US
Cloud

Use AWS MCP Server for Independent AWS API

Use the MCP server to access AWS APIs independently, leveraging amazon-q-cli's use_aws tool for general AWS API workflows.

View on GitHub
Quick Install
npx -y @runjivu/use_aws_mcp

Overview

The MCP (Model Context Protocol) server lets developers expose AWS APIs to language models and other tools through a controlled, local endpoint. Instead of giving models direct AWS credentials or embedding AWS SDK calls inside the model runtime, the MCP server accepts well-defined MCP requests and forwards them to AWS on the caller’s behalf. This enables safer, auditable, and portable interactions between agent frameworks and AWS services.

This repo pairs particularly well with amazon-q-cli’s use_aws tool: use_aws emits general AWS API workflows and can target an MCP-compliant server instead of talking directly to AWS. Running an MCP server gives you an independent, local gateway that centralizes credential handling, request validation, logging, and service allowlists for model-driven workflows.

Features

  • Acts as an MCP-compatible gateway that proxies authorized requests to AWS services
  • Centralized credential management (env vars, IAM role, or STS)
  • Allowlist/denylist support for services and API actions
  • Request logging and basic auditing for model-originated calls
  • Easy integration with amazon-q-cli’s use_aws for common AWS workflows
  • Runs locally or inside containers for development and CI use

Installation / Configuration

Clone and run the server locally:

git clone https://github.com/runjivu/use_aws_mcp.git
cd use_aws_mcp
# Python example (if provided in repo)
pip install -r requirements.txt
python server.py --config config.json

Run with Docker (example):

docker build -t use-aws-mcp .
docker run -p 3000:3000 \
  -e AWS_ACCESS_KEY_ID=AKIA... \
  -e AWS_SECRET_ACCESS_KEY=... \
  -e AWS_REGION=us-west-2 \
  -e MCP_TOKEN=your-token \
  use-aws-mcp

Example JSON configuration (config.json):

{
  "listen": "0.0.0.0:3000",
  "mcp_token": "your-token",
  "allowed_services": ["s3", "sts", "ec2"],
  "audit_log": "/var/log/use_aws_mcp/audit.log",
  "max_request_size": 1048576
}

Common environment variables supported:

  • AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN — standard AWS credentials
  • AWS_REGION — default AWS region
  • MCP_TOKEN — simple bearer token for authenticating clients to the MCP server

Configuration options at a glance:

OptionTypeDescription
listenstringHost:port for server binding
mcp_tokenstringToken required to authenticate incoming MCP clients
allowed_servicesarrayList of AWS services the server will forward
audit_logstringPath to write request/audit records
max_request_sizeintMax MCP request size in bytes

Available Resources

  • GitHub repository: https://github.com/runjivu/use_aws_mcp
  • amazon-q-cli (use_aws tool) — integrates with the MCP server to drive AWS workflows
  • AWS SDKs and CLI — underlying clients used by the server to forward requests
  • Model Context Protocol (MCP) — the protocol the server implements for model/tool communication

(Consult the repository README and source for the exact MCP request/response schema supported by this server.)

Use Cases

  1. Local model-driven development

    • Run the MCP server locally during development. Use amazon-q-cli use_aws with the server to let a model prototype list S3 buckets or describe EC2 instances without exposing direct credentials to the model.

    Example:

    amazon-q-cli use_aws --mcp-url http://localhost:3000 --mcp-token your-token s3 list-buckets

  2. Secure production agent execution

    • Deploy the MCP server into a controlled network segment. Agents or LLMs call the MCP endpoint; the server enforces allowed services/actions and logs all requests for auditing.

  3. CI/CD and automated tests

    • Run the MCP server inside CI containers with short-lived credentials (via STS). Tests and automation can run use_aws workflows against the server to validate logic against real AWS APIs while centralizing credential rotation.

  4. Auditable automation workflows

    • Centralize AWS operations initiated by models or automation tools, making it straightforward to capture who asked for what and when — useful for compliance and debugging.

Example: curl call (diagnostic)

You can validate the server is up with a simple health or ping endpoint (if provided by the implementation):

curl -H "Authorization: Bearer your-token" http://localhost:3000/health
# expected: {"status":"ok"}

For MCP-specific calls, use the client tooling (amazon-q-cli use_aws) which understands the MCP request format and will send properly structured requests.

Notes and Best Practices

  • Keep the MCP token and AWS credentials out of source control; use environment variables or secrets management.
  • Limit allowed services and actions to the minimum required for your model workflows.
  • Enable request/audit logging in production to keep an audit trail of model-driven operations.
  • If you require multi-tenant use, run separate MCP instances or extend the server to support per-tenant authentication and credential scoping.

For full implementation details, supported MCP request formats and any extra flags, see the repository: https://github.com/runjivu/use_aws_mcp.

Tags:cloud