Setting up the AWS MCP Server

This section outlines how you can set up your AWS MCP Server.

Prerequisites

Before you begin, you must ensure that you have set up an AWS account.

Set up the AWS MCP Server

To set up AWS MCP Server, use the steps in the following sections.

Step 1: (If applicable) Remove conflicting MCP servers

If you currently have AWS API MCP Server or AWS Knowledge MCP Server installed, we recommend removing them before setting up the AWS MCP Server to avoid tool conflicts that can confuse AI agents and reduce performance.

To remove existing AWS MCP servers:

Step 2: Configure AWS credentials

Before connecting to AWS MCP Server, you need to configure AWS credentials on your local machine. The server uses these credentials to authenticate your requests.

You can use the SigV4 via Proxy to authenticate the AWS MCP Server. SigV4 via Proxy uses your available AWS credentials and requires the MCP Proxy for AWS. The MCP Proxy for AWS handles SigV4 signing and credential management between your MCP client and the AWS MCP Server. No separate installation is required — the uvx mcp-proxy-for-aws@latest command in your MCP client configuration automatically downloads and runs the latest version of the proxy each time your MCP client starts. For the full list of configuration options, see the MCP Proxy for AWS repository on GitHub.

For detailed information about configuring AWS credentials, see Sign in with the aws login command in the AWS CLI User Guide.

Step 3: Configure your MCP client

AWS MCP Server is available in the following AWS Regions:

Replace the endpoint URL in the configuration examples below with the endpoint for your preferred Region. When configuring the SigV4 proxy, append /mcp to the base endpoint URL as shown in the following examples.

The endpoint Region determines which MCP server you connect to, while the AWS_REGION metadata parameter sets the default Region for the AWS operations the server performs on your behalf. These can be different — for example, you can connect to the us-east-1 endpoint while operating on resources in us-west-2.

Set your default AWS Region by adding the --metadata parameter with AWS_REGION. Without this setting, all AWS operations default to us-east-1.

Region behavior:

Kiro CLI

{
  "mcpServers": {
    "aws-mcp": {
      "command": "uvx",
      "timeout": 100000,
      "transport": "stdio",
      "args": [
        "mcp-proxy-for-aws@latest",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata", "AWS_REGION=us-west-2"
      ]
    }
  }
}

Kiro IDE

{
  "mcpServers": {
    "aws-mcp": {
      "command": "uvx",
      "timeout": 100000,
      "transport": "stdio",
      "args": [
        "mcp-proxy-for-aws@latest",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata", "AWS_REGION=us-west-2"
      ]
    }
  }
}

Cursor IDE

{
  "mcpServers": {
    "aws-mcp": {
      "command": "uvx",
      "args": [
        "mcp-proxy-for-aws@latest",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata", "AWS_REGION=us-west-2"
      ]
    }
  }
}

Claude Desktop

{
  "mcpServers": {
    "aws-mcp": {
      "command": "uvx",
      "args": [
        "mcp-proxy-for-aws@latest",
        "https://aws-mcp.us-east-1.api.aws/mcp",
        "--metadata", "AWS_REGION=us-west-2"
      ]
    }
  }
}

Codex

[mcp_servers.aws_mcp]
command = "uvx"
args = [
  "mcp-proxy-for-aws@latest",
  "https://aws-mcp.us-east-1.api.aws/mcp",
  "--metadata", "AWS_REGION=us-west-2"
]
startup_timeout_sec = 60

Step 4: Understand IAM authorization

AWS MCP Server does not require separate IAM permissions to invoke the MCP server. Authorization occurs at the AWS service level using your existing IAM roles and policies. When an AI agent calls the AWS MCP Server, the server authenticates your request and forwards it to the appropriate AWS service. The AWS service then authorizes the request using your existing IAM permissions, just as it would for any direct API call.

Two global condition context keys are automatically added to all requests made through the AWS MCP Server:

You can use these context keys in your IAM policies to allow or deny actions initiated through any AWS managed MCP server. For more information about these context keys, see IAM condition context keys in the IAM User Guide.

The following examples show how to restrict access using these context keys.

Deny all operations via any AWS managed MCP server

{
    "Effect": "Deny",
    "Action": "*",
    "Resource": "*",
    "Condition": {
        "Bool": {
            "aws:ViaAWSMCPService": "true"
        }
    }
}

Deny specific operations via a specific AWS managed MCP server

{
    "Effect": "Deny",
    "Action": ["s3:DeleteBucket", "s3:DeleteObject"],
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "aws:CalledViaAWSMCP": "aws-mcp.amazonaws.com"
        }
    }
}

Step 5: Test your connection

You should see tools like aws___search_documentation and aws___retrieve_skill listed. For more information about the tools, see Understanding the MCP Server tools.

Troubleshooting authentication errors

Authentication errors can prevent the MCP server from initializing, which results in AWS MCP tools not being available to AI agents. If your AI agent is not using AWS MCP tools, an expired or missing credential is the most likely cause.

Use the following table to identify and resolve common authentication errors.