目录

1. 概述

• 成本

2. 先决条件

• 操作系统

3. 部署步骤
4. 部署验证
5. 运行指导
6. 下一步
7. 清理
8. 常见问题、已知问题、额外注意事项及限制
9. 修订
10. 通知

概述

本指南演示了如何在AWS上部署模型上下文协议（MCP）服务器，并利用Amazon Cognito实现安全认证，实现2025-06-18 MCP规范，并采用OAuth 2.0受保护资源元数据（RFC9728）。它允许您托管可远程访问的MCP服务器，同时通过符合标准的OAuth 2.0认证流程维护安全性。

该解决方案解决了几个关键挑战：

• 在AWS基础设施上安全托管MCP服务器
• 使用OAuth 2.0受保护资源元数据（RFC9728）进行符合标准的认证
• 通过安全的 StreamableHTTP 传输远程访问 MCP 服务器
• 无状态服务器架构，支持并发客户端
• 使用 AWS CDK 实现可扩展且可维护的部署

建筑

该架构实现了：

1. CloudFront 分发，用于全球内容分发，并具备 WAF 保护

Guidance for Deploying Model Context Protocol Servers on AWS

Table of Contents

1. Overview
   • Cost
2. Prerequisites
   • Operating System
3. Deployment Steps
4. Deployment Validation
5. Running the Guidance
6. Next Steps
7. Cleanup
8. FAQ, known issues, additional considerations, and limitations
9. Revisions
10. Notices

Overview

This guidance demonstrates how to deploy Model Context Protocol (MCP) servers on AWS with secure authentication using Amazon Cognito, implementing the 2025-06-18 MCP specification with OAuth 2.0 Protected Resource Metadata (RFC9728). It enables you to host MCP servers that can be accessed remotely while maintaining security through standards-compliant OAuth 2.0 authentication flows.

The solution addresses several key challenges:

• Secure hosting of MCP servers on AWS infrastructure
• Standards-compliant authentication using OAuth 2.0 Protected Resource Metadata (RFC9728)
• Remote access to MCP servers through secure StreamableHTTP transport
• Stateless server architecture for concurrent client support
• Scalable and maintainable deployment using AWS CDK

Architecture

The architecture implements:

1. CloudFront distribution for global content delivery with WAF protection
2. Application Load Balancer for traffic distribution and SSL termination
3. ECS Fargate and Lambda for containerized and serverless MCP servers
4. AWS Cognito for OAuth 2.0 authorization server functionality
5. OAuth 2.0 Protected Resource Metadata endpoints for standards-compliant authentication
6. StreamableHTTP transport with stateless request handling
7. Four-stack CDK deployment: VPC, Security, CloudFront WAF, and MCP Server stacks

Cost

You are responsible for the cost of the AWS services used while running this Guidance. As of August 2025, the cost for running this Guidance with the default settings in the US East (N. Virginia) Region is approximately $194.18 per month for processing moderate traffic levels.

We recommend creating a Budget through AWS Cost Explorer to help manage costs. Prices are subject to change. For full details, refer to the pricing webpage for each AWS service used in this Guidance.

Estimated Cost Table

The following table provides a sample cost breakdown for deploying this Guidance with the default parameters in the US East (N. Virginia) Region for one month.

| AWS service | Dimensions | Cost [USD] |