AWS MCP Server: IAM-Native Access to 15,000+ AWS APIs

AWS has released a free, officially maintained MCP server that exposes all 15,000+ AWS APIs through a single tool — authenticated via the IAM credentials the calling agent already holds.

The MCP Auth Gap

The Model Context Protocol has become the de facto standard for connecting AI agents to external services. Claude Code, Cursor, and AWS’s own Kiro all support MCP natively, and the integration catalog has grown quickly. The persistent gap has been enterprise-grade auth. Most community-built MCP servers handle credentials through environment variables or API keys — a pattern that creates credential sprawl when multiple agents need AWS access and one that bypasses the IAM policies, SCPs, and audit trails that enterprise security teams rely on. Every AWS API call made outside the IAM perimeter is a call that evades the governance controls organizations already have in place.

The AWS MCP Server solves this at the protocol layer rather than the configuration layer. The server inherits IAM context from the calling agent’s session, so existing IAM policies govern agent behavior without additional enforcement tooling or credential management work.

What the Server Provides

Three core tools ship with the GA release. call_aws is the primary interface: one tool covering all 15,000+ AWS APIs, routed by service name and operation. There is no need to deploy separate MCP servers for S3, EC2, Lambda, and Bedrock — a single server instance handles the entire service catalog. run_script provides sandboxed Python execution that inherits the session’s IAM context, enabling agents to execute SDK code without injecting additional credentials. search_documentation and read_documentation connect agents to the full AWS documentation corpus, addressing a systematic failure mode in infrastructure automation: models confidently describing APIs or behaviors that have changed since their training cutoff.

In the GA demonstration, an agent answered a detailed question about S3 Vectors — a feature released after the model’s knowledge cutoff — by querying the documentation tool rather than generating a hallucinated answer. This is the practical value of grounded documentation access in infrastructure contexts: the AWS service catalog moves faster than any model’s training cycle, and agents relying purely on parametric knowledge will drift from current behavior continuously.

The auth architecture uses IAM context keys natively, so IAM policies, SCPs, and permission boundaries apply to agent actions without modification. For organizations sharing MCP access across multiple agents or teams without distributing raw credentials, the MCP Proxy component implements OAuth 2.1 as a delegation layer — the same standard enterprise identity providers already support. The server is available in US East 1 and EU Frankfurt. The MCP server itself is free; standard AWS API invocation costs apply to the calls it executes.

Source: AWS Blog

Content created with AI assistance and reviewed for accuracy.