1---2name: aws-network-ops3description: AWS cloud networking — VPC, Transit Gateway, Cloud WAN, VPN, Network Firewall, ENI, flow logs. Use when auditing AWS VPCs, troubleshooting connectivity between EC2 instances, checking Transit Gateway routes, or investigating VPN tunnel status.4license: Apache-2.05---6
7# AWS Network Operations
8
9## MCP Server
10
11- **Command**: `uvx awslabs.aws-network-mcp-server@latest` (stdio transport)
12- **Requires**: `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION` (or `AWS_PROFILE`)
13- **Read-only**: All operations are Describe/Get/List — no create/modify/delete
14
15## Available Tools (27)
16
17### General (3)
18
19| Tool | What It Does |
20|------|-------------|
21| `get_path_trace_methodology` | Guidance for tracing network paths across AWS resources |
22| `find_ip_address` | Find which VPC/subnet/ENI an IP address belongs to |
23| `get_eni_details` | Get Elastic Network Interface details — security groups, subnet, routes |
24
25### VPC (3)
26
27| Tool | What It Does |
28|------|-------------|
29| `list_vpcs` | List all VPCs in the account/region |
30| `get_vpc_network_details` | Full VPC details — subnets, route tables, IGW, NAT GW, endpoints, NACLs |
31| `get_vpc_flow_logs` | Query VPC flow logs for traffic analysis |
32
33### Transit Gateway (7)
34
35| Tool | What It Does |
36|------|-------------|
37| `list_transit_gateways` | List all Transit Gateways |
38| `get_tgw_details` | Transit Gateway details — attachments, route tables, associations |
39| `get_tgw_routes` | Get routes from a specific TGW route table |
40| `get_all_tgw_routes` | Get routes from all TGW route tables |
41| `get_tgw_flow_logs` | Query Transit Gateway flow logs |
42| `list_tgw_peerings` | List TGW peering connections |
43| `detect_tgw_inspection` | Detect if traffic inspection is configured on a TGW |
44
45### Cloud WAN (10)
46
47| Tool | What It Does |
48|------|-------------|
49| `list_core_networks` | List all Cloud WAN core networks |
50| `get_cloudwan_details` | Core network details — segments, policies, attachments |
51| `get_cloudwan_routes` | Get routes from a Cloud WAN segment |
52| `get_all_cloudwan_routes` | Get routes from all Cloud WAN segments |
53| `get_cloudwan_attachment_details` | Details for a specific Cloud WAN attachment |
54| `detect_cloudwan_inspection` | Detect inspection configuration on Cloud WAN |
55| `list_cloudwan_peerings` | List Cloud WAN peering connections |
56| `get_cloudwan_peering_details` | Details for a specific Cloud WAN peering |
57| `get_cloudwan_logs` | Query Cloud WAN logs |
58| `simulate_cloud_wan_route_change` | Simulate a route change and predict impact |
59
60### VPN (1)
61
62| Tool | What It Does |
63|------|-------------|
64| `list_vpn_connections` | List all site-to-site VPN connections with tunnel status |
65
66### Network Firewall (3)
67
68| Tool | What It Does |
69|------|-------------|
70| `list_network_firewalls` | List all AWS Network Firewalls |
71| `get_firewall_rules` | Get firewall rule groups and policies |
72| `get_network_firewall_flow_logs` | Query Network Firewall flow logs |
73
74## Workflow: VPC Network Audit
75
76When a user asks "show me our AWS network" or "audit the VPCs":
77
781. **List VPCs**: `list_vpcs` to see all VPCs in the region
792. **For each VPC**: `get_vpc_network_details` — subnets, route tables, gateways, NACLs
803. **Check TGW**: `list_transit_gateways` to see cross-VPC connectivity
814. **Check VPN**: `list_vpn_connections` for hybrid connectivity
825. **Check firewalls**: `list_network_firewalls` for security posture
836. **Report**: Formatted summary of the cloud network architecture
84
85## Workflow: Troubleshoot Connectivity
86
87When a user asks "why can't EC2 instance X reach Y?":
88
891. **Find the IPs**: `find_ip_address` for both source and destination
902. **Get ENI details**: `get_eni_details` to check security groups, subnet, routes
913. **Check route tables**: `get_vpc_network_details` to see routing
924. **Check flow logs**: `get_vpc_flow_logs` to see if traffic is being dropped
935. **Check firewalls**: `get_firewall_rules` if traffic crosses a Network Firewall
946. **Check TGW**: `get_tgw_routes` if traffic crosses Transit Gateway
957. **Report**: Root cause analysis with fix recommendation
96
97## Workflow: Transit Gateway Health
98
99When checking multi-VPC connectivity:
100
1011. **List TGWs**: `list_transit_gateways`
1022. **Get details**: `get_tgw_details` for attachments and route tables
1033. **Check routes**: `get_all_tgw_routes` for route table completeness
1044. **Check peerings**: `list_tgw_peerings` for cross-region/cross-account
1055. **Check inspection**: `detect_tgw_inspection` for security posture
1066. **Flow logs**: `get_tgw_flow_logs` for traffic analysis
107
108## Workflow: VPN Tunnel Monitoring
109
110When checking hybrid connectivity:
111
1121. **List VPNs**: `list_vpn_connections`
1132. **Check tunnel status**: Up/Down for each tunnel (redundancy check)
1143. **Check routes**: TGW or VGW routes for the VPN prefixes
1154. **Flow logs**: VPC flow logs for traffic across VPN
1165. **Report**: VPN health summary with any down tunnels flagged
117
118## Important Rules
119
120- **Read-only** — this MCP cannot create, modify, or delete any AWS resources
121- **Region-specific** — results are scoped to the configured AWS_REGION
122- **IAM permissions required** — EC2 Describe, Network Manager, Network Firewall Describe, CloudWatch Logs
123- **Record in GAIT** — log all AWS network investigations for audit trail
124
125## Environment Variables
126
127- `AWS_ACCESS_KEY_ID` — AWS access key
128- `AWS_SECRET_ACCESS_KEY` — AWS secret key
129- `AWS_REGION` — AWS region (e.g., us-east-1)
130- Or `AWS_PROFILE` — Named AWS CLI profile
gabrielmoreira