AWS
Connect AWS so agents can work with your AWS resources and look up AWS documentation.
The AWS MCP Server lets agents call AWS APIs in your account and look up current AWS documentation while they work.
For use cases and example prompts, see AWS for AI coding agents.
What is AWS?
Amazon Web Services (AWS) is Amazon's cloud platform for computing, storage, databases, and other services.
What agents can do
Once you connect AWS, agents can:
- Call AWS APIs to list and inspect resources, or make changes across services and regions
- Search and read AWS documentation, and follow AWS's step-by-step guides
- Check which regions offer a service or feature
Agents can only do what your AWS identity is allowed to do.
Changes agents make in AWS take effect right away, and some, like deleting a resource, can't be undone. Tell agents when they should only read.
Setup
Signing in with your AWS account is coming soon. For now, AWS connects with an access token that expires within an hour.
First, create a token with the AWS CLI. Your AWS identity needs the AWSMCPSignInOAuthAccessPolicy managed policy, or a policy that allows signin:CreateOAuth2Token. The root user doesn't need it. See AWS's guide.
aws signin create-oauth2-token-with-iam --grant-type client_credentials --resource aws-mcp.amazonaws.com --region us-east-1Then connect it in Superconductor: find AWS on the Connectors page, click Connect, and paste the accessToken value into the AWS MCP Access Token field. The Connectors guide explains Me and Workspace ownership and the independent private-chat and project access settings.
When the token expires, agents' AWS calls fail until you click Manage next to the connection, paste a new token, and click Save.
When to use it
Ask agents to use AWS when a ticket depends on how your AWS resources are set up, or needs a change made in AWS. For example:
List our S3 buckets in every region and flag any that allow public access. Don't change anything.Our order-sync Lambda function started timing out today. Check its recent CloudWatch logs and configuration in AWS, and tell me what changed.Search the AWS docs for how to add a dead-letter queue to an SQS queue, then add one to our staging jobs queue.Our new uploads page needs a private S3 bucket. Create one in us-east-1 with public access blocked, then update the app's config to use it.