AWS Integration

The AWS MCP server provides AWS operations using the AWS CLI with Azure AD On-Behalf-Of (OBO) authentication.

Authentication: Azure AD token exchanged for AWS credentials via STS AssumeRoleWithWebIdentity

Tools

call_aws

Execute AWS CLI commands:

Input:
  cli_command: string - AWS CLI command
  max_results?: number - Limit results
  meta?: object - Request metadata

Output: JSON or text output from AWS CLI

Examples:

# List EC2 instances
aws ec2 describe-instances

# List S3 buckets
aws s3 ls

# List Lambda functions
aws lambda list-functions

# Describe RDS instances
aws rds describe-db-instances

# List ECS clusters
aws ecs list-clusters

suggest_aws_commands

Get command suggestions from natural language:

Input:
  query: string - Natural language query

Output: Suggested AWS CLI commands

Examples:
  "list EC2 instances in us-west-2"
  "show S3 bucket contents"
  "get Lambda function logs"

aws_list_accounts

List Identity Center accounts:

Input:
  meta?: object - Request metadata

Output: Available accounts and roles

Authentication Flow

1. User authenticates with Azure AD

2. Azure AD token passed to MCP server

3. Token exchanged via AWS STS AssumeRoleWithWebIdentity

4. Temporary AWS credentials returned

5. AWS CLI command executed with credentials

6. Credentials cached for 50 minutes

Credential Caching

• Cache key: User ID

• TTL: 50 minutes (10 min buffer before expiry)

• Storage: Redis + in-memory

Fallback

When no user token is available:

• Falls back to environment variable credentials

• Uses AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY

Common Commands

EC2

# List instances
aws ec2 describe-instances

# Get instance by ID
aws ec2 describe-instances --instance-ids i-1234567890abcdef0

# Start instance
aws ec2 start-instances --instance-ids i-1234567890abcdef0

# Stop instance
aws ec2 stop-instances --instance-ids i-1234567890abcdef0

S3

# List buckets
aws s3 ls

# List bucket contents
aws s3 ls s3://bucket-name/

# Get object
aws s3 cp s3://bucket-name/key local-file

Lambda

# List functions
aws lambda list-functions

# Invoke function
aws lambda invoke --function-name my-function output.json

# Get function configuration
aws lambda get-function-configuration --function-name my-function

CloudWatch

# Get metrics
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=i-1234567890abcdef0 \
  --start-time 2024-01-01T00:00:00Z \
  --end-time 2024-01-02T00:00:00Z \
  --period 3600 \
  --statistics Average

IAM

# List users
aws iam list-users

# List roles
aws iam list-roles

# Get user
aws iam get-user --user-name username

Error Handling

• Invalid credentials: Re-authenticates via OBO

• Expired token: Automatic credential refresh

• Permission denied: Returns error with required permissions

• Service unavailable: Returns service status