{
  "id": 19522180,
  "title": "Two Security Policy Fixes in AWS's API MCP Server, and What They Say About Guardrails Inside the Server",
  "url": "https://urgent.news/2026/11/11/two-security-policy-fixes-in-awss-api-mcp-server-and-what-they-say",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-11T16:55:14.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/x1y1co/two-security-policy-fixes-in-awss-api-mcp-server-and-what-they-say-about-guardrails-inside-the-3095"
  },
  "original_language": "en",
  "account": "AWS has recently released two patches to address issues in its API MCP server's security policy mechanism. The first issue, discovered in version 1.3.47 released in July 2026, caused the server to silently ignore denylisted operations if the startup data could not be loaded, effectively disabling the guardrails entirely. The fix in 1.3.47 now refuses to start if the startup data cannot be loaded, ensuring the server enforces the security policy at all times.\n\nThe second issue, addressed in version 1.5.1 released in August, pertains to the exact-match requirement for operation names in the security policy file. This bug could allow certain operations to bypass the denylist due to mismatches caused by differences in naming conventions or format. The fix in 1.5.1 standardizes the operation name representation, ensuring consistent matching against the denylist and elicit list.\n\nThese security fixes highlight the importance of robust guardrails within the server and the potential risks when such mechanisms fail or behave unexpectedly. The AWS documentation emphasizes that IAM permissions remain the primary security control, and the policy layer is meant to complement, not replace, IAM restrictions. Adopters should be aware of these potential vulnerabilities and implement appropriate measures to ensure their servers' security policies remain effective and secure.",
  "summary": "The AWS API MCP server lets an agent run AWS CLI commands through a single tool, and it ships its own policy file so you can block or gate specific commands. Twice this year its changelog has recorded a bug in that policy layer. In version 1.3.47, released in July 2026, the changelog says that if the index of read-only operations failed to load at startup, \"the server continued running with the…",
  "key_points": [
    "First fix in version 1.3.47 prevents server from starting without startup data",
    "Second fix in version 1.5.1 standardizes operation name matching in security policies",
    "AWS emphasizes IAM permissions as primary security control while policy layer complements"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}