Description
find_ip_address with all_regions=True is documented to search "across all enabled regions in your account" until the IP is found. In practice, if the calling role is denied ec2:DescribeNetworkInterfaces in even one of the account's enabled regions (e.g. via an AWS Organizations SCP restricting a specific region, or a permission boundary), the entire multi-region search fails outright instead of skipping that region and continuing to the next.
Environment
awslabs.aws-network-mcp-server version: 0.0.13 (via uvx awslabs.aws-network-mcp-server@latest)- MCP client: Claude Code
- Region making the call: eu-west-1 (account has 5 enabled regions total)
Steps to reproduce
- Have an IAM role where
ec2:DescribeNetworkInterfaces is explicitly denied by an SCP for at least one of the account's enabled regions, but allowed in others.
- Call
find_ip_address(ip_address="<ip>", region="<any-allowed-region>", all_regions=True, profile_name="<profile>").
Actual behavior
Error searching IP address in all regions: An error occurred (UnauthorizedOperation) when calling the DescribeNetworkInterfaces operation: You are not authorized to perform this operation. User: <role-arn> is not authorized to perform: ec2:DescribeNetworkInterfaces with an explicit deny in a service control policy: <scp-arn>. REQUIRED TO REMEDIATE BEFORE CONTINUING
The search aborts completely on the first denied region, even though the IP might be found (or the search could at least complete) in the other 4 enabled regions.
Expected behavior
When all_regions=True, a region that returns AccessDenied/UnauthorizedOperation should be skipped (with a warning noted in the response, e.g. "regions_skipped": ["<region>"]) rather than aborting the entire search. This makes the tool usable in accounts with per-region SCP restrictions, which is a common pattern in regulated/enterprise AWS Organizations.
Additional context
This isn't a bug in the sense of incorrect AWS API usage — the deny is coming from the account's own SCP, which the tool has no control over. But since all_regions=True is explicitly documented as a convenience for "search until found," a single inaccessible region shouldn't be able to break that convenience entirely. Happy to help test a fix if useful.
Description
find_ip_addresswithall_regions=Trueis documented to search "across all enabled regions in your account" until the IP is found. In practice, if the calling role is deniedec2:DescribeNetworkInterfacesin even one of the account's enabled regions (e.g. via an AWS Organizations SCP restricting a specific region, or a permission boundary), the entire multi-region search fails outright instead of skipping that region and continuing to the next.Environment
awslabs.aws-network-mcp-serverversion: 0.0.13 (viauvx awslabs.aws-network-mcp-server@latest)Steps to reproduce
ec2:DescribeNetworkInterfacesis explicitly denied by an SCP for at least one of the account's enabled regions, but allowed in others.find_ip_address(ip_address="<ip>", region="<any-allowed-region>", all_regions=True, profile_name="<profile>").Actual behavior
The search aborts completely on the first denied region, even though the IP might be found (or the search could at least complete) in the other 4 enabled regions.
Expected behavior
When
all_regions=True, a region that returnsAccessDenied/UnauthorizedOperationshould be skipped (with a warning noted in the response, e.g."regions_skipped": ["<region>"]) rather than aborting the entire search. This makes the tool usable in accounts with per-region SCP restrictions, which is a common pattern in regulated/enterprise AWS Organizations.Additional context
This isn't a bug in the sense of incorrect AWS API usage — the deny is coming from the account's own SCP, which the tool has no control over. But since
all_regions=Trueis explicitly documented as a convenience for "search until found," a single inaccessible region shouldn't be able to break that convenience entirely. Happy to help test a fix if useful.