AWS API MCP Server

Overview

This is a highlevel deployment overview. For detailed instructions, troubleshooting, and configuration options see the complete deployment guide. https://github.com/awslabs/mcp/blob/main/src/aws-api-mcp-server/DEPLOYMENT.md 

Security Best Practices

Single User Only: This deployment is designed for individual use. Do NOT use in multi-user environments.

Least Privilege: You are responsible for configuring appropriate permissions. We Recommend to start with read-only access and add permissions incrementally based on your requirements.

Credential Separation: The MCP server uses the IAM role specified during deployment, separate from your local AWS credentials. This means that the Agent will execute requests against AWS services using the MCP Server IAM Role, and and not the callers credentials.

Defense-in-Depth: AI assistants executing AWS commands can be vulnerable to prompt injection attacks. Implement layered security with minimal IAM permissions, exercise caution with untrusted data sources (logs, databases, user-generated content), and command validation workflows.

Required Environment Variables Add these to your AgentCore runtime configuration:

"AUTH_TYPE": "no-auth"

"AWS_API_MCP_HOST": "0.0.0.0"

"AWS_API_MCP_PORT": "8000"

"AWS_API_MCP_STATELESS_HTTP": "true"

"AWS_API_MCP_TRANSPORT": "streamable-http"

"AWS_API_MCP_ALLOWED_HOSTS" = "*"

"AWS_API_MCP_ALLOWED_ORIGINS" = "*"

Note:

• AUTH_TYPE=no-auth is required since AgentCore uses external authentication such as Amazon Cognito.

• These are the minimum required variables - additional environment variables and security configurations are available. See GitHub for complete configuration options.

Recommended Permission Model for the MCP Server

The MCP server has no inherent AWS permission requirements - permissions depend entirely on which AWS services your use case requires. You are responsible to determine and configure appropriate permissions based on your specific needs.

Start with Read-Only Access (Recommended)

aws iam attach-role-policy
--role-name your-mcp-role
--policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess

Add Service-Specific Permissions

Create custom policies for specific AWS services you need and add it to the bedrock-agentcore-role that you will create in the next steps. Example for S3 access:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::your-bucket", "arn:aws:s3:::your-bucket/*" ] } ] }

Always Specify Custom Role

Authentication Methods

SigV4 (Recommended): Uses AWS credentials via AWS MCP Proxy

• Requires AWS credentials for endpoint access
• Requires bedrock-agentcore:InvokeAgentRuntime permission on your local IAM policy
• Requires use of MCP Proxy for AWS

JWT: Uses Cognito or external token providers

• Requires bearer token for endpoint access
• AgentCore creates Cognito User Pool automatically, but you must create users manually
• Use if your client requires JWT authentication

Client Configuration

Once the MCP Server is deployed to AgentCore Runtime, you will receive a runtime ARN. You must URL-encode this ARN to construct the endpoint URL for your MCP client. See documentation.

SigV4 Example (Claude Desktop/Cursor):

{ "aws-api-mcp": { "type": "stdio", "command": "uvx", "args": [ "--from", "git+https://github.com/aws/mcp-proxy-for-aws ", "mcp-proxy-for-aws", "YOUR_AGENTCORE_ENDPOINT", "--region", "us-east-1" ] } }

Once the MCP Server is deployed to AgentCore Runtime, you will receive an ARN to invoke the MCP server. Encode the ARN to invoke the MCP Server by replacing ':' with '%3A' and '/ with' '%2F'

For detailed troubleshooting, see GitHub for complete guide. https://github.com/awslabs/mcp/blob/main/src/aws-api-mcp-server/DEPLOYMENT.md