aws-resilience-modeling

No direct malware or explicit malicious behavior is present in this documentation. The significant security risks are executing MCP packages via the mutable @latest tag, granting those packages access to AWS credentials, and using a broad account-wide read policy that may expose sensitive logs and configuration. Pin package versions, verify provenance and hashes where supported, review each server's actual capabilities, use least-privilege and scoped credentials, and avoid exposing sensitive logs unnecessarily.

该文件是 AWS MCP 服务器配置文档，不包含直接恶意代码或明显后门。主要安全风险来自使用 uvx 包名@latest 动态执行未固定版本的软件，以及向多个外部 MCP 进程授予范围较宽的 AWS 只读权限。建议固定经过审计的版本和哈希，使用最小化且按账户/资源限制的 IAM 策略，避免将生产凭证用于未经验证的 MCP 包，并确认日志、DynamoDB 和 Lambda 查询结果不会被外传。