AWS MCP Server – Agent Access to AWS Resources
AWS MCP Server is a managed remote Model Context Protocol server from AWS that gives AI agents access to AWS knowledge, skills, and API tools. It is useful when an agent needs current AWS documentation, regional service information, or tightly governed access to AWS APIs using existing IAM credentials and audit controls.
Overview
AWS MCP Server is a managed MCP endpoint provided by AWS as part of Agent Toolkit for AWS. It connects MCP-compatible AI assistants and coding agents to AWS knowledge sources and, when authenticated, to AWS API operations. The server is designed for teams that want agents to reason about AWS services with current documentation while still using normal AWS identity, authorization, monitoring, and audit mechanisms.
What the MCP server enables
AWS documents two main tool groups. Knowledge tools let an agent retrieve AWS skills, search AWS documentation, read documentation pages as markdown, list AWS Regions, and check regional availability for services, features, SDK APIs, and CloudFormation resources. API tools can execute authenticated AWS API calls, suggest AWS API commands, run Python code in a sandboxed environment with AWS API access, generate Amazon S3 pre-signed URLs, and poll long-running tasks.
These capabilities allow agents to answer architecture questions, inspect live AWS resources, troubleshoot service issues, and carry out cloud operations. Access to live AWS APIs depends on the IAM permissions available to the credentials used for the session.
When to use it
Use AWS MCP Server when an AI assistant needs up-to-date AWS service guidance or must perform controlled AWS operations. Practical examples include checking whether a service is available in a target Region, looking up an AWS best-practice workflow, listing cloud resources, generating valid API call syntax, or running a multi-step inspection script across AWS services.
Connection and authentication
AWS provides regional managed MCP endpoints, including https://aws-mcp.us-east-1.api.aws/mcp and https://aws-mcp.eu-central-1.api.aws/mcp. AWS documentation shows MCP clients connecting through uvx mcp-proxy-for-aws@latest, which signs requests using AWS Signature Version 4. AWS CLI version 2.32.0 or later is required for the documented setup, and aws login is recommended for automatically rotating credentials.
Key considerations
AWS MCP Server uses existing IAM credentials, roles, and policies for authorization. CloudTrail logs AWS API calls for audit visibility, and CloudWatch metrics provide monitoring for agent activity. AWS also adds MCP-specific IAM condition context keys so administrators can distinguish MCP-initiated actions and write policies that restrict or block agent activity. Remove older AWS API MCP Server or AWS Knowledge MCP Server configurations when switching to the managed AWS MCP Server to avoid duplicate tools and confusing agent behavior.
Supported Transports
streamable_http
URL: https://aws-mcp.us-east-1.api.aws/mcp
streamable_http
URL: https://aws-mcp.eu-central-1.api.aws/mcp
stdio
Command: uvx
Args:
mcp-proxy-for-aws@latesthttps://aws-mcp.us-east-1.api.aws/mcp--metadataAWS_REGION=${AWS_REGION}
Frequently Asked Questions
- When should an AI agent use AWS MCP Server?
- Use AWS MCP Server when an agent needs current AWS documentation, AWS skills, regional availability data, or authenticated access to AWS APIs for cloud operations such as inspection, troubleshooting, provisioning assistance, or multi-step resource checks.
- What AWS capabilities does this MCP server add to an AI agent?
- It adds AWS knowledge tools for searching and reading documentation, retrieving skills, listing Regions, and checking regional availability, plus authenticated API tools for AWS API calls, command suggestions, sandboxed Python execution, S3 pre-signed URLs, and long-running task status checks.
- What can the AI agent access or manage through AWS MCP Server?
- Unauthenticated agents can search AWS documentation and retrieve service information. Authenticated agents can use API-oriented tools against AWS resources, but only within the permissions granted by the IAM credentials, roles, policies, and conditions used for the session.
- How is authentication configured for AWS MCP Server?
- AWS documentation configures clients through MCP Proxy for AWS, which signs requests to the managed MCP endpoint with AWS Signature Version 4 using local AWS credentials. The documented setup requires AWS CLI 2.32.0 or later and recommends aws login for credential rotation.
- Which transport should be used for AWS MCP Server?
- Use the managed Streamable HTTP endpoint for the AWS Region you want to connect to, normally through the documented stdio client configuration that runs uvx mcp-proxy-for-aws@latest. The endpoint Region controls which MCP server you connect to, while the AWS_REGION metadata controls the default Region for AWS operations.