Sra Verify MCP

AWS SRA验证MCP服务器

它的作用

SRA 验证 验证您的AWS组织中本地AWS安全服务是否已大规模正确配置。它检查多种帐户类型（管理、审计、日志存档和应用程序），并返回每种安全控制的详细通过/失败结果。

安全和合规是AWS和客户之间的共同责任。SRA验证和SRA验证MCP服务器可以帮助客户在共享责任模型的客户端实施控制和最佳实践。访问 共同责任模式 了解更多。

MCP工具

支持服务列表

SRA Verify涵盖了广泛的AWS安全服务，包括：Access Analyzer、Audit Manager、CloudTrail、CloudWatch、Config、GuardDuty、IAM、Inspector、Macie、Organizations、S3、security Hub、security Lake、Shield、WAF等。查看完整 检查清单 在SRA验证Github上。

注意：SRA Verify包含对多个服务的检查，但可能不包含对AWS安全参考架构的每个考虑因素的检查。查看 AWS规范性指南 有关AWS安全参考架构的更多信息。

先决条件

• Python 3.10+
• 紫外线 包管理器
• 具有适当安全服务读取权限的AWS凭据
• 使用SRA帐户结构（管理、审计、日志归档帐户）访问AWS组织

跨帐户角色设置

要扫描AWS组织中的成员帐户，SRA Verify需要为其评估的每个帐户部署IAM角色。包括 1-sraverify-mcp-roles.yaml CloudFormation模板以最低权限创建此角色。

注意：您应该使用最小权限来限制AI代理权限。提供的示例是最低权限只读命令，但您应该检查和更新以符合组织的策略。

通过CloudFormation进行部署

使用 云层堆叠集 要在整个组织中部署角色，请执行以下操作：

1. 引导到 云形成>堆叠集 在您的管理帐户中
2. 选择 创建堆栈集 并上传 1-sraverify-mcp-roles.yaml
3. 设置 Role 将运行SRA Verify的IAM角色或用户的ARN参数（您的AWS配置文件验证的主体）
4. 部署到您的目标客户（或整个组织）

模板创建：

• SRAM成员MCP角色 --SRA Verify在每个帐户中承担的IAM角色
• SRA验证MCPLeast特权 --具有AWS服务SRA验证检查范围内的只读权限的托管策略
• SRA验证MCP检查权限 --帐户级别检查的额外权限

角色的信任策略只允许您在 Role 参数来假设它。

注意：StackSets不适用于管理帐户。您还必须部署 1-sraverify-mcp-roles.yaml 作为独立的CloudFormation模板添加到您的管理帐户。

设置

Kiro CLI（代理模式）

创建自定义代理（可选）

您可以创建一个专用的SRA验证代理，以便快速访问：

打开Kiro或VS Code以创建新的代理配置文件。

kiro ~/.kiro/agents/sra.json

输入以下示例配置文件。使用克隆存储库的绝对路径更新“/path/to/sra-verify-mcp_server/”。

{
  "name": "sra",
  "description": "AWS Security Reference Architecture compliance checker",
  "prompt": "You are an AWS security expert specializing in SRA compliance validation. Use the SRA Verify MCP tools to help users assess their AWS environment against security best practices. When users ask about security checks, proactively discover available checks, explain what they validate, and run them with the appropriate account IDs and parameters. Always provide clear summaries of findings with actionable recommendations.",
  "mcpServers": {
    "awslabs.sraverify-mcp-server": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/sra-verify-mcp/awslabs/sraverify_mcp_server/",
        "run",
        "server.py"
      ],
      "disabled": false,
      "env": {
        "AWS_PROFILE": "my-profile" //Optional, you can remove this to use your default AWS credential chain
      }
    }
  },
  "tools": [
    "*"
  ],
  "toolAliases": {},
  "allowedTools": [
    "@awslabs.sraverify-mcp-server/list*",
    "@awslabs.sraverify-mcp-server/describe*"
  ],
  "resources": [],
  "hooks": {},
  "toolsSettings": {},
  "useLegacyMcpJson": true,
  "model": null
}

或者，您可以直接使用uvx运行。

{
  "name": "sra",
  "description": "AWS Security Reference Architecture compliance checker",
  "prompt": "You are an AWS security expert specializing in SRA compliance validation. Use the SRA Verify MCP tools to help users assess their AWS environment against security best practices. When users ask about security checks, proactively discover available checks, explain what they validate, and run them with the appropriate account IDs and parameters. Always provide clear summaries of findings with actionable recommendations.",
  "mcpServers": {
    "awslabs.sraverify-mcp-server": {
      "command": "uvx",
      "args": [
        "sraverify-mcp"
      ],
      "disabled": false
    }
  },
  "tools": [
    "*"
  ],
  "toolAliases": {},
  "allowedTools": [
    "@awslabs.sraverify-mcp-server/list*",
    "@awslabs.sraverify-mcp-server/describe*"
  ],
  "resources": [],
  "hooks": {},
  "toolsSettings": {},
  "useLegacyMcpJson": true,
  "model": null
}

您可以更新 my-profile 使用有权承担以下任务的AWS CLI配置文件 SRAMemberMCPRole，或将其删除以使用默认的AWS凭据。

要调用代理，请包括 --agent sra 当开始新的聊天时。

kiro-cli chat --agent sra

用法示例

Kiro CLI代理提示

注意：这些提示仅作为示例提供。生成式人工智能是非确定性的，你可能会得到不同的结果。始终使用最小权限和人在循环中来防止不必要的更改。

配置后，您可以在Kiro CLI代理中使用自然语言提示：

发现：

[sra] > List all AWS services that SRA Verify can check
Running tool list_checks_by_account_type with the param (from mcp server: awslabs.sraverify-mcp-server)
 ⋮  {
 ⋮    "account_type": "all"
 ⋮  }
 - Completed in 0.16s

> SRA Verify can check the following 17 AWS services:

1. Account
2. AuditManager
3. CloudTrail
4. Config
5. EC2
6. FirewallManager
7. GuardDuty
8. IAM Access Analyzer
9. Inspector
10. Macie
11. Organizations
12. S3
13. SecurityHub
14. SecurityIncidentResponse
15. SecurityLake
16. Shield
17. WAF

Would you like to see the available checks for any specific service?

[sra] > Show me all GuardDuty checks available
Running tool list_checks_by_service with the param (from mcp server: awslabs.sraverify-mcp-server)
 ⋮  {
 ⋮    "service": "GuardDuty"
 ⋮  }
 - Completed in 0.14s

> Here are all 25 GuardDuty checks available in SRA Verify:

## Application Account Checks (12)
Core Configuration:
- **SRA-GUARDDUTY-01** (HIGH) - GuardDuty detector exists
- **SRA-GUARDDUTY-02** (LOW) - GuardDuty finding frequency is set
- **SRA-GUARDDUTY-03** (HIGH) - GuardDuty detector is enabled

Data Sources:
- **SRA-GUARDDUTY-04** (MEDIUM) - DNS logs enabled
- **SRA-GUARDDUTY-05** (MEDIUM) - VPC flow logs enabled
- **SRA-GUARDDUTY-08** (HIGH) - CloudTrail logs enabled

Protection Features:
- **SRA-GUARDDUTY-06** (HIGH) - S3 protection enabled
- **SRA-GUARDDUTY-07** (HIGH) - EKS protection enabled
- **SRA-GUARDDUTY-09** (HIGH) - Malware protection for EBS enabled
- **SRA-GUARDDUTY-10** (HIGH) - RDS protection enabled
- **SRA-GUARDDUTY-11** (HIGH) - EKS runtime protection enabled
- **SRA-GUARDDUTY-12** (HIGH) - Lambda protection enabled

Agent Management:
- **SRA-GUARDDUTY-17** (HIGH) - EKS addon management enabled
- **SRA-GUARDDUTY-18** (HIGH) - ECS Fargate agent management enabled
- **SRA-GUARDDUTY-19** (HIGH) - EC2 agent management enabled

## Management Account Checks (2)
- **SRA-GUARDDUTY-13** (HIGH) - Service administration delegated
- **SRA-GUARDDUTY-14** (HIGH) - Delegated admin is audit account

## Audit Account Checks (7)
Organization-Wide Configuration:
- **SRA-GUARDDUTY-15** (HIGH) - Auto-enablement configured
- **SRA-GUARDDUTY-16** (HIGH) - Member account limit not reached

Auto-Enablement for Features:
- **SRA-GUARDDUTY-20** (HIGH) - S3 data events auto-enablement configured
- **SRA-GUARDDUTY-21** (HIGH) - EBS Malware Protection auto-enablement configured
- **SRA-GUARDDUTY-22** (HIGH) - EKS Audit Logs auto-enablement configured
- **SRA-GUARDDUTY-23** (HIGH) - Runtime Monitoring auto-enablement configured
- **SRA-GUARDDUTY-24** (HIGH) - Lambda Network Logs auto-enablement configured
- **SRA-GUARDDUTY-25** (HIGH) - RDS Login Events auto-enablement configured

运行检查：

[sra] > Run SRA-GUARDDUTY-01 check for audit account 123456789012 using role SRAMemberMCPRole

Running tool run_check with the param (from mcp server: awslabs.sraverify-mcp-server)
 ⋮  {
 ⋮    "check_id": "SRA-GUARDDUTY-01",
 ⋮    "audit_accounts": [
 ⋮      "123456789012"
 ⋮    ],
 ⋮    "log_archive_accounts": null,
 ⋮    "role_arn": "arn:aws:iam::123456789012:role/SRAMemberMCPRole"
 ⋮  }

Allow this action? Use 't' to trust (always allow) this tool for the session. [y/n/t]:

[sra] > y

 - Completed in 11.689s

> ## SRA-GUARDDUTY-01 Check Results

Account: 123456789012 (Code Prod)
Status: Completed with 1 failure

### Summary
- ✅ Passed: 16 regions
- ❌ Failed: 1 region
- **Total:** 17 regions checked

### Failed Region
ap-northeast-3 (HIGH severity)
- **Issue:** GuardDuty detector does not exist
- **Remediation:** Enable GuardDuty in ap-northeast-3

### Passing Regions
GuardDuty detectors are properly configured in:
- ap-south-1, eu-north-1, eu-west-3, eu-west-2, eu-west-1
- ap-northeast-2, ap-northeast-1, ca-central-1, sa-east-1
- ap-southeast-1, ap-southeast-2, eu-central-1
- us-east-1, us-east-2, us-west-1, us-west-2

### Recommendation
Enable GuardDuty in ap-northeast-3 to ensure comprehensive threat detection coverage across all AWS regions, even those not actively used for workloads. This prevents blind spots where unauthorized activity could go undetected.

 ▸ Time: 28s

全面验证：

[sra] > Run all GuardDuty checks for my audit account 123456789012 in us-east-1 and summarize the results

Running tool run_check with the param (from mcp server: awslabs.sraverify-mcp-server)
 ⋮  {
 ⋮    "audit_accounts": [
 ⋮      "123456789012"
 ⋮    ],
 ⋮    "check_id": "SRA-GUARDDUTY-01",
 ⋮    "region": "us-east-1"
 ⋮  }

Allow this action? Use 't' to trust (always allow) this tool for the session. [y/n/t]:

[sra] > y

Running tool run_check with the param (from mcp server: awslabs.sraverify-mcp-server)
 ⋮  {
 ⋮    "audit_accounts": [
 ⋮      "123456789012"
 ⋮    ],
 ⋮    "check_id": "SRA-GUARDDUTY-02",
 ⋮    "region": "us-east-1"
 ⋮  }

Allow this action? Use 't' to trust (always allow) this tool for the session. [y/n/t]:

[sra] > y

Running tool run_check with the param (from mcp server: awslabs.sraverify-mcp-server)
 ⋮  {
 ⋮    "audit_accounts": [
 ⋮      "123456789012"
 ⋮    ],
 ⋮    "check_id": "SRA-GUARDDUTY-03",
 ⋮    "region": "us-east-1"
 ⋮  }

Allow this action? Use 't' to trust (always allow) this tool for the session. [y/n/t]:

[sra] > y

 - Completed in 1.150s

 - Completed in 1.65s

 - Completed in 1.592s

_truncated the other 22 run_check calls_

> ## GuardDuty Security Assessment Summary

Account: 123456789012 (Audit)
Region: us-east-1
Total Checks: 25

### Overall Results
- ✅ Passed: 23 checks (92%)
- ❌ Failed: 1 check (4%)
- ⚠️ Errors: 1 check (4%)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

### Critical Issues

❌ FAILED - SRA-GUARDDUTY-13: GuardDuty service administration NOT delegated (HIGH)
- **Issue:** GuardDuty service administration is not delegated to any account
- **Impact:** Lack of centralized management reduces security visibility and control across the organization
- **Remediation:** Delegate GuardDuty administration to the audit account (123456789012) from the management account using AWS Organizations

⚠️ ERROR - SRA-GUARDDUTY-14: Cannot verify delegated admin configuration (HIGH)
- **Issue:** BadRequestException when accessing GuardDuty organization information
- **Impact:** Cannot verify if the delegated admin is properly configured as the audit account
- **Remediation:** Check IAM permissions and AWS Organizations configuration

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

### Passing Checks Summary

✅ Core Configuration (3/3)
- Detector exists
- Detector is enabled
- Finding frequency set (SIX_HOURS)

✅ Data Sources (3/3)
- DNS logs enabled
- VPC flow logs enabled
- CloudTrail logs enabled

✅ Protection Features (6/6)
- S3 protection enabled
- EKS protection enabled
- Malware protection for EBS enabled
- RDS protection enabled
- EKS runtime protection enabled
- Lambda protection enabled

✅ Agent Management (3/3)
- EKS addon management enabled
- ECS Fargate agent management enabled
- EC2 agent management enabled

✅ Organization Configuration (7/7)
- Auto-enablement configured for new accounts
- Member account limit not reached
- S3 data events auto-enablement configured
- EBS Malware Protection auto-enablement configured
- EKS Audit Logs auto-enablement configured
- Runtime Monitoring auto-enablement configured
- Lambda Network Logs auto-enablement configured
- RDS Login Events auto-enablement configured

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

### Key Recommendations

1. Critical: Delegate GuardDuty administration to this audit account from the management account to enable centralized security management across the
organization

2. Investigate: Resolve the permissions error for organization-level checks (SRA-GUARDDUTY-14)

3. Optional: Consider changing finding frequency from 6 hours to 15 minutes or 1 hour for faster threat response in critical environments

Your GuardDuty configuration is excellent with comprehensive protection features, all data sources enabled, and proper auto-enablement policies for new
accounts. The primary gap is the missing delegated administration setup.

 ▸ Time: 1m 47s

Kiro IDE（电源）

注意：这些提示仅作为示例提供。生成式人工智能是非确定性的，你可能会得到不同的结果。始终使用最小权限和人在循环中来防止不必要的更改。

SRA Verify Power将MCP服务器与入职工作流程和指导文件捆绑在一起，以获得指导性体验。

安装电源

1. 打开Kiro IDE
2. 安装电源之前，请更新 path/to/sra-verify-mcp/awslabs/sraverify_mcp_server/ 在mcp.json中，带有克隆存储库的绝对路径。
3. 打开电源面板（选择侧边栏中的电源图标或使用命令面板： 基洛：开放的力量)
4. 选择 添加自定义电源.
5. 选择 从文件夹导入电源.
6. 选择/path/to/powers/sra验证

配置您的AWS配置文件

安装电源后，更新MCP配置中的AWS配置文件：

1. 打开 ~/.kiro/settings/mcp.json 在您的工作空间中。您还可以选择Kiro选项卡中MCP服务器旁边的编辑按钮。
2. 找到 AWS_PROFILE value--默认为 SRA_VERIFY_MCP_PROFILE_NAME
3. 替换 SRA_VERIFY_MCP_PROFILE_NAME 使用您的实际AWS CLI配置文件名称：

{
  "mcpServers": {
    "power-sra-verify-awslabs.sraverify-mcp-server": {
      "command": "uv",
      "args": [
        "--directory",
        "/path/to/sra-verify-mcp/awslabs/sraverify_mcp_server/",
        "run",
        "server.py"
      ],
      "disabled": false,
      "env": {
        "AWS_PROFILE": "my-profile" // Update this profile
      }
    }
  }
}

入职培训

安装和配置电源后，使用Kiro聊天中的此提示浏览交互式设置：

I just installed SRA Verify power and want to set it up

入职流程将：

• 自动发现您的AWS帐户（或手动收集）
• 确定您的管理、审计和日志归档帐户
• 检测您的活动AWS区域
• 配置您的跨帐户角色ARN
• 将所有内容保存到指导文件中以备将来使用

Kiro IDE聊天提示

在安装了电源的Kiro IDE中，您可以使用自然语言提示。你不必那么具体，因为指导文件为Kiro提供了额外的背景。

                                    Check my Researcher account for GuardDuty 03

Kiro
> Including Steering Documents sra-verify-environment.md

I'll check the Researcher01 account for GuardDuty check 03. Let me first activate the sra-verify power and then run the check.

> Activated Kiro power sra-verify

Now I'll run the GuardDuty check 03 for the Researcher01 account. Let me first describe the check to understand what it validates, then run it.

> Used Kiro power sra-verify describe_check

> Used Kiro power sra-verify run_check

Great news! The GuardDuty check 03 passed for your Researcher01 account.

Check Results:

Status: PASS ✓
Account: Researcher01 (123456789012)
Region: us-east-1
Severity: HIGH
What was checked: This validates that the GuardDuty detector is enabled in the account. The detector represents the GuardDuty service in the specific region - if disabled, it won't provide threat intelligence.

Finding:

Detector status is ENABLED
Detector ID: 02bf72b27729788EXAMPLE06a31eb
No remediation needed
Your Researcher01 account has GuardDuty properly enabled and running in us-east-1.

下一步

考虑一下如何将其与其他MCP服务器和工作流一起使用。

• 添加票证系统MCP，为失败的发现自动创建票证。
• 使用 AWS MCP服务器 参考AWS文档并调用AWS API
• 请求补救指导、代码示例、CloudFormation模板来修复失败的发现。