Securing MCP Servers: Role-Based Tool Access with OAuth 2.0 and AWS Cognito

Welcome back to the channel! In today's video, we're building on our previous Azure Entra implementation and showing you how to secure your MCP server tools using AWS Cognito instead.

We'll walk through the complete process of setting up authentication and authorization for your MCP server, creating custom scopes, implementing policies in .NET, and testing everything with Postman. By the end of this tutorial, you'll be able to control access to your MCP tools based on which scopes are included in the access token.

📚 What You'll Learn
✅ How to set up AWS Cognito for machine-to-machine authentication

✅ Creating a resource server and custom scopes in Cognito

✅ Configuring app clients with the right permissions

✅ Implementing JWT Bearer authentication in .NET

✅ Creating custom authorization policies that validate Cognito scopes

✅ Handling the "default scope" behavior in AWS Cognito

✅ Testing with Postman using different scope combinations

✅ Complete working code example for MCP server security

🛠️ Prerequisites
An AWS account (free tier works fine)

Visual Studio / VS Code with .NET installed

Basic understanding of MCP servers (check the playlist link below)

Postman for testing API calls

📮 Postman Setup
Grant Type: Client Credentials

Access Token URL: https://your-domain.auth.region.amazoncognito.com/oauth2/token

Client ID: From your app client

Client Secret: From your app client

Scopes: Space-separated list (e.g., https://api.example.com/WeatherSecuredTools1 https://api.example.com/WeatherSecuredTools2)

🎯 Key Takeaways
✅ AWS Cognito returns ALL scopes when you omit the scope parameter

✅ Use a "default" scope to detect when no scopes were explicitly requested

✅ Scopes come as a space-separated string in the JWT token

✅ Custom authorization policies give you fine-grained control

✅ The same MCP server can support both public and secure tools

📖 Video Chapters
⏱️ 0:00 - Introduction & What We'll Build
⏱️ 1:30 - Quick Demo: Secure Tools in Action
⏱️ 3:15 - Setting Up AWS Cognito User Pool
⏱️ 5:40 - Creating App Client (M2M Application)
⏱️ 7:20 - Configuring Resource Server & Custom Scopes
⏱️ 10:15 - Assigning Scopes to App Client
⏱️ 12:00 - Getting Access Token URL & Credentials
⏱️ 14:30 - Testing Token in Postman & jwt.io
⏱️ 16:45 - Installing Required NuGet Packages
⏱️ 18:30 - Configuring Authentication in Program.cs
⏱️ 20:15 - Creating Custom Scope Validation Logic
⏱️ 23:40 - Implementing Authorization Policies
⏱️ 26:00 - Adding Authorize Attributes to Tools
⏱️ 28:15 - Testing: Both Scopes → Both Tools Available
⏱️ 30:30 - Testing: Single Scope → Single Tool Available
⏱️ 32:45 - Testing: No Scope → No Secure Tools (Default Scope Logic)
⏱️ 35:00 - Complete Code Review & Explanation
⏱️ 37:30 - AWS Cognito Configuration Recap
⏱️ 39:00 - Postman Setup Walkthrough
⏱️ 41:15 - Final Thoughts & Next Steps

Видео Securing MCP Servers: Role-Based Tool Access with OAuth 2.0 and AWS Cognito канала Code & Cloud