Ctrlk
Sign up for FreeKnowledge Base
For the complete documentation index, see llms.txt. This page is also available as Markdown.

AWS MCP server

Install the predefined AWS MCP server behind the P0 AI Gateway, giving agents policy-scoped, credential-free access to the AWS CLI.

The AWS MCP server is a predefined server that runs the official AWS API MCP server (awslabs.aws-api-mcp-server) behind the P0 AI Gateway, wired up with P0's access controls. Agents can run AWS API calls (via call_aws, with suggest_aws_commands for help) without ever holding AWS credentials: the gateway obtains short-lived, policy-scoped access for each session using Workload Identity Federation, backed by the AWS OIDC component.

Prerequisites

  • A registered Gateway component, with the gateway deployed in your environment.

  • The AWS OIDC component installed on the AWS account you want agents to reach. This provides the federated identity the AWS MCP server uses as its credential provider, and it requires the base AWS integration with IAM management on the same account.

Configure the AWS MCP server

  1. Follow the shared steps in Add an MCP server to name the server and choose its gateway. On the configuration screen, set the following fields, then click Finish:

AWS MCP server configuration showing fields server identifier and gateway
AWS MCP server configuration showing AWS IAM federation as the credential source and the P0 AWS CLI predefined definition

  • Credential source: choose AWS IAM federation, then select the Federation provider: the AWS OIDC identity you installed. The gateway uses this identity's audience when it federates to AWS, and your account's IAM trust policy authorizes it.

  • Definition: choose P0, then select AWS CLI as the pre-defined server identifier.

A Federation provider maps one-to-one to a single AWS account. To give agents access to multiple AWS accounts, configure a separate AWS MCP server for each account, using that account's AWS OIDC identity as its Federation provider.

  1. The server now appears with the state Installed.

Installed servers list showing the new AWS server with state Installed

Once saved, P0 pushes the server definition to the gateway on its next sync, and the AWS MCP server becomes available to agents through the gateway URL. Access is granted per session and governed by your P0 policy; no long-lived AWS credentials are issued.

Next steps

  • Define the agentic access policies that determine which agents and users may call the AWS MCP server, and what they may do in AWS.

PreviousMCP server
NextGCP MCP server

Last updated