# AWS Solutions Architect Prover MCP for AI Agents AI Agent Connect

> AWS Solutions Architect Prover MCP for AI Agents. This Connector acts as a Principal-level architect reviewing every cloud decision your AI makes. It identifies expensive NAT Gateway mistakes, IAM security holes, and unnecessary service sprawl before you ever push to production.

## Overview
- **Category:** cloud-infrastructure
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_rYl1Jzic0L6ltphpeZqZTQw1KfvxuENsIWqwqZJ3/ai-agent-connect
- **Tags:** aws, well-architected, solutions-architect, cloud-architecture, cost-optimization, blast-radius, iam, security-by-design, principal-architect, aws-review

## Description

Imagine having a senior AWS architect sitting next to you during every design session. Instead of waiting for a costly post-scale audit or an unexpected $40K bill, you can run your architecture through a rigorous review in seconds. This Connector looks at your compute choices, networking costs, and security policies with the same scrutiny used by enterprise support teams. Whether you are scaling a startup or managing complex regulated workloads, it forces you to justify every service and quantify every requirement. You connect it to your preferred client via Vinkius and immediately start getting feedback that prevents technical debt and security breaches. It does not touch your actual AWS account; it simply reviews the logic of your design to ensure you are not overpaying for features you do not need.

## Tools

### validate_aws_architecture
Runs your cloud design through five mandatory gates to catch cost, security, and complexity errors. It identifies failures in requirements, blast radius, service choice, TCO, and security.

## Prompt Examples

**Prompt:** 
```
Is this architecture for my new API cost-effective?
```

**Response:** 
```
I analyzed your design. While Lambda is cheap, your current setup will incur high costs due to VPC endpoints and NAT Gateway usage.

| Component | Estimated Monthly Cost |
| :--- | :--- |
| API Gateway | $140 (40M requests) |
| VPC Endpoints | $132 (3 AZs, 2 endpoints each) |
| NAT Gateway | $32 + usage fees |

**Recommendation:** Consider using Fargate with an ALB to reduce the networking overhead.
```

**Prompt:** 
```
Review my proposed multi-region setup for the payment service.
```

**Response:** 
```
The design fails Gate 2 (Blast Radius). You are proposing Aurora Global Database, but your requirement is only 99.95% availability.

* **Current Plan:** Multi-region active-active.
* **Required Plan:** Multi-AZ within a single region.
* **Reasoning:** Multi-AZ meets your 99.95% SLO without the massive cost and complexity of global replication.
```

**Prompt:** 
```
Check my IAM policy for security risks.
```

**Response:** 
```
The policy contains a critical security failure: `Resource: "*"` is used in an S3 action.

**Required Fix:**
1. Replace the wildcard with specific bucket ARNs.
2. Implement `aws:PrincipalTag` conditions.
3. Ensure all actions are scoped to the minimum required permissions.
```

## Capabilities

### Catch expensive NAT Gateway and egress costs
It flags hidden networking fees before they hit your monthly invoice.

### Identify IAM permission wildcards
The review catches dangerous Resource: * policies during the design phase.

### Prevent service sprawl
It rejects unnecessary EKS or MSK clusters when simpler alternatives like Fargate work.

### Validate availability requirements
The tool ensures your multi-region strategy is actually justified by your SLOs.

### Quantify architectural requirements
It forces you to replace vague marketing terms with concrete RPS and latency numbers.

## Use Cases

### Avoiding EKS complexity
A founder proposes EKS for a simple web app, but the agent suggests Fargate to save costs and reduce ops burden.

### Preventing expensive data transfer
An engineer plans cross-AZ replication; the tool flags the compounding cost of $0.01/GB at scale.

### Securing IAM policies
A developer submits a Lambda function with wide-open permissions, and the agent demands scoped ARNs.

### Justifying multi-region setups
A team proposes Aurora Global Database for a 99.9% SLO; the tool flags it as unnecessary complexity.

## Benefits

- Stop NAT Gateway overspending by identifying idle resources before deployment.
- Prevent IAM breaches by catching wide-open permissions during the design phase.
- Reduce operational burden by replacing complex services with simpler alternatives like Fargate.
- Eliminate multi-region theater by justifying failover needs with real SLOs.
- Ensure compliance readiness for SOC2 or HIPAA from your very first deployment.

## How It Works

The bottom line is you get senior-level AWS architectural oversight without the massive salary overhead.

1. Paste your architecture design or Terraform plan into your AI client.
2. The Connector runs the design through a five-gate review framework.
3. You receive a verdict identifying specific failures and required fixes.

## Frequently Asked Questions

**How much AWS spend can this typically save?**
The senior SA persona targets the five most expensive AWS mistakes: idle NAT Gateways ($32/mo each, often 3-6 in a VPC), forgotten cross-AZ transfer at scale, egress that quietly ranges from $500 to $50,000/mo, VPC endpoints omitted so every S3 call goes through NAT, and EKS control planes chosen where Fargate would suffice ($73/mo per cluster). Teams that put this review in front of every design typically recover 20-40% of AWS spend inside 90 days. The savings scale with the size of the AWS footprint.

**Is this a replacement for AWS Trusted Advisor or Well-Architected Tool?**
No — those tools inspect deployed infrastructure. This Prover reviews the architecture BEFORE you deploy, at the design and reasoning stage where an AI just produced the plan. Trusted Advisor finds the idle NAT Gateway after it has cost you $384/year. The senior SA persona in this Connector catches it in the design conversation, before the CDK template is written. The two are complementary: this is your Day 0 review, Trusted Advisor is your Day 90 audit.

**Does this need AWS credentials or access to my account?**
No. The senior SA persona works purely at the reasoning level — reviewing the design, the tradeoffs, and the justifications your AI produces. It never authenticates against AWS, never reads your account, never touches your infrastructure. There is nothing to configure and no attack surface to worry about. Approve it once, use it forever.

**What does the senior SA actually reject?**
The five patterns that show up in every junior AWS review: (1) marketing words as requirements — 'scalable', 'high performance', 'cloud-native' with no RPS, no p99, no SLO; (2) multi-region as a default instead of a decision earned by 99.99%+ SLO or data residency; (3) service sprawl — Kinesis + MSK + EventBridge stacked because the AI could not commit; (4) 'serverless is cheap' as an argument without API Gateway, DynamoDB, VPC endpoint, and NAT Gateway line items; (5) `Resource: "*"`, access keys, and 'we will lock it down later'. Every rejection names the exact gate and the concrete fix.

**How does the senior SA compare to the CTO Architect Prover?**
The CTO Architect Prover is cloud-agnostic — stack fitness, failure tolerance, migration safety, and observability at any provider or on-prem. The AWS Solutions Architect Prover is AWS-native — it knows the specific pricing of NAT Gateway, the shape of IAM policies, when EKS beats Fargate, and where Aurora Serverless v2 beats DynamoDB. Use the CTO Prover to decide whether you should be on AWS at all. Use this Prover once you are.