AWS MCP Server

This page documents the AWS API MCP Server from awslabs/mcp, published as awslabs.aws-api-mcp-server. It runs AWS CLI commands through the call_aws tool with command validation and optional read-only mode.

The upstream README now marks this server as superseded by the newer AWS MCP Server; it remains available and is documented here.

What it Does

• AWS CLI execution: Runs AWS CLI commands through call_aws with validation and error handling
• Command suggestions: Suggests likely AWS CLI commands for a natural language query
• Read-only mode: Restricts execution to non-mutating operations with READ_OPERATIONS_ONLY=true
• Credential chain: Uses boto3's credential chain or a named AWS profile

Installation

# Using uvx
uvx awslabs.aws-api-mcp-server@latest

Docker:

docker run --rm -i \
  -e AWS_REGION=us-east-1 \
  -v ~/.aws:/app/.aws \
  public.ecr.aws/awslabs-mcp/awslabs/aws-api-mcp-server:latest

Configuration

{
  "mcpServers": {
    "aws-api": {
      "command": "uvx",
      "args": ["awslabs.aws-api-mcp-server@latest"],
      "env": {
        "AWS_REGION": "us-east-1",
        "AWS_API_MCP_PROFILE_NAME": "default"
      }
    }
  }
}

AWS_REGION sets the default region. AWS_API_MCP_PROFILE_NAME selects a named AWS profile; if it is omitted, the server follows boto3's default credential chain.

Available Tools

The full tool descriptions are in the upstream README.

Common Workflows

Security Audit

1. Use call_aws to list IAM roles and inspect their policies
2. Use call_aws to list S3 buckets and inspect bucket access settings
3. Review security group rules for open ports
4. Ask for a summary of the findings

Cost Investigation

1. Use call_aws to query AWS Cost Explorer for the current month
2. Ask for the top-spending services
3. Use call_aws to list EC2 instances and identify idle resources
4. Generate cost optimization recommendations

Resource Inventory

1. Use call_aws with aws ec2 describe-instances to list EC2 instances
2. Use call_aws with aws s3api list-buckets to list S3 buckets
3. Ask for Lambda functions and RDS instances in the target region
4. Compile a resource inventory report

Example Prompts

• "List all my EC2 instances"
• "Show me S3 buckets in us-west-2"
• "Create a new security group for web servers"
• "Which IAM roles have overly permissive policies?"
• "What are my top 5 cost centers this month?"

Troubleshooting

Security Notes

• Use least-privilege IAM credentials; IAM permissions remain the primary control
• Set READ_OPERATIONS_ONLY=true for read-only exploration
• Do not connect the server to untrusted data sources; call_aws is exposed to prompt injection
• Enable CloudTrail for audit logging

Sources

• https://github.com/awslabs/mcp/tree/main/src/aws-api-mcp-server
• https://docs.aws.amazon.com/agent-toolkit/latest/userguide/mcp-server.html