Add ECS Instance Log MCP Server

[LearningNewbie]

Description

Add a new MCP Server for AWS DevOps Agent that collects and analyzes diagnostic logs from ECS container instances using SSM Automation. This complements the existing mcp/aws-eks-node-diagnostics-mcp by providing equivalent capabilities for ECS EC2 instances.

Covers ECS agent, Docker/containerd, container logs, system logs, dmesg, networking, cgroups, instance metadata, and GPU diagnostics - artifacts that live on the instance OS and aren't accessible through the ECS API or CloudWatch.

Key Features

• 19 MCP tools across 5 tiers: Core, Analysis, Cluster, Capture, SOPs
• Hub-and-spoke cross-region design (one central deployment serves all regions)
• 36 structured runbooks covering ECS-specific failure categories (A-K, Z)
• Security: KMS encryption, Cognito OAuth2, region allow-list, ECS instance validation
• Auto-deploy SOPs via CDK BucketDeployment
• Interactive deploy script with ECS cluster/instance role auto-detection
• Property-based tests with hypothesis

Architecture

Single CDK stack deploys: S3 (KMS-encrypted logs + SOPs), Lambda (19 tools), SSM Automation role, Cognito User Pool, and BedrockAgentCore MCP Gateway.

Type of change

• Documentation or infrastructure change

Testing

• Unit tests: 28/28 pass (property-based with hypothesis)
• TypeScript compile: clean
• CDK synth: generates valid CloudFormation template
• End-to-end deployment validated (us-east-1):
  • OAuth token exchange
  • tools/list (all 19 tools registered)
  • list_sops (36 SOPs returned)
  • get_sop (content retrieval)
  • cluster_health (correct cluster status)
  • collect (input validation, region restriction)

License confirmation

• By submitting this pull request, I confirm that my contribution is made under the terms of the Apache License 2.0.

[LearningNewbie]

Closing in favor of #45 by @shyamkulkarni which includes all changes from this PR plus the human-in-the-loop SSM approval workflow required for the appsec baseline.