mcp

Least-privilege permissions

• Grant the MCP IAM role only the minimum AWS actions required for intended use cases (e.g., s3:GetObject instead of s3:*)
• Use resource-based policies to restrict access to specific ARNs (S3 buckets, RDS instances, Secrets Manager secrets)
• Implement service control policies (SCPs) to prevent dangerous actions like iam:*, ec2:TerminateInstances, or s3:DeleteBucket at the organization level
• Regularly audit and revoke unused permissions via IAM Access Analyzer

Network isolation

• Deploy the MCP server in a private VPC subnet with no direct internet access; use VPC endpoints for AWS service calls (S3, RDS, Secrets Manager, CloudTrail)
• Restrict inbound connections to the MCP agent only from trusted hosts; block outbound traffic to unknown destinations
• Use AWS PrivateLink or VPC endpoints to prevent data traversal over the public internet

Monitoring

• Enable CloudTrail logging for all MCP-initiated AWS API calls; forward logs to a centralized SIEM and set up alerts for anomalous patterns (bulk data reads, permission changes, resource deletions)
• Implement VPC Flow Logs to detect unexpected network connections or data exfiltration attempts
• Use Amazon GuardDuty or third-party intrusion detection to flag suspicious activity; monitor CloudWatch Logs for errors or unexpected agent behavior

Red flags to watch for

• Repeated failed authorization errors or attempts to access resources outside the intended scope
• Large or unusual S3 read operations, RDS queries, or Secrets Manager lookups that deviate from baseline patterns
• Agent responses containing raw AWS credentials, encryption keys, or sensitive database content
• API calls to unintended services or regions; sudden spikes in API activity