AWS MCP Server Authentication and Required IAM Permissions for Agent Operations

The AWS MCP Server authenticates using the agent's existing AWS credentials and requires service-specific IAM permissions attached to the execution role, with minimal development access available through the SignInLocalDevelopmentAccess managed policy.

The AWS MCP (Model Context Protocol) Server is the central component in the aws/agent-toolkit-for-aws repository that enables AI coding agents to safely issue AWS API calls, execute sandboxed Python scripts, and retrieve live AWS documentation. Understanding how authentication flows through this architecture and which IAM permissions are required is critical for deploying secure, least-privilege agent workflows.

How Authentication Flows Through the AWS MCP Server

The AWS MCP Server acts as a secure proxy between your agent and AWS services, inheriting credentials from the agent's runtime environment rather than maintaining separate authentication secrets.

Agent to MCP Server Communication

When an agent invokes tools like call_aws or aws___run_script, it transmits JSON-encoded requests over TLS to the MCP Server endpoint. According to the toolkit's architectural rules in rules/aws-agent-rules.md, agents prefer the AWS MCP Server for all AWS interactions, falling back to AWS CLI only when the server is unavailable. The MCP Server validates that requests are well-formed before processing but does not require separate IAM permissions at this layer—authentication relies entirely on the credentials the agent's compute environment already possesses (either an IAM role attached to the instance or explicit access keys).

MCP Server to AWS Service Proxy

The MCP Server forwards validated requests to target AWS services using the same credentials presented by the agent. This means the Server inherits whatever IAM policies are attached to the agent's principal. As implemented in the repository, every request is automatically logged to CloudWatch (metric MCPRequestCount) and CloudTrail (event MCPServer.CallAWS), enabling audit trails for all agent activity.

Identity Inheritance and the SDK Credential Chain

The agent's IAM identity is derived from the standard AWS SDK credential chain. When the MCP Server executes call_aws operations, it uses the caller's identity to sign requests to the target service. This design ensures that access control remains consistent—if the agent's role lacks s3:PutObject, the MCP Server cannot execute that operation on the agent's behalf, regardless of the Server's own configuration.

Required IAM Permissions for MCP Server Operations

Effective IAM policies must cover development sign-in capabilities, service-specific actions, and observability requirements.

Minimal Development Permissions

The toolkit ships with a managed policy called SignInLocalDevelopmentAccess that grants developers the minimal permissions needed to sign in and discover resources without full administrative rights. As documented in skills/core-skills/signing-in-to-aws/SKILL.md, this policy allows agents to use the MCP Server for basic exploration and validation tasks. For production deployments, you should attach specific service permissions rather than relying on this minimal starter policy.

Service-Specific Action Permissions

The exact IAM actions required depend entirely on which AWS services the agent will manipulate through the call_aws tool. Each skill in the repository documents its specific permission requirements—for example, skills/specialized-skills/storage-skills/securing-s3-buckets/references/iam-permissions.md enumerates exact S3 actions like s3:PutObject, s3:GetObject, and s3:ListBucket for storage operations.

Common permission categories include:

• General validation: sts:GetCallerIdentity, iam:SimulatePrincipalPolicy
• Compute operations: ec2:DescribeInstances, ecs:RunTask
• Serverless functions: lambda:CreateFunction, lambda:InvokeFunction
• Infrastructure as code: cloudformation:CreateStack, cloudformation:DescribeStacks
• Storage management: s3:PutObject, s3:GetObject, s3:ListBucket

Observability and Audit Permissions

Because the MCP Server automatically emits metrics and logs, the execution role requires permissions to write to CloudWatch and CloudWatch Logs. This includes cloudwatch:PutMetricData for the MCPRequestCount metric and logs:CreateLogGroup / logs:PutLogEvents for operational logging.

Configuring the MCP Server Connection

To connect an agent to the AWS MCP Server, configure your MCP-compatible client (such as Kiro) with the Server endpoint and metadata. The configuration is documented in the repository's README.md:

{
  "mcpServers": {
    "aws": {
      "command": "uvx",
      "args": [
        "mcp-proxy-for-aws@1.6.3",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata", "AWS_REGION=us-west-2"
      ]
    }
  }
}

This configuration points the agent to the AWS MCP Server endpoint, enabling access to tools like call_aws, aws___search_documentation, and aws___run_script.

Validating Permissions Before Execution

The Agent Toolkit enforces least-privilege by requiring agents to validate IAM permissions before attempting operations. Using the aws iam simulate-principal-policy action, agents can verify access without executing destructive commands. As shown in the CloudFormation pre-deploy validation script (skills/core-skills/aws-cloudformation/references/cloudformation-pre-deploy-validation.script.md), this pattern prevents permission-related failures:

{
  "tool": "aws iam simulate-principal-policy",
  "arguments": {
    "PolicySourceArn": "arn:aws:iam::123456789012:role/AgentExecutionRole",
    "ActionNames": [
      "s3:PutObject",
      "lambda:CreateFunction"
    ]
  }
}

The response indicates whether the role can perform the requested actions, allowing the agent to surface clear error messages if permissions are missing.

Security Architecture and Sandboxing

The AWS MCP Server implements multiple security layers beyond standard IAM authentication.

Sandboxed Script Execution

All aws___run_script calls execute inside isolated containers that cannot access the host filesystem or network except via the AWS SDK. This containerization prevents accidental credential leakage and ensures that scripts cannot exfiltrate data or access unauthorized resources outside the AWS API.

Audit Logging and CloudTrail Integration

Every request processed by the MCP Server generates CloudTrail events under the MCPServer.CallAWS event name. This integration allows security teams to monitor agent activity through existing AWS audit mechanisms, enforcing compliance and detecting anomalous behavior through standard CloudWatch Alarms or CloudTrail Lake queries.

Summary

• Authentication inheritance: The AWS MCP Server uses the agent's existing AWS credentials from the SDK credential chain, requiring no separate authentication setup.
• Permission attachment: Attach IAM policies directly to the agent's execution role; the Server inherits these permissions when proxying requests.
• Development baseline: Use the SignInLocalDevelopmentAccess managed policy for local development, but implement service-specific policies for production.
• Validation requirement: Agents should call iam:SimulatePrincipalPolicy before executing operations to verify permissions.
• Observability: The Server automatically logs to CloudWatch (MCPRequestCount) and CloudTrail (MCPServer.CallAWS), requiring write permissions for these services.
• Sandboxing: Script execution occurs in isolated containers, preventing host access and credential leakage.

Frequently Asked Questions

What credentials does the AWS MCP Server use to authenticate?

The AWS MCP Server uses the same credentials that the agent's runtime environment already possesses, whether that is an IAM role attached to the compute instance or explicit access keys from an IAM user. The Server does not maintain separate credentials; instead, it inherits permissions from the agent's principal through the standard AWS SDK credential chain.

Do I need to create a separate IAM user for the MCP Server?

No. Because the MCP Server acts as a proxy that forwards requests using the agent's existing identity, you do not need to create a separate IAM user or role for the Server itself. You only need to ensure that the agent's execution role has the necessary permissions for the specific AWS services it will invoke through tools like call_aws.

How can I verify my agent has the correct permissions before running operations?

Use the aws iam simulate-principal-policy tool to validate permissions before executing potentially destructive operations. The AWS Agent Toolkit specifically recommends this approach in rules/aws-agent-rules.md, and many skills implement pre-flight checks that validate specific actions (such as s3:PutObject or lambda:CreateFunction) against the agent's role before proceeding.

What is the minimum IAM policy required for local development with the MCP Server?

The toolkit provides a managed policy called SignInLocalDevelopmentAccess that grants the minimal permissions needed for developers to sign in and discover resources. As documented in skills/core-skills/signing-in-to-aws/SKILL.md, this policy allows basic MCP Server functionality without granting full administrative access, making it suitable for development environments where agents need to explore AWS services safely.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}