Idira SCA MCP Server – Just-in-Time AWS Access

Overview

Idira SCA MCP Server is the official Model Context Protocol server for Idira Secure Cloud Access, documented by CyberArk. It is designed for command-line, IDE, and AI-assistant workflows where an agent needs AWS access only when required. Instead of relying on long-lived AWS secrets, the server requests temporary access through Secure Cloud Access and writes fresh credentials into the configured AWS credentials file.

What the MCP server enables

The server exposes two documented tools. login_to_aws_default grants temporary just-in-time access to the default AWS account and role configured for the server. elevate_aws_account_access grants temporary access to a specified standalone AWS account using a designated role. Once credentials are written to the AWS credentials file, the AI agent or local tooling can continue with normal AWS operations using the configured profile.

The server is useful for asking an AI assistant to perform cloud-development tasks that need live AWS access, such as listing S3 buckets or checking the role currently available in the authenticated account. Access elevation depends on Secure Cloud Access policies, tenant configuration, and the AWS account and role existing in the environment.

When to use it

Use Idira SCA MCP Server when AI-powered developer tools, infrastructure-as-code workflows, or CI/CD tasks need temporary AWS permissions. It is especially relevant where security teams want to reduce standing privileges and avoid distributing persistent AWS credentials to agents or developers.

Connection and authentication

The documented MCP connection is a local stdio server run from a Docker container pulled through AWS Marketplace and Amazon ECR. Docker must be available on the machine that runs the MCP server, and the AWS credentials directory must be mounted into the container so the server can create or update the selected AWS profile.

Authentication can be configured with an Idira Identity token obtained through the Identity APIs, or by OAuth2 using CYBERARK_CLIENT_ID, CYBERARK_CLIENT_SECRET, and CYBERARK_APPLICATION_ID. The transport entry below uses the documented token-based environment variables.

Key considerations

The documented limitation is important: this MCP server supports elevation to standalone AWS accounts only. It requires a valid Idira tenant, predefined cloud access policies, an accessible AWS credentials file path, and an existing AWS account and role. Because it writes credentials for downstream tools, teams should mount only the required AWS configuration path, protect tokens and OAuth credentials, and keep access policies scoped to the minimum privileges required.