Two Security Policy Fixes in AWS's API MCP Server, and What They Say About Guardrails Inside the Server
The AWS API MCP server lets an agent run AWS CLI commands through a single tool, and it ships its own policy file so you can block or gate specific commands. Twice this year its changelog has recorded a bug in that policy layer. In version 1.3.47, released in July 2026, the changelog says that if the index of read-only operations failed to load at startup, "the server continued running with the…
AWS has recently released two patches to address issues in its API MCP server's security policy mechanism. The first issue, discovered in version 1.3.47 released in July 2026, caused the server to silently ignore denylisted operations if the startup data could not be loaded, effectively disabling the guardrails entirely. The fix in 1.3.47 now refuses to start if the startup data cannot be loaded, ensuring the server enforces the security policy at all times.
The second issue, addressed in version 1.5.1 released in August, pertains to the exact-match requirement for operation names in the security policy file. This bug could allow certain operations to bypass the denylist due to mismatches caused by differences in naming conventions or format. The fix in 1.5.1 standardizes the operation name representation, ensuring consistent matching against the denylist and elicit list.
These security fixes highlight the importance of robust guardrails within the server and the potential risks when such mechanisms fail or behave unexpectedly. The AWS documentation emphasizes that IAM permissions remain the primary security control, and the policy layer is meant to complement, not replace, IAM restrictions. Adopters should be aware of these potential vulnerabilities and implement appropriate measures to ensure their servers' security policies remain effective and secure.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.