Apache Airflow Mwaa Cost MCP

🔍 CMDB MCP챗봇

将存储在S3中的AWS CMDB策略数据与7个AWS MCP服务器联动，使用自然语言查询AWS资源现状、成本、安全性和监控的AI聊天机器人。

______________________________________________________________________

📋 项目概述

🎯 主要功能

💡 MCP（模型上下文协议）란?

AI模型可以访问外部数据和工具的标准协议。

• 一般方式：将所有数据以文本形式传递给AI→浪费令牌，速度慢
• MCP方式：在需要AI时调用工具查询数据→高效、准确

______________________________________________________________________

🏗️ 体系结构

사용자 질문
    ↓
Streamlit 챗봇 (UI)
    ↓
질문 유형 분류 (라우팅)
    ↓
┌─────────────────────────────────────────────┐
│  📊 CMDB (S3)     ☁️ AWS MCP 서버 (7개)     │
│  - IAM 정책       - 💰 AWS Billing           │
│  - EC2 현황       - 📈 Cost Explorer         │
│  - S3 버킷        - 📚 AWS Knowledge         │
│  - RDS/VPC        - 💵 AWS Pricing           │
│  - KMS/보안       - 📊 CloudWatch            │
│                   - 🔍 CloudTrail            │
│                   - 🔐 IAM                   │
└─────────────────────────────────────────────┘
    ↓
Strands Agent + Bedrock Claude Sonnet 4
    ↓
통합 분석 → 한국어 답변 + 사용된 MCP 표시

数据流：

1. 输入用户问题
2. 问题关键字分析→仅选择性调用所需的MCP
3. Strands Agent自主运行MCP工具
4. 整合多个源数据→Bedrock分析后回答
5. 敏感信息匿名化→显示已使用的MCP服务器

______________________________________________________________________

📊 配置MCP服务器

内部CMDB MCP（S3直接查询）

查看存储在S3存储桶中的AWS资源策略快照数据。

S3数据结构：

s3://mwaa-cmdb-bucket/
└── aws-policies/
    └── YYYYMMDD/
        ├── identity_policies.json
        ├── storage_policies.json
        ├── compute_policies.json
        ├── database_policies.json
        ├── network_policies.json
        └── security_policies.json

外部AWS MCP服务器（7个）

基于Strands Agent运行。根据问题类型，只会自动选择所需的服务器。

______________________________________________________________________

⚙ENT MCP设置文件

mcpconfig.json

{
  "mcpServers": {
    "cmdb-server": {
      "command": "python",
      "args": ["mcp_server.py"],
      "env": {
        "AWS_DEFAULT_REGION": "us-east-1"
      }
    },
    "aws-billing": {
      "command": "uvx",
      "args": ["awslabs.billing-cost-management-mcp-server@latest"],
      "env": {
        "AWS_REGION": "us-east-1",
        "FASTMCP_LOG_LEVEL": "ERROR"
      }
    },
    "aws-cost-explorer": {
      "command": "uvx",
      "args": ["awslabs.cost-explorer-mcp-server@latest"],
      "env": {
        "AWS_REGION": "us-east-1",
        "FASTMCP_LOG_LEVEL": "ERROR"
      }
    },
    "aws-knowledge": {
      "command": "uvx",
      "args": ["awslabs.aws-documentation-mcp-server@latest"],
      "env": {
        "FASTMCP_LOG_LEVEL": "ERROR"
      }
    },
    "aws-pricing": {
      "command": "uvx",
      "args": ["awslabs.aws-pricing-mcp-server@latest"],
      "env": {
        "AWS_REGION": "us-east-1",
        "FASTMCP_LOG_LEVEL": "ERROR"
      }
    },
    "aws-cloudwatch": {
      "command": "uvx",
      "args": ["awslabs.cloudwatch-mcp-server@latest"],
      "env": {
        "AWS_REGION": "us-east-1",
        "FASTMCP_LOG_LEVEL": "ERROR"
      }
    },
    "aws-cloudtrail": {
      "command": "uvx",
      "args": ["awslabs.cloudtrail-mcp-server@latest"],
      "env": {
        "AWS_REGION": "us-east-1",
        "FASTMCP_LOG_LEVEL": "ERROR"
      }
    },
    "aws-iam": {
      "command": "uvx",
      "args": ["awslabs.iam-mcp-server@latest"],
      "env": {
        "AWS_REGION": "us-east-1",
        "FASTMCP_LOG_LEVEL": "ERROR"
      }
    }
  }
}

______________________________________________________________________

🚀 执行方法

1.前提条件

• Python 3.13+
• 安装uv/uvx（pip install uv)
• 设置AWS凭据

2.首选参数

# 가상환경 생성
python3 -m venv cmdbmcp313_new
source cmdbmcp313_new/bin/activate

# 패키지 설치
pip install -r requirements.txt

# 환경 변수 설정
cp .env.example .env
# .env 파일에 실제 AWS 자격증명 입력

3.设置.env文件

# AWS 자격증명
AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY_HERE
AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY_HERE

# S3 CMDB 버킷
S3_CMDB_BUCKET=mwaa-cmdb-bucket

# Bedrock 설정 (us. 접두사 필수)
BEDROCK_REGION=us-east-1
BEDROCK_MODEL_ID=us.anthropic.claude-sonnet-4-20250514-v1:0

4.运行

# 통합 실행 스크립트 (권장)
./run.sh

# 또는 직접 실행
python -m streamlit run streamlit_app.py --server.port 8505

连接URL： http://localhost:8505

______________________________________________________________________

🖥️ UI配置

边栏

🔍 CMDB 설정
S3 버킷: [mwaa-cmdb-bucket]

─────────────────────────
🔧 데이터 소스 설정

☑ 📊 CMDB (S3 데이터)
   조직 내 AWS 리소스 현황 (IAM, EC2, S3 등)

☑ ☁️ AWS MCP
   💰 Billing  📈 Cost Explorer  📚 Knowledge
   💵 Pricing  📊 CloudWatch  🔍 CloudTrail  🔐 IAM

✅ 활성화: 📊 CMDB · ☁️ AWS MCP

选项卡配置

选项卡功能 |---|---| | 💬 聊天机器人|通过自然语言问题查询AWS资源/成本/安全性 | 📊 仪表板|按类别显示的资源数量图表、饼图| | 🔍 数据导航|直接查询S3 CMDB数据和JSON查看器|

回答格式

[AI 분석 답변]

---
🔌 활용된 MCP 서버: 📊 CMDB (S3) · 📈 AWS Cost Explorer

______________________________________________________________________

💬 推荐问题示例

🔐 IAM/安全性

了解现状

• “IAM有几个角色？”
• “告诉我IAM用户情况”
• “让我看看拥有管理员权限的角色”

详细分析

• “哪些角色具有CloudWatch权限？”
• “哪些政策拥有S3相关权限？”
• “有访问密钥过期的用户吗？”

💰 成本分析

• “请列出与上月相比本月费用的特别事项”
• “请分析各服务成本增加的原因”
• “EC2成本优化方案是什么？”
• “下个月的预计费用是？”

🖥️ 资源现状

• “如何升级到当前组织内每个帐户的第6代或更低版本实例列表和最新版本”
• “有几个S3愿望桶？”
• “请出示RDS数据库列表”
• “VPC网络配置如何？”

📊 监视

• “请确认EC2 CPU使用率”
• “请分析Lambda错误日志”
• “目前的CloudWatch闹钟状态是？”

🔍 审核/变更历史记录

• “谁更改了S3存储桶的设置？”
• “请出示最近IAM角色变更历史记录”
• “请检查昨天控制台的登录记录”

📚 指南/文档

• “更改EC2实例类型时的注意事项”
• “S3安全最佳实践”
• “如何设置RDS备份”

______________________________________________________________________

🔐 必需的IAM权限

完整集成策略（所有MCP一次应用）

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3CMDBAccess",
            "Effect": "Allow",
            "Action": ["s3:GetObject", "s3:ListBucket"],
            "Resource": [
                "arn:aws:s3:::mwaa-cmdb-bucket",
                "arn:aws:s3:::mwaa-cmdb-bucket/*"
            ]
        },
        {
            "Sid": "BedrockAccess",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CostExplorerAccess",
            "Effect": "Allow",
            "Action": [
                "ce:GetCostAndUsage",
                "ce:GetCostAndUsageComparisons",
                "ce:GetCostComparisonDrivers",
                "ce:GetCostForecast",
                "ce:GetDimensionValues",
                "ce:GetTagValues",
                "ce:GetAnomalies",
                "ce:GetAnomalyMonitors",
                "ce:GetReservationCoverage",
                "ce:GetReservationUtilization",
                "ce:GetSavingsPlansCoverage",
                "ce:GetSavingsPlansUtilization"
            ],
            "Resource": "*"
        },
        {
            "Sid": "BudgetsAccess",
            "Effect": "Allow",
            "Action": [
                "budgets:ViewBudget",
                "budgets:DescribeBudgets",
                "budgets:DescribeBudgetActionsForAccount"
            ],
            "Resource": "*"
        },
        {
            "Sid": "PricingAccess",
            "Effect": "Allow",
            "Action": [
                "pricing:GetProducts",
                "pricing:DescribeServices",
                "pricing:GetAttributeValues"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CloudWatchAccess",
            "Effect": "Allow",
            "Action": [
                "cloudwatch:GetMetricData",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:ListMetrics",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:DescribeAlarmHistory",
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
                "logs:GetLogEvents",
                "logs:FilterLogEvents",
                "logs:StartQuery",
                "logs:GetQueryResults",
                "logs:StopQuery"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CloudTrailAccess",
            "Effect": "Allow",
            "Action": [
                "cloudtrail:LookupEvents",
                "cloudtrail:GetTrail",
                "cloudtrail:ListTrails",
                "cloudtrail:DescribeTrails",
                "cloudtrail:ListEventDataStores",
                "cloudtrail:StartQuery",
                "cloudtrail:GetQueryResults",
                "cloudtrail:DescribeQuery"
            ],
            "Resource": "*"
        },
        {
            "Sid": "IAMReadAccess",
            "Effect": "Allow",
            "Action": [
                "iam:ListUsers", "iam:GetUser",
                "iam:ListRoles", "iam:GetRole",
                "iam:ListGroups", "iam:GetGroup",
                "iam:ListPolicies", "iam:GetPolicy", "iam:GetPolicyVersion",
                "iam:ListUserPolicies", "iam:GetUserPolicy",
                "iam:ListRolePolicies", "iam:GetRolePolicy",
                "iam:ListAttachedUserPolicies", "iam:ListAttachedRolePolicies",
                "iam:ListAccessKeys", "iam:SimulatePrincipalPolicy"
            ],
            "Resource": "*"
        }
    ]
}

当前已知的权限限制： - ce:GetCostAndUsageComparisons -环比比较功能（需要单独启用） - ce:GetCostComparisonDrivers -成本增长原因分析 - ce:GetAnomalies -检测成本异常 如果您没有上述权限 get_cost_and_usage手动比较每个月的数据。

______________________________________________________________________

🔒 安全和匿名

第2步自动匿名化

步骤1：加载数据时

• 导入S3 CMDB数据时自动匿名

第2步：生成AI答案后

• AI答案中包含的敏感信息也自动掩蔽

掩蔽项目：

保留项： 角色名称、策略名称、服务名称（分析所需）

______________________________________________________________________

📁 项目结构

cmdb_mcp/
├── streamlit_app.py        # 메인 Streamlit 챗봇 앱
├── mcp_server.py           # 내부 CMDB MCP 서버 (S3 조회)
├── mcp_config.json         # MCP 서버 설정 (Claude Desktop 연동용)
├── requirements.txt        # Python 패키지
├── run.sh                  # 통합 실행 스크립트

______________________________________________________________________

🛠️ 故障射击

1.MCP服务器错误：ValidationException

An error occurred (ValidationException) when calling the ConverseStream operation

原因： Bedrock模型ID格式错误

解决方案： .env在 us. 确认前缀

# 잘못된 예
BEDROCK_MODEL_ID=anthropic.claude-sonnet-4-20250514-v1:0

# 올바른 예
BEDROCK_MODEL_ID=us.anthropic.claude-sonnet-4-20250514-v1:0

2.Cost Explorer权限错误

AccessDeniedException: not authorized to perform: ce:GetCostAndUsageComparisons

解决方案： 向IAM用户添加上述集成策略

3.无uvx错误

FileNotFoundError: uvx not found

解决方案：

pip install uv
# 또는
brew install uv

4.如果AI找不到数据

症状： 有数据，但回答“没有”

解决方案：

1. 更具体的问题：“请在IAM角色中查找CloudWatch相关角色”
2. 直接在“数据导航”选项卡中查看
3. 分阶段提问