Description

detect_tgw_inspection fails with an unhandled KeyError: 'VpcId' when called against Transit Gateways that have at least one attachment type other than a plain VPC attachment (e.g. Connect, peering, or Direct Connect Gateway attachments).

Environment

• awslabs.aws-network-mcp-server version: 0.0.13 (via uvx awslabs.aws-network-mcp-server@latest)
• MCP client: Claude Code
• Region: eu-west-1

Steps to reproduce

1. Call list_transit_gateways(region="eu-west-1", profile_name="<profile>") — returns 2+ TGWs, at least one with mixed attachment types (VPC + Connect/peering).
2. Call detect_tgw_inspection(transit_gateway_id="<tgw-id>", region="eu-west-1", profile_name="<profile>") on that TGW.

Actual behavior

Error detecting firewall attachments: 'VpcId'. REQUIRED TO REMEDIATE BEFORE CONTINUING

This happened consistently on 2 out of 2 TGWs tested in the account, one of which is a long-standing production TGW and one a newer TGW used for third-party VPC attachment.

Expected behavior

The tool should either:

• Skip/ignore attachments that don't have a VpcId (e.g. Connect, peering) when checking for firewall-appliance-mode VPC attachments, or
• Return a clear error identifying which attachment(s) lack the expected field, rather than an unhandled KeyError.

Additional context

This appears to be an unguarded dict access (e.g. attachment['VpcId']) somewhere in the TGW attachment-inspection logic that doesn't account for non-VPC attachment types in the TGW's attachment list.