AWS MCP: How to Use AWS MCP Servers

aws-mcp/
├── src/
│   ├── auth/
│   │   ├── credentials.ts        # AWS credentials management
│   │   ├── role-assumption.ts    # IAM role management
│   │   └── policy-validator.ts   # Permission validation
│   ├── services/
│   │   ├── ec2-service.ts        # EC2 operations
│   │   ├── s3-service.ts         # S3 operations
│   │   ├── lambda-service.ts     # Lambda operations
│   │   └── cloudwatch-service.ts # CloudWatch operations
│   ├── tools/
│   │   ├── resource-tools.ts     # Resource management tools
│   │   ├── analytics-tools.ts    # Data analysis tools
│   │   ├── monitoring-tools.ts   # CloudWatch tools
│   │   └── iac-tools.ts          # Infrastructure-as-code tools
│   ├── resources/
│   │   ├── account-info.ts       # Account metadata resources
│   │   └── service-quotas.ts     # Service limits resources
│   └── server.ts                 # MCP server implementation
├── config/
│   └── aws-config.ts             # Configuration schema
└── package.json                  # Dependencies and scripts

# Set AWS credentials directly
export AWS_ACCESS_KEY_ID=your_access_key
export AWS_SECRET_ACCESS_KEY=your_secret_key
export AWS_REGION=us-west-2
 
# Optional session token for temporary credentials
export AWS_SESSION_TOKEN=your_session_token

# ~/.aws/credentials
[default]
aws_access_key_id = your_access_key
aws_secret_access_key = your_secret_key
region = us-west-2
 
[project-prod]
aws_access_key_id = production_access_key
aws_secret_access_key = production_secret_key
region = us-east-1

interface AssumeRoleOptions {
  roleArn: string;
  sessionName: string;
  durationSeconds?: number;
  externalId?: string;
}
 
// Implementation
async function assumeRole(options: AssumeRoleOptions): Promise<Credentials> {
  const sts = new STSClient({ region: process.env.AWS_REGION });
  const command = new AssumeRoleCommand({
    RoleArn: options.roleArn,
    RoleSessionName: options.sessionName,
    DurationSeconds: options.durationSeconds || 3600,
    ExternalId: options.externalId
  });
  
  const response = await sts.send(command);
  
  return {
    accessKeyId: response.Credentials.AccessKeyId,
    secretAccessKey: response.Credentials.SecretAccessKey,
    sessionToken: response.Credentials.SessionToken,
    expiration: response.Credentials.Expiration
  };
}

npm install -g aws-mcp

npx -y @smithery/cli install aws-mcp --client claude

git clone https://github.com/modelcontextprotocol/aws-mcp-server
cd aws-mcp-server
npm install
npm run build

{
  "authentication": {
    "profile": "default",
    "region": "us-east-1",
    "assumeRole": {
      "roleArn": "arn:aws:iam::123456789012:role/MCP-ExecutionRole",
      "sessionName": "MCP-Session",
      "durationSeconds": 3600
    }
  },
  "permissions": {
    "allowedServices": ["s3", "ec2", "lambda", "cloudwatch"],
    "allowedRegions": ["us-east-1", "us-west-2"],
    "readOnlyMode": false,
    "permissionBoundary": "arn:aws:iam::123456789012:policy/MCP-Boundary"
  },
  "operations": {
    "maxConcurrency": 5,
    "timeout": 30000,
    "retryCount": 3,
    "logLevel": "info"
  }
}

{
  "mcpServers": {
    "aws": {
      "command": "npx",
      "args": ["-y", "aws-mcp"],
      "env": {
        "AWS_PROFILE": "default",
        "AWS_REGION": "us-east-1",
        "AWS_ALLOWED_SERVICES": "s3,ec2,lambda,cloudwatch"
      }
    }
  }
}

{
  "github.copilot.chat.mcpServers": [
    {
      "name": "aws",
      "command": "npx",
      "args": ["-y", "aws-mcp"],
      "env": {
        "AWS_PROFILE": "default",
        "AWS_REGION": "us-east-1"
      }
    }
  ]
}

// List EC2 instances with specific tag
const instances = await tools.aws_ec2_describe_instances({
  region: "us-east-1",
  filters: [
    {
      name: "tag:Environment",
      values: ["Production"]
    },
    {
      name: "instance-state-name",
      values: ["running"]
    }
  ]
});
 
// Get CloudWatch metrics for these instances
const instanceIds = instances.Reservations.flatMap(r => 
  r.Instances.map(i => i.InstanceId)
);
 
const cpuMetrics = await Promise.all(instanceIds.map(instanceId => 
  tools.aws_cloudwatch_get_metrics({
    region: "us-east-1",
    namespace: "AWS/EC2",
    metricName: "CPUUtilization",
    dimensions: [{ name: "InstanceId", value: instanceId }],
    startTime: new Date(Date.now() - 24 * 60 * 60 * 1000), // Last 24 hours
    endTime: new Date(),
    period: 300, // 5-minute intervals
    statistics: ["Average"]
  })
));
 
// Identify instances with high CPU usage
const highCpuInstances = cpuMetrics
  .filter(metric => {
    const datapoints = metric.Datapoints || [];
    const recentDatapoints = datapoints.slice(-12); // Last hour
    const avgCpu = recentDatapoints.reduce((sum, dp) => sum + dp.Average, 0) / 
                  (recentDatapoints.length || 1);
    return avgCpu > 80; // CPU above 80%
  })
  .map(metric => metric.Dimensions.find(d => d.Name === "InstanceId").Value);
 
// Scale up instances with high CPU
await Promise.all(highCpuInstances.map(instanceId => 
  tools.aws_ec2_control_instance({
    region: "us-east-1",
    instanceId,
    action: "stop"
  }).then(() => 
    // Update instance type
    tools.aws_ec2_modify_instance({
      region: "us-east-1",
      instanceId,
      instanceType: "m5.2xlarge"
    })
  ).then(() =>
    // Restart instance
    tools.aws_ec2_control_instance({
      region: "us-east-1",
      instanceId,
      action: "start"
    })
  )
));

// Retrieve CloudFormation template from S3
const templateObject = await tools.aws_s3_get_object({
  bucket: "company-templates",
  key: "infrastructure/web-stack.yaml"
});
 
const templateBody = templateObject.Body.toString('utf-8');
 
// Create or update CloudFormation stack
const stackResult = await tools.aws_cloudformation_create_stack({
  stackName: "web-production",
  templateBody,
  parameters: [
    {
      parameterKey: "EnvironmentType",
      parameterValue: "Production"
    },
    {
      parameterKey: "InstanceType",
      parameterValue: "t3.large"
    }
  ],
  capabilities: ["CAPABILITY_IAM", "CAPABILITY_NAMED_IAM"],
  tags: [
    { key: "Project", value: "WebPlatform" },
    { key: "Environment", value: "Production" }
  ]
});
 
// Monitor stack creation progress
const stackId = stackResult.StackId;
let stackStatus = "CREATE_IN_PROGRESS";
 
while (["CREATE_IN_PROGRESS", "UPDATE_IN_PROGRESS"].includes(stackStatus)) {
  await new Promise(resolve => setTimeout(resolve, 10000)); // Wait 10 seconds
  
  const stackInfo = await tools.aws_cloudformation_describe_stacks({
    stackName: stackId
  });
  
  stackStatus = stackInfo.Stacks[0].StackStatus;
  console.log(`Stack status: ${stackStatus}`);
}
 
// Get outputs from the stack
const outputs = stackInfo.Stacks[0].Outputs;
const apiEndpoint = outputs.find(o => o.OutputKey === "ApiEndpoint").OutputValue;
const databaseEndpoint = outputs.find(o => o.OutputKey === "DatabaseEndpoint").OutputValue;

class CostController {
  private readonly serviceLimits = {
    ec2: {
      maxInstances: 5,
      allowedTypes: ['t3.micro', 't3.small', 't3.medium']
    },
    s3: {
      maxBucketCount: 3,
      maxStorageGB: 100
    },
    lambda: {
      maxConcurrentExecutions: 10,
      maxMemoryMB: 512
    }
  };
  
  async validateEC2Launch(instanceType: string, count: number): Promise<boolean> {
    // Check instance type is allowed
    if (!this.serviceLimits.ec2.allowedTypes.includes(instanceType)) {
      throw new Error(`Instance type ${instanceType} is not allowed`);
    }
    
    // Check instance count doesn't exceed limit
    const existingInstances = await countRunningInstances();
    if (existingInstances + count > this.serviceLimits.ec2.maxInstances) {
      throw new Error(`Cannot launch ${count} new instances: would exceed limit of ${this.serviceLimits.ec2.maxInstances}`);
    }
    
    // Check estimated cost is within budget
    const estimatedCost = await calculateEstimatedCost(instanceType, count);
    if (estimatedCost > this.dailyBudget) {
      throw new Error(`Estimated cost ${estimatedCost} exceeds daily budget of ${this.dailyBudget}`);
    }
    
    return true;
  }
  
  // Additional validation methods for other services...
}

class ThrottleHandler {
  private requestCounts: Map<string, number> = new Map();
  private lastReset: number = Date.now();
  private readonly resetInterval: number = 60000; // 1 minute in ms
  
  async executeWithThrottling<T>(
    serviceKey: string,
    operation: () => Promise<T>,
    maxAttempts: number = 3
  ): Promise<T> {
    this.updateCounts();
    
    const currentCount = this.requestCounts.get(serviceKey) || 0;
    this.requestCounts.set(serviceKey, currentCount + 1);
    
    let attempt = 0;
    let lastError;
    
    while (attempt < maxAttempts) {
      try {
        return await operation();
      } catch (error) {
        if (error.name === 'ThrottlingException' || 
            error.name === 'TooManyRequestsException' ||
            error.code === 'RequestLimitExceeded') {
          
          attempt++;
          lastError = error;
          
          if (attempt < maxAttempts) {
            // Exponential backoff with jitter
            const delayMs = Math.min(
              1000 * Math.pow(2, attempt) + Math.random() * 100,
              30000 // Max 30 seconds
            );
            await new Promise(resolve => setTimeout(resolve, delayMs));
            continue;
          }
        }
        
        throw error; // Non-throttling error or max attempts reached
      }
    }
    
    throw lastError;
  }
  
  private updateCounts() {
    const now = Date.now();
    if (now - this.lastReset >= this.resetInterval) {
      this.requestCounts.clear();
      this.lastReset = now;
    }
  }
}

class CredentialRefresher {
  private credentials: AWS.Credentials | null = null;
  private expirationTime: number = 0;
  private refreshPromise: Promise<AWS.Credentials> | null = null;
  
  async getCredentials(): Promise<AWS.Credentials> {
    const now = Date.now();
    
    // If credentials are still valid, return them
    if (this.credentials && now < this.expirationTime - 15 * 60 * 1000) {
      return this.credentials;
    }
    
    // If refresh is in progress, wait for it
    if (this.refreshPromise) {
      return this.refreshPromise;
    }
    
    // Start credential refresh
    this.refreshPromise = this.refreshCredentials();
    
    try {
      this.credentials = await this.refreshPromise;
      
      // Set expiration time with 15-minute buffer
      if (this.credentials.expireTime) {
        this.expirationTime = this.credentials.expireTime.getTime();
      } else {
        // Default to 1 hour if no expiration is set
        this.expirationTime = now + 60 * 60 * 1000;
      }
      
      return this.credentials;
    } finally {
      this.refreshPromise = null;
    }
  }
  
  private async refreshCredentials(): Promise<AWS.Credentials> {
    // Implement appropriate credential refresh logic based on 
    // authentication method (IAM role, STS, etc.)
    
    // Example: Assuming IAM role
    if (process.env.AWS_ROLE_ARN) {
      const sts = new AWS.STS();
      const result = await sts.assumeRole({
        RoleArn: process.env.AWS_ROLE_ARN,
        RoleSessionName: 'MCP-Session'
      }).promise();
      
      return new AWS.Credentials({
        accessKeyId: result.Credentials.AccessKeyId,
        secretAccessKey: result.Credentials.SecretAccessKey,
        sessionToken: result.Credentials.SessionToken,
        expireTime: result.Credentials.Expiration
      });
    }
    
    // Default: Load from environment or shared credentials file
    return new AWS.SharedIniFileCredentials({
      profile: process.env.AWS_PROFILE || 'default'
    });
  }
}