SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsaws-network-ops

aws-network-ops

Deployment & operations

View repository

Updated 10-15 17:21

About this skill

AWS Network Operations

MCP Server

  • Command: uvx awslabs.aws-network-mcp-server@latest (stdio transport)
  • Requires: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION (or AWS_PROFILE)
  • Read-only: All operations are Describe/Get/List — no create/modify/delete

Available Tools (27)

General (3)

Tool What It Does
get_path_trace_methodology Guidance for tracing network paths across AWS resources
find_ip_address Find which VPC/subnet/ENI an IP address belongs to
get_eni_details Get Elastic Network Interface details — security groups, subnet, routes

VPC (3)

Tool What It Does
list_vpcs List all VPCs in the account/region
get_vpc_network_details Full VPC details — subnets, route tables, IGW, NAT GW, endpoints, NACLs
get_vpc_flow_logs Query VPC flow logs for traffic analysis

Transit Gateway (7)

Tool What It Does
list_transit_gateways List all Transit Gateways
get_tgw_details Transit Gateway details — attachments, route tables, associations
get_tgw_routes Get routes from a specific TGW route table
get_all_tgw_routes Get routes from all TGW route tables
get_tgw_flow_logs Query Transit Gateway flow logs
list_tgw_peerings List TGW peering connections
detect_tgw_inspection Detect if traffic inspection is configured on a TGW

Cloud WAN (10)

Tool What It Does
list_core_networks List all Cloud WAN core networks
get_cloudwan_details Core network details — segments, policies, attachments
get_cloudwan_routes Get routes from a Cloud WAN segment
get_all_cloudwan_routes Get routes from all Cloud WAN segments
get_cloudwan_attachment_details Details for a specific Cloud WAN attachment
detect_cloudwan_inspection Detect inspection configuration on Cloud WAN
list_cloudwan_peerings List Cloud WAN peering connections
get_cloudwan_peering_details Details for a specific Cloud WAN peering
get_cloudwan_logs Query Cloud WAN logs
simulate_cloud_wan_route_change Simulate a route change and predict impact

VPN (1)

Tool What It Does
list_vpn_connections List all site-to-site VPN connections with tunnel status

Network Firewall (3)

Tool What It Does
list_network_firewalls List all AWS Network Firewalls
get_firewall_rules Get firewall rule groups and policies
get_network_firewall_flow_logs Query Network Firewall flow logs

Workflow: VPC Network Audit

When a user asks "show me our AWS network" or "audit the VPCs":

  1. List VPCs: list_vpcs to see all VPCs in the region
  2. For each VPC: get_vpc_network_details — subnets, route tables, gateways, NACLs
  3. Check TGW: list_transit_gateways to see cross-VPC connectivity
  4. Check VPN: list_vpn_connections for hybrid connectivity
  5. Check firewalls: list_network_firewalls for security posture
  6. Report: Formatted summary of the cloud network architecture

Workflow: Troubleshoot Connectivity

When a user asks "why can't EC2 instance X reach Y?":

  1. Find the IPs: find_ip_address for both source and destination
  2. Get ENI details: get_eni_details to check security groups, subnet, routes
  3. Check route tables: get_vpc_network_details to see routing
  4. Check flow logs: get_vpc_flow_logs to see if traffic is being dropped
  5. Check firewalls: get_firewall_rules if traffic crosses a Network Firewall
  6. Check TGW: get_tgw_routes if traffic crosses Transit Gateway
  7. Report: Root cause analysis with fix recommendation

Workflow: Transit Gateway Health

When checking multi-VPC connectivity:

  1. List TGWs: list_transit_gateways
  2. Get details: get_tgw_details for attachments and route tables
  3. Check routes: get_all_tgw_routes for route table completeness
  4. Check peerings: list_tgw_peerings for cross-region/cross-account
  5. Check inspection: detect_tgw_inspection for security posture
  6. Flow logs: get_tgw_flow_logs for traffic analysis

Workflow: VPN Tunnel Monitoring

When checking hybrid connectivity:

  1. List VPNs: list_vpn_connections
  2. Check tunnel status: Up/Down for each tunnel (redundancy check)
  3. Check routes: TGW or VGW routes for the VPN prefixes
  4. Flow logs: VPC flow logs for traffic across VPN
  5. Report: VPN health summary with any down tunnels flagged

Important Rules

  • Read-only — this MCP cannot create, modify, or delete any AWS resources
  • Region-specific — results are scoped to the configured AWS_REGION
  • IAM permissions required — EC2 Describe, Network Manager, Network Firewall Describe, CloudWatch Logs
  • Record in GAIT — log all AWS network investigations for audit trail

Environment Variables

  • AWS_ACCESS_KEY_ID — AWS access key
  • AWS_SECRET_ACCESS_KEY — AWS secret key
  • AWS_REGION — AWS region (e.g., us-east-1)
  • Or AWS_PROFILE — Named AWS CLI profile

Failure Behavior

  • On a tool error (timeout, unreachable host, malformed response), report the failure and its error message directly to the user rather than fabricating or guessing at results.
  • For a confirmed read-only call, check connectivity and retry once if appropriate. For any call that changes state or sends a message, a timeout does not prove the action failed: inspect current state or delivery status before retrying, preserve the required approval/change gates, and do not repeat an action whose outcome is unknown.