AWS MCP server: setup, auth, production

What is the AWS MCP server?

A AWS MCP server implements the Model Context Protocol and exposes AWS's capabilities as typed tools an agent can discover and call in the middle of a task. Your cloud infrastructure — compute, storage, networking, and more.

Cloud and orchestration access is the highest-stakes MCP connection and the one to lock down hardest: read-mostly IAM/RBAC, a firm boundary on anything destructive, and a human gate on state changes. Done right, agents become excellent at diagnosis without being able to cause an outage.

A real AWS workflow

A service is unhealthy. The agent inspects the relevant resource configuration and state — security groups, task definitions, recent changes — and drafts the fix as a diff for you to apply, rather than reaching for the change itself.

What an agent can do with AWS

• Have an agent inspect resource configuration and state
• Investigate why a service is unhealthy
• Draft infrastructure changes for human review

Read-only is the right default: let the agent observe and reason first, then grant specific write actions deliberately — each behind audit logging and, for anything high-impact, human approval.

Setting up the AWS MCP server

Give the agent an IAM role with least-privilege, read-mostly policies (Describe/Get/List). Explicitly deny the destructive and IAM-mutating actions; an allow-list of read verbs plus a deny-list of dangerous ones is the belt-and-braces.

Auth: An IAM role with least-privilege, read-mostly permissions. Credentials belong in the environment or a secret store — never in the repo or the agent's sandbox. Wiring a server into Claude Code or Cursor is the same for every tool; the step-by-step lives in the MCP connection guide.

The risk to watch with AWS

This is the highest-stakes connection on the list. An over-scoped IAM role turns a prompt-injected agent into an infrastructure incident. Read-mostly, destructive actions denied, human gate on any change.

More broadly, a production-grade AWS integration needs least-privilege IAM and a hard boundary on destructive actions. The MCP security checklist applies to every integration — we build servers with these controls baked in.