils.py：提示模板工具的测试
  • test_resource_utils.py: Tests for AWS resource operationstest_resource_utils.py：AWS 资源运维的测试
  • test_storage_security.py: Tests for storage encryption checkstest_storage_security.py：存储加密检查的测试
  • test_network_security.py: Tests for network security checkstest_network_security.py：网络安全检查的测试
  • test_security_services.py: Tests for AWS security servicestest_security_services.py：AWS 安全服务的测试

Running Tests​

The easiest way to run all tests is to use the provided script:运行所有测试最简单的方法是使用提供的脚本：

# Make the script executable if needed
chmod +x run_tests.sh

# Run the tests
./run_tests.sh

This script will:该脚本将：

  1. Install required dependencies (pytest, pytest-asyncio, pytest-cov)安装所需的依赖项 (pytest, pytest-asyncio, pytest-cov)
  2. Run all tests with coverage reporting运行所有测试并生成覆盖率报告

For more detailed information about testing, see the tests/README.md file in the project repository.有关测试的更多详细信息，请参阅项目仓库中的 tests/README.md 文件。

License​

This project is licensed under the Apache License, Version 2.0.本项目采用 Apache License 2.0 版本协议授权。