aws-s3-connector-mcp — agentic threat model

Not certain from the listing — the connector is model-agnostic and relies on the host MCP client's LLM. The primary threat is that the underlying model is susceptible to prompt injection, which could be weaponized to abuse the S3 read/write tools.

Directly handles S3 object data across multiple formats. Threats include data exfiltration of sensitive bucket contents via read operations, and data poisoning or malicious file uploads via write operations.

Exposes powerful S3 tools (list, read, upload) to the MCP framework. Insecure tool integration or lack of input validation on bucket names and object keys could allow path traversal or arbitrary bucket access.

Requires AWS credentials to operate. If the hosting environment or MCP client is compromised, these credentials (which have write scope) could be leaked, leading to broader cloud infrastructure compromise.

Not certain from the listing — there is no mention of built-in logging, audit trails for S3 transactions, or guardrails to detect and block anomalous data transfer volumes or unauthorized file types.

Relies entirely on external AWS IAM policies for authorization. If over-broad IAM permissions are granted, the agent inherits them, creating a compliance gap regarding the principle of least privilege.

As an MCP tool, it can be orchestrated by other agents. A compromised or malicious orchestrator agent could abuse this connector to exfiltrate enterprise data to public buckets.