☁️ 技術調査 - AWS MCP Server

# uv のインストール (macOS / Linux)
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

# 起動確認
uvx mcp-proxy-for-aws@latest --help

git clone https://github.com/aws/mcp-proxy-for-aws.git
cd mcp-proxy-for-aws
uv run mcp_proxy_for_aws/server.py https://aws-mcp.us-east-1.api.aws/mcp

docker pull public.ecr.aws/mcp-proxy-for-aws/mcp-proxy-for-aws:latest

uvx mcp-proxy-for-aws@latest --version

aws login
# ブラウザが開きマネジメントコンソールと同じ認証情報でサインイン。最大 12 時間有効

aws configure sso
aws sso login --profile my-sso-profile
aws sts get-caller-identity --profile my-sso-profile

aws configure
# 90 日ごとのローテーションが必要。自動更新なし

# ~/.aws/config
[profile my-role]
role_arn = arn:aws:iam::123456789012:role/MyRole
source_profile = default
region = us-east-1

uvx mcp-proxy-for-aws@latest https://aws-mcp.us-east-1.api.aws/mcp \
  --profile my-role \
  --metadata AWS_REGION=ap-northeast-1

{
  "mcpServers": {
    "aws-mcp": {
      "command": "uvx",
      "args": [
        "mcp-proxy-for-aws@latest",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata", "AWS_REGION=ap-northeast-1"
      ]
    }
  }
}

claude mcp add-json aws-mcp --scope user \
  '{"command":"uvx","args":["mcp-proxy-for-aws@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=ap-northeast-1"]}'

{
  "mcpServers": {
    "aws-mcp": {
      "command": "uvx",
      "args": [
        "mcp-proxy-for-aws@latest",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata", "AWS_REGION=ap-northeast-1"
      ]
    }
  }
}

{
  "mcpServers": {
    "aws-mcp": {
      "command": "uvx",
      "timeout": 100000,
      "transport": "stdio",
      "args": [
        "mcp-proxy-for-aws@latest",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata", "AWS_REGION=ap-northeast-1"
      ]
    }
  }
}

[mcp_servers.aws_mcp]
command = "uvx"
args = [
  "mcp-proxy-for-aws@latest",
  "https://aws-mcp.us-east-1.api.aws/mcp",
  "--metadata", "AWS_REGION=ap-northeast-1"
]
startup_timeout_sec = 60

/tools
/mcp

{
  "tool": "aws___call_aws",
  "arguments": {
    "service": "s3",
    "operation": "list_buckets",
    "region": "ap-northeast-1"
  }
}

{
  "tool": "aws___search_documentation",
  "arguments": {
    "query": "S3 bucket policy configuration",
    "topic": "s3"
  }
}

{
  "tool": "aws___run_script",
  "arguments": {
    "code": "import boto3\nfor region in ['ap-northeast-1', 'us-east-1']:\n    client = boto3.client('lambda', region_name=region)\n    resp = client.list_functions()\n    print(f'{region}: {len(resp[\"Functions\"])} functions')"
  }
}

{
  "tool": "aws___get_tasks",
  "arguments": {
    "task_id": "<前の呼び出しで返された task_id>"
  }
}

{
  "Effect": "Deny",
  "Action": [
    "s3:DeleteBucket",
    "s3:DeleteObject",
    "ec2:TerminateInstances",
    "rds:DeleteDBInstance"
  ],
  "Resource": "*",
  "Condition": {
    "Bool": {
      "aws:ViaAWSMCPService": "true"
    }
  }
}

{
  "Effect": "Deny",
  "Action": ["s3:DeleteBucket", "s3:DeleteObject"],
  "Resource": "*",
  "Condition": {
    "StringEquals": {
      "aws:CalledViaAWSMCP": "aws-mcp.amazonaws.com"
    }
  }
}

uvx mcp-proxy-for-aws@latest \
  https://aws-mcp.us-east-1.api.aws/mcp \
  --read-only \
  --metadata AWS_REGION=ap-northeast-1

-- 直近 24 時間の MCP ツール呼び出し
SELECT
  eventtime,
  json_extract_scalar(requestparameters, '$.method') AS tool_name,
  json_extract_scalar(mcpeventdetails, '$.sessionId') AS session_id,
  json_extract_scalar(mcpeventdetails, '$.executionTimeMs') AS exec_ms,
  readonly
FROM cloudtrail_logs
WHERE eventsource = 'aws-mcp.us-east-1.api.aws'
  AND eventname = 'CallTool'
  AND eventtime > date_add('hour', -24, now())
ORDER BY eventtime DESC;

-- 書き込み操作のみ抽出
SELECT eventtime, useridentity,
       json_extract_scalar(requestparameters, '$.method') AS tool_name
FROM cloudtrail_logs
WHERE eventsource = 'aws-mcp.us-east-1.api.aws'
  AND readonly = false
ORDER BY eventtime DESC;

McpHighErrorRateAlarm:
  Type: AWS::CloudWatch::Alarm
  Properties:
    AlarmName: aws-mcp-high-error-rate
    Namespace: AWS-MCP
    MetricName: ToolErrorRate
    Statistic: Average
    Period: 300
    EvaluationPeriods: 2
    Threshold: 5
    ComparisonOperator: GreaterThanThreshold
    TreatMissingData: notBreaching

# ツール起動ごとに sessionId を RoleSessionName に埋め込む例
sts.assume_role(
    RoleArn='arn:aws:iam::111122223333:role/AgentDataRole',
    RoleSessionName=f'agent-{mcp_session_id[:28]}',
    Tags=[
        {'Key': 'McpSessionId', 'Value': mcp_session_id},
        {'Key': 'AccessType',   'Value': 'AI'},
    ]
)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyDestructiveViaMCP",
      "Effect": "Deny",
      "Action": [
        "s3:DeleteBucket",
        "s3:DeleteObject",
        "ec2:TerminateInstances",
        "rds:DeleteDBInstance",
        "iam:DeleteUser",
        "iam:DeleteRole"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "aws:CalledViaAWSMCP": "aws-mcp.amazonaws.com"
        }
      }
    }
  ]
}

{
  "Sid": "AgentRoleMcpOnly",
  "Effect": "Deny",
  "Action": "*",
  "Resource": "*",
  "Condition": {
    "ArnLike": {
      "aws:PrincipalArn": "arn:aws:iam::*:role/AgentRole-*"
    },
    "Bool": {
      "aws:ViaAWSMCPService": "false"
    }
  }
}

{
  "Sid": "AgentMaxPermissions",
  "Effect": "Allow",
  "Action": [
    "ec2:Describe*",
    "s3:Get*",
    "s3:List*",
    "cloudwatch:Get*",
    "cloudwatch:List*",
    "logs:Describe*",
    "logs:Get*",
    "logs:Filter*"
  ],
  "Resource": "*"
}

[クライアント設定]
  --read-only フラグ → ツールレベルの第一防衛線

[IAM ポリシー (エージェント用ロール)]
  ReadOnlyAccess + 削除/書き込み系の明示 Deny → 認可レベルの最終防衛線

Phase 1: sandbox (検証環境)
  - エージェント用 IAM Role を新設
  - Permission Boundary で *Read* / *Describe* / *List* 系に限定
  - Claude Code から call_aws で動作確認
  - CloudTrail で eventSource=aws-mcp.* が記録されることを確認

Phase 2: staging
  - Permission Boundary を「read 全部 + 限定的 write」に拡張
  - aws:ViaAWSMCPService=true を Condition に明示した Deny ポリシー追加
  - SCP で「AgentRole は MCP 経由のみ」を強制
  - sessionId と CloudTrail の突合をインシデントドリルで確認

Phase 3: 本番 (限定スコープ)
  - IaC / 監査 / ドキュメント検索系から先行導入
  - run_script は stable な集計・ヘルスチェックから
  - プロンプト全文ログを Claude Code 側でローテーション保存し S3 に転送
  - 破壊的操作は Step Functions / Lambda 型に留置

問題の構造:
  エージェントが bash で aws s3 ls を実行
  → aws:ViaAWSMCPService = (付与されない)
  → IAM Deny ポリシーの "StringEquals aws:CalledViaAWSMCP" が不一致
  → Deny が発火せず通過

対処の優先順位:
  1. MCP クライアントの tool permission 設定で bash を除外する (最優先)
  2. SCP で "AgentRole は ViaAWSMCPService=false で Deny" を組織レベルで強制
  3. bash が除外できない場合は Session Policy で AssumeRole ごとに権限を絞る

# run_script でページネーション制御する例
import boto3

client = boto3.client('ec2', region_name='ap-northeast-1')
paginator = client.get_paginator('describe_instances')
results = []
for page in paginator.paginate(PaginationConfig={'MaxItems': 20, 'PageSize': 10}):
    for reservation in page['Reservations']:
        results.extend(reservation['Instances'])
    if len(results) >= 20:
        break
print(f"取得件数: {len(results)}")

入力層:
  - 処理対象テキストに「aws」「cli」「execute」「run」を含む疑わしい命令形を検出
  - 外部 URL / ファイル / Issue 本文は要約してから渡す

IAM 層:
  - 削除/変更系 API を aws:CalledViaAWSMCP で Deny
  - ToolInvocationCount 急増アラームを有効化

クライアント層:
  - write 系ツール呼び出し前に人間の確認ステップを挟む