# AWS

<div style={{maxWidth: '720px'}}>
![The AWS connector in Workspace Settings, for inspecting and changing AWS resources and searching AWS documentation, with a Connect button](</docs/_next/static/media/aws-connector.07qqwzd8_wk2h.jpg>)
</div>

The [AWS MCP Server](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/understanding-mcp-server-tools.html) lets agents call AWS APIs in your account and look up current AWS documentation while they work.

For use cases and example prompts, see [AWS for AI coding agents](/integrations/aws).

## What is AWS? [#what-is-aws]

[Amazon Web Services (AWS)](https://aws.amazon.com) is Amazon's cloud platform for computing, storage, databases, and other services.

## What agents can do [#what-agents-can-do]

Once you connect AWS, agents can:

- Call AWS APIs to list and inspect resources, or make changes across services and regions
- Search and read AWS documentation, and follow AWS's step-by-step guides
- Check which regions offer a service or feature

Agents can only do what your AWS identity is allowed to do.

<Callout>
Changes agents make in AWS take effect right away, and some, like deleting a resource, can't be undone. Tell agents when they should only read.
</Callout>

## Setup [#setup]

<Callout type="info">
Signing in with your AWS account is coming soon. For now, AWS connects with an access token that expires within an hour.
</Callout>

First, create a token with the AWS CLI. Your AWS identity needs the `AWSMCPSignInOAuthAccessPolicy` managed policy, or a policy that allows `signin:CreateOAuth2Token`. The root user doesn't need it. See [AWS's guide](https://docs.aws.amazon.com/signin/latest/userguide/aws-mcp-server.html#aws-mcp-server-non-interactive).

```bash
aws signin create-oauth2-token-with-iam --grant-type client_credentials --resource aws-mcp.amazonaws.com --region us-east-1
```

Then connect it in Superconductor: find **AWS** on the [Connectors page](https://www.superconductor.com/workspaces/default/connectors), click **Connect**, and paste the `accessToken` value into the **AWS MCP Access Token** field. The [Connectors guide](/docs/integrations/connectors#fill-in-the-connection-details) explains **Me** and **Workspace** ownership and the independent private-chat and project access settings.

When the token expires, agents' AWS calls fail until you click **Manage** next to the connection, paste a new token, and click **Save**.

## When to use it [#when-to-use-it]

Ask agents to use AWS when a ticket depends on how your AWS resources are set up, or needs a change made in AWS. For example:

```text
List our S3 buckets in every region and flag any that allow public access. Don't change anything.
```

```text
Our order-sync Lambda function started timing out today. Check its recent CloudWatch logs and configuration in AWS, and tell me what changed.
```

```text
Search the AWS docs for how to add a dead-letter queue to an SQS queue, then add one to our staging jobs queue.
```

```text
Our new uploads page needs a private S3 bucket. Create one in us-east-1 with public access blocked, then update the app's config to use it.
```