# AWS MCP Server Authentication and Required IAM Permissions for Agent Operations

> Learn about AWS MCP Server authentication and required IAM permissions for agent operations. Securely manage access with the agent's AWS credentials and specific IAM policies.

- Repository: [Amazon Web Services/agent-toolkit-for-aws](https://github.com/aws/agent-toolkit-for-aws)
- Tags: how-to-guide
- Published: 2026-07-03

---

**The AWS MCP Server authenticates using the agent's existing AWS credentials and requires service-specific IAM permissions attached to the execution role, with minimal development access available through the `SignInLocalDevelopmentAccess` managed policy.**

The **AWS MCP (Model Context Protocol) Server** is the central component in the `aws/agent-toolkit-for-aws` repository that enables AI coding agents to safely issue AWS API calls, execute sandboxed Python scripts, and retrieve live AWS documentation. Understanding how authentication flows through this architecture and which IAM permissions are required is critical for deploying secure, least-privilege agent workflows.

## How Authentication Flows Through the AWS MCP Server

The AWS MCP Server acts as a secure proxy between your agent and AWS services, inheriting credentials from the agent's runtime environment rather than maintaining separate authentication secrets.

### Agent to MCP Server Communication

When an agent invokes tools like `call_aws` or `aws___run_script`, it transmits JSON-encoded requests over TLS to the MCP Server endpoint. According to the toolkit's architectural rules in [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md), agents prefer the AWS MCP Server for all AWS interactions, falling back to AWS CLI only when the server is unavailable. The MCP Server validates that requests are well-formed before processing but does not require separate IAM permissions at this layer—authentication relies entirely on the credentials the agent's compute environment already possesses (either an IAM role attached to the instance or explicit access keys).

### MCP Server to AWS Service Proxy

The MCP Server forwards validated requests to target AWS services using the **same credentials** presented by the agent. This means the Server inherits whatever IAM policies are attached to the agent's principal. As implemented in the repository, every request is automatically logged to CloudWatch (metric `MCPRequestCount`) and CloudTrail (event `MCPServer.CallAWS`), enabling audit trails for all agent activity.

### Identity Inheritance and the SDK Credential Chain

The agent's **IAM identity** is derived from the standard AWS SDK credential chain. When the MCP Server executes `call_aws` operations, it uses the caller's identity to sign requests to the target service. This design ensures that access control remains consistent—if the agent's role lacks `s3:PutObject`, the MCP Server cannot execute that operation on the agent's behalf, regardless of the Server's own configuration.

## Required IAM Permissions for MCP Server Operations

Effective IAM policies must cover development sign-in capabilities, service-specific actions, and observability requirements.

### Minimal Development Permissions

The toolkit ships with a managed policy called **`SignInLocalDevelopmentAccess`** that grants developers the minimal permissions needed to sign in and discover resources without full administrative rights. As documented in [`skills/core-skills/signing-in-to-aws/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/signing-in-to-aws/SKILL.md), this policy allows agents to use the MCP Server for basic exploration and validation tasks. For production deployments, you should attach specific service permissions rather than relying on this minimal starter policy.

### Service-Specific Action Permissions

The exact IAM actions required depend entirely on which AWS services the agent will manipulate through the `call_aws` tool. Each skill in the repository documents its specific permission requirements—for example, [`skills/specialized-skills/storage-skills/securing-s3-buckets/references/iam-permissions.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/specialized-skills/storage-skills/securing-s3-buckets/references/iam-permissions.md) enumerates exact S3 actions like `s3:PutObject`, `s3:GetObject`, and `s3:ListBucket` for storage operations.

Common permission categories include:

- **General validation**: `sts:GetCallerIdentity`, `iam:SimulatePrincipalPolicy`
- **Compute operations**: `ec2:DescribeInstances`, `ecs:RunTask`
- **Serverless functions**: `lambda:CreateFunction`, `lambda:InvokeFunction`
- **Infrastructure as code**: `cloudformation:CreateStack`, `cloudformation:DescribeStacks`
- **Storage management**: `s3:PutObject`, `s3:GetObject`, `s3:ListBucket`

### Observability and Audit Permissions

Because the MCP Server automatically emits metrics and logs, the execution role requires permissions to write to CloudWatch and CloudWatch Logs. This includes `cloudwatch:PutMetricData` for the `MCPRequestCount` metric and `logs:CreateLogGroup` / `logs:PutLogEvents` for operational logging.

## Configuring the MCP Server Connection

To connect an agent to the AWS MCP Server, configure your MCP-compatible client (such as Kiro) with the Server endpoint and metadata. The configuration is documented in the repository's [`README.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/README.md):

```json
{
  "mcpServers": {
    "aws": {
      "command": "uvx",
      "args": [
        "mcp-proxy-for-aws@1.6.3",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata", "AWS_REGION=us-west-2"
      ]
    }
  }
}

```

This configuration points the agent to the AWS MCP Server endpoint, enabling access to tools like `call_aws`, `aws___search_documentation`, and `aws___run_script`.

## Validating Permissions Before Execution

The Agent Toolkit enforces least-privilege by requiring agents to validate IAM permissions before attempting operations. Using the `aws iam simulate-principal-policy` action, agents can verify access without executing destructive commands. As shown in the CloudFormation pre-deploy validation script ([`skills/core-skills/aws-cloudformation/references/cloudformation-pre-deploy-validation.script.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/aws-cloudformation/references/cloudformation-pre-deploy-validation.script.md)), this pattern prevents permission-related failures:

```json
{
  "tool": "aws iam simulate-principal-policy",
  "arguments": {
    "PolicySourceArn": "arn:aws:iam::123456789012:role/AgentExecutionRole",
    "ActionNames": [
      "s3:PutObject",
      "lambda:CreateFunction"
    ]
  }
}

```

The response indicates whether the role can perform the requested actions, allowing the agent to surface clear error messages if permissions are missing.

## Security Architecture and Sandboxing

The AWS MCP Server implements multiple security layers beyond standard IAM authentication.

### Sandboxed Script Execution

All `aws___run_script` calls execute inside isolated containers that cannot access the host filesystem or network except via the AWS SDK. This containerization prevents accidental credential leakage and ensures that scripts cannot exfiltrate data or access unauthorized resources outside the AWS API.

### Audit Logging and CloudTrail Integration

Every request processed by the MCP Server generates CloudTrail events under the `MCPServer.CallAWS` event name. This integration allows security teams to monitor agent activity through existing AWS audit mechanisms, enforcing compliance and detecting anomalous behavior through standard CloudWatch Alarms or CloudTrail Lake queries.

## Summary

- **Authentication inheritance**: The AWS MCP Server uses the agent's existing AWS credentials from the SDK credential chain, requiring no separate authentication setup.
- **Permission attachment**: Attach IAM policies directly to the agent's execution role; the Server inherits these permissions when proxying requests.
- **Development baseline**: Use the `SignInLocalDevelopmentAccess` managed policy for local development, but implement service-specific policies for production.
- **Validation requirement**: Agents should call `iam:SimulatePrincipalPolicy` before executing operations to verify permissions.
- **Observability**: The Server automatically logs to CloudWatch (`MCPRequestCount`) and CloudTrail (`MCPServer.CallAWS`), requiring write permissions for these services.
- **Sandboxing**: Script execution occurs in isolated containers, preventing host access and credential leakage.

## Frequently Asked Questions

### What credentials does the AWS MCP Server use to authenticate?

The AWS MCP Server uses the **same credentials** that the agent's runtime environment already possesses, whether that is an IAM role attached to the compute instance or explicit access keys from an IAM user. The Server does not maintain separate credentials; instead, it inherits permissions from the agent's principal through the standard AWS SDK credential chain.

### Do I need to create a separate IAM user for the MCP Server?

No. Because the MCP Server acts as a proxy that forwards requests using the agent's existing identity, you do not need to create a separate IAM user or role for the Server itself. You only need to ensure that the agent's execution role has the necessary permissions for the specific AWS services it will invoke through tools like `call_aws`.

### How can I verify my agent has the correct permissions before running operations?

Use the `aws iam simulate-principal-policy` tool to validate permissions before executing potentially destructive operations. The AWS Agent Toolkit specifically recommends this approach in [`rules/aws-agent-rules.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/rules/aws-agent-rules.md), and many skills implement pre-flight checks that validate specific actions (such as `s3:PutObject` or `lambda:CreateFunction`) against the agent's role before proceeding.

### What is the minimum IAM policy required for local development with the MCP Server?

The toolkit provides a managed policy called **`SignInLocalDevelopmentAccess`** that grants the minimal permissions needed for developers to sign in and discover resources. As documented in [`skills/core-skills/signing-in-to-aws/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/signing-in-to-aws/SKILL.md), this policy allows basic MCP Server functionality without granting full administrative access, making it suitable for development environments where agents need to explore AWS services safely.