目次

1. 概要

• コスト

2. 前提条件

• オペレーティングシステム

3. 展開ステップ
4. 展開検証
5. ガイダンスの実行
6. 次のステップ
7. 清掃
8. FAQ、既知の問題点、追加の考慮事項および制限事項
9. 改訂
10. 通知

概要

このガイダンスは、Amazon Cognitoを用いて安全な認証を備えたモデルコンテキストプロトコル(MCP)サーバーをAWS上で展開する方法を示し、OAuth 2.0保護リソースメタデータ(RFC9728)を用いた2025-06-18 MCP仕様を実装しています。これにより、標準準準のOAuth 2.0認証フローを通じてセキュリティを維持しつつ、リモートアクセス可能なMCPサーバーをホストできます。

このソリューションは、いくつかの重要な課題に対応しています。

• AWSインフラ上でのMCPサーバーの安全なホスティング
• OAuth 2.0保護リソースメタデータ(RFC9728)を用いた標準準拠認証
• 安全なStreamableHTTPトランスポートを通じたMCPサーバーへのリモートアクセス
• 並行クライアントサポートのためのステートレスサーバーアーキテクチャ
• AWS CDKを用いたスケーラブルかつ保守可能な展開

建築

アーキテクチャは以下を実装しています:

1. **CloudFront配信:グローバルコンテンツ配信とWAF保護

Guidance for Deploying Model Context Protocol Servers on AWS

Table of Contents

1. Overview
   • Cost
2. Prerequisites
   • Operating System
3. Deployment Steps
4. Deployment Validation
5. Running the Guidance
6. Next Steps
7. Cleanup
8. FAQ, known issues, additional considerations, and limitations
9. Revisions
10. Notices

Overview

This guidance demonstrates how to deploy Model Context Protocol (MCP) servers on AWS with secure authentication using Amazon Cognito, implementing the 2025-06-18 MCP specification with OAuth 2.0 Protected Resource Metadata (RFC9728). It enables you to host MCP servers that can be accessed remotely while maintaining security through standards-compliant OAuth 2.0 authentication flows.

The solution addresses several key challenges:

• Secure hosting of MCP servers on AWS infrastructure
• Standards-compliant authentication using OAuth 2.0 Protected Resource Metadata (RFC9728)
• Remote access to MCP servers through secure StreamableHTTP transport
• Stateless server architecture for concurrent client support
• Scalable and maintainable deployment using AWS CDK

Architecture

The architecture implements:

1. CloudFront distribution for global content delivery with WAF protection
2. Application Load Balancer for traffic distribution and SSL termination
3. ECS Fargate and Lambda for containerized and serverless MCP servers
4. AWS Cognito for OAuth 2.0 authorization server functionality
5. OAuth 2.0 Protected Resource Metadata endpoints for standards-compliant authentication
6. StreamableHTTP transport with stateless request handling
7. Four-stack CDK deployment: VPC, Security, CloudFront WAF, and MCP Server stacks

Cost

You are responsible for the cost of the AWS services used while running this Guidance. As of August 2025, the cost for running this Guidance with the default settings in the US East (N. Virginia) Region is approximately $194.18 per month for processing moderate traffic levels.

We recommend creating a Budget through AWS Cost Explorer to help manage costs. Prices are subject to change. For full details, refer to the pricing webpage for each AWS service used in this Guidance.

Estimated Cost Table

The following table provides a sample cost breakdown for deploying this Guidance with the default parameters in the US East (N. Virginia) Region for one month.

| AWS service | Dimensions | Cost [USD] |