1---
2name: aws-network-ops
3description: "AWS cloud networking — VPC, Transit Gateway, Cloud WAN, VPN, Network Firewall, ENI, flow logs. Use when auditing AWS VPCs, troubleshooting connectivity between EC2 instances, checking Transit Gateway routes, or investigating VPN tunnel status."
4version: 1.0.0
5license: Apache-2.0
6tags: [aws, vpc, transit-gateway, cloud-wan, vpn, network-firewall, flow-logs]
7
8netshell:
9 mcp_tools:
10 - mcp: aws-network-mcp
11 tools:
12 - get_path_trace_methodology
13 - find_ip_address
14 - get_eni_details
15 - list_vpcs
16 - get_vpc_details
17 - get_vpc_route_tables
18 - list_subnets
19 - get_subnet_details
20 - list_transit_gateways
21 - get_transit_gateway_details
22 - get_transit_gateway_route_tables
23 - list_vpn_connections
24 - get_vpn_connection_details
25 - get_network_firewall_details
26 - list_flow_logs
27---
28
29# AWS Network Operations
30
31## MCP Server
32
33- **Command**: `uvx awslabs.aws-network-mcp-server@latest` (stdio transport)
34- **Requires**: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION` (or `AWS_PROFILE`)
35- **Read-only**: All operations are Describe/Get/List — no create/modify/delete
36
37## Available Tools (27)
38
39### General (3)
40
41| Tool | What It Does |
42|------|-------------|
43| `get_path_trace_methodology` | Guidance for tracing network paths across AWS resources |
44| `find_ip_address` | Find which VPC/subnet/ENI an IP address belongs to |
45| `get_eni_details` | Get Elastic Network Interface details — security groups, subnet, routes |
46
47### VPC (3)
48
49| Tool | What It Does |
50|------|-------------|
51| `list_vpcs` | List all VPCs in the account/region |
52| `get_vpc_network_details` | Full VPC details — subnets, route tables, IGW, NAT GW, endpoints, NACLs |
53| `get_vpc_flow_logs` | Query VPC flow logs for traffic analysis |
54
55### Transit Gateway (7)
56
57| Tool | What It Does |
58|------|-------------|
59| `list_transit_gateways` | List all Transit Gateways |
60| `get_tgw_details` | Transit Gateway details — attachments, route tables, associations |
61| `get_tgw_routes` | Get routes from a specific TGW route table |
62| `get_all_tgw_routes` | Get routes from all TGW route tables |
63| `get_tgw_flow_logs` | Query Transit Gateway flow logs |
64| `list_tgw_peerings` | List TGW peering connections |
65| `detect_tgw_inspection` | Detect if traffic inspection is configured on a TGW |
66
67### Cloud WAN (10)
68
69| Tool | What It Does |
70|------|-------------|
71| `list_core_networks` | List all Cloud WAN core networks |
72| `get_cloudwan_details` | Core network details — segments, policies, attachments |
73| `get_cloudwan_routes` | Get routes from a Cloud WAN segment |
74| `get_all_cloudwan_routes` | Get routes from all Cloud WAN segments |
75| `get_cloudwan_attachment_details` | Details for a specific Cloud WAN attachment |
76| `detect_cloudwan_inspection` | Detect inspection configuration on Cloud WAN |
77| `list_cloudwan_peerings` | List Cloud WAN peering connections |
78| `get_cloudwan_peering_details` | Details for a specific Cloud WAN peering |
79| `get_cloudwan_logs` | Query Cloud WAN logs |
80| `simulate_cloud_wan_route_change` | Simulate a route change and predict impact |
81
82### VPN (1)
83
84| Tool | What It Does |
85|------|-------------|
86| `list_vpn_connections` | List all site-to-site VPN connections with tunnel status |
87
88### Network Firewall (3)
89
90| Tool | What It Does |
91|------|-------------|
92| `list_network_firewalls` | List all AWS Network Firewalls |
93| `get_firewall_rules` | Get firewall rule groups and policies |
94| `get_network_firewall_flow_logs` | Query Network Firewall flow logs |
95
96## Workflow: VPC Network Audit
97
98When a user asks "show me our AWS network" or "audit the VPCs":
99
1001. **List VPCs**: `list_vpcs` to see all VPCs in the region
1012. **For each VPC**: `get_vpc_network_details` — subnets, route tables, gateways, NACLs
1023. **Check TGW**: `list_transit_gateways` to see cross-VPC connectivity
1034. **Check VPN**: `list_vpn_connections` for hybrid connectivity
1045. **Check firewalls**: `list_network_firewalls` for security posture
1056. **Report**: Formatted summary of the cloud network architecture
106
107## Workflow: Troubleshoot Connectivity
108
109When a user asks "why can't EC2 instance X reach Y?":
110
1111. **Find the IPs**: `find_ip_address` for both source and destination
1122. **Get ENI details**: `get_eni_details` to check security groups, subnet, routes
1133. **Check route tables**: `get_vpc_network_details` to see routing
1144. **Check flow logs**: `get_vpc_flow_logs` to see if traffic is being dropped
1155. **Check firewalls**: `get_firewall_rules` if traffic crosses a Network Firewall
1166. **Check TGW**: `get_tgw_routes` if traffic crosses Transit Gateway
1177. **Report**: Root cause analysis with fix recommendation
118
119## Workflow: Transit Gateway Health
120
121When checking multi-VPC connectivity:
122
1231. **List TGWs**: `list_transit_gateways`
1242. **Get details**: `get_tgw_details` for attachments and route tables
1253. **Check routes**: `get_all_tgw_routes` for route table completeness
1264. **Check peerings**: `list_tgw_peerings` for cross-region/cross-account
1275. **Check inspection**: `detect_tgw_inspection` for security posture
1286. **Flow logs**: `get_tgw_flow_logs` for traffic analysis
129
130## Workflow: VPN Tunnel Monitoring
131
132When checking hybrid connectivity:
133
1341. **List VPNs**: `list_vpn_connections`
1352. **Check tunnel status**: Up/Down for each tunnel (redundancy check)
1363. **Check routes**: TGW or VGW routes for the VPN prefixes
1374. **Flow logs**: VPC flow logs for traffic across VPN
1385. **Report**: VPN health summary with any down tunnels flagged
139
140## Important Rules
141
142- **Read-only** — this MCP cannot create, modify, or delete any AWS resources
143- **Region-specific** — results are scoped to the configured AWS_REGION
144- **IAM permissions required** — EC2 Describe, Network Manager, Network Firewall Describe, CloudWatch Logs
145- **Record in GAIT** — log all AWS network investigations for audit trail
146
147## Environment Variables
148
149- `AWS_ACCESS_KEY_ID` — AWS access key
150- `AWS_SECRET_ACCESS_KEY` — AWS secret key
151- `AWS_REGION` — AWS region (e.g., us-east-1)
152- Or `AWS_PROFILE` — Named AWS CLI profile
gabrielmoreira