AWS Security Audit

MCP Servers

• IAM MCP: uvx awslabs.iam-mcp-server@latest --readonly (stdio transport)
• CloudTrail MCP: uvx awslabs.cloudtrail-mcp-server@latest (stdio transport)
• Requires: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_PROFILE)

Key Capabilities

IAM (Identity & Access Management)

• Users: List IAM users, access keys, MFA status, last activity
• Roles: List roles, trust policies, attached permissions
• Policies: Inspect policy documents, identify overly permissive policies
• Groups: List groups and their memberships
• Read-only mode: --readonly flag prevents any IAM modifications

CloudTrail (API Audit Trail)

• Event history: Search recent API calls by user, service, or resource
• Lookup events: Filter by event name, resource type, username
• Time-based queries: Narrow to specific time windows around incidents
• Multi-region: Trail events across all enabled regions

Workflow: Network Security Audit

When a user asks "audit our AWS network security":

1. IAM roles for network services: Check roles used by VPC, TGW, Network Firewall
2. Overly permissive policies: Find policies with ec2:* or *:* actions
3. Unused access keys: Identify stale credentials that should be rotated
4. MFA compliance: Check which users lack MFA
5. CloudTrail check: Recent AuthorizeSecurityGroupIngress, CreateNetworkAcl, ModifyVpcAttribute events
6. Report: Security posture summary with remediation recommendations

Workflow: Incident Investigation

When investigating a security event:

1. CloudTrail lookup: Search events by time window and suspected user/role
2. Identify actions: What API calls were made? DeleteSecurityGroup, ModifySubnetAttribute?
3. Source IP: Where did the API calls originate from?
4. IAM context: What permissions does the user/role have? Should they?
5. Blast radius: What resources were affected?
6. Report: Timeline of events with impact assessment

Workflow: Compliance Check

When checking AWS security compliance:

1. Root account: Check for root access key usage in CloudTrail
2. MFA enforcement: List users without MFA enabled
3. Access key rotation: Find keys older than 90 days
4. Unused credentials: Identify users with no recent activity
5. Policy review: Check for policies granting * on sensitive services
6. Report: Compliance scorecard with findings

Common CloudTrail Network Events

| Event Name | What It Means | |------------|---------------| | AuthorizeSecurityGroupIngress | Security group rule added (inbound) | | AuthorizeSecurityGroupEgress | Security group rule added (outbound) | | RevokeSecurityGroupIngress | Security group rule removed (inbound) | | CreateNetworkAclEntry | NACL rule added | | CreateRoute | Route table entry added | | ModifyVpcAttribute | VPC setting changed | | CreateVpnConnection | New VPN tunnel created | | AttachInternetGateway | IGW attached to VPC | | CreateTransitGatewayRoute | TGW route added | | UpdateFirewallRuleGroupRuleList | Network Firewall rule changed |

IAM Best Practices for Network Teams

| Check | Why It Matters | |-------|---------------| | No ec2:* policies | Prevent accidental network changes | | Separate roles per service | Least privilege for VPC, TGW, Firewall | | MFA on all humans | Protect against credential theft | | No root access keys | Root should use MFA console only | | Key rotation < 90 days | Limit exposure of compromised keys | | CloudTrail enabled | Audit trail for all API changes |

Important Rules

• IAM MCP runs in read-only mode — cannot create, modify, or delete IAM resources
• CloudTrail has event history limits — default 90-day lookback for management events
• Region-specific for CloudTrail — unless using organization trail
• Record in GAIT — log all security investigations for audit trail

Environment Variables

• AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_PROFILE)