How to Connect Claude Code to AWS with MCP

Connecting Claude Code to the AWS MCP Server lets Claude search AWS documentation, check which services exist in a Region and run AWS API calls through a sandboxed script tool. AWS manages the server and documents Claude Code setup for both of its sign-in methods.

Checked against: AWS's MCP Server setup guide and Claude Code's MCP documentation on 28 October 2026. eSEOspace did not run these steps; menus can change, so follow the vendor's page if it differs.

Before you start

You need Claude Code installed and an AWS account. Then pick a method. AWS's decision guide points to:

• OAuth if you want no local installs, use a single account and don't need read-only mode.
• SigV4 if you need read-only mode, work across several accounts in one session, need a default Region, or your organization restricts the OAuth sign-in permissions.

Pick a Region endpoint. AWS lists eight, including https://aws-mcp.us-east-1.api.aws/mcp (US East, N. Virginia), https://aws-mcp.us-west-2.api.aws/mcp (US West, Oregon) and https://aws-mcp.eu-west-1.api.aws/mcp (Europe, Ireland). The examples below use us-east-1.

If you already use the older AWS API MCP Server or AWS Knowledge MCP Server, AWS recommends removing them first to avoid tool conflicts. In Claude Code, use claude mcp remove <name>.

Steps

Option A: OAuth

1. Attach the managed policy that allows OAuth sign-in to your IAM role:

aws iam attach-role-policy \
  --role-name MyRole \
  --policy-arn arn:aws:iam::aws:policy/AWSMCPSignInOAuthAccessPolicy

1. Add the server. AWS lists Claude Code CLI among clients that "fully support OAuth with the default endpoint URL":

claude mcp add aws-mcp https://aws-mcp.us-east-1.api.aws/mcp --transport http

1. Start claude. AWS says that when you first invoke a tool, your client opens a browser window to AWS Sign-in. Sign in and authorize access.

AWS says access tokens stay valid for one hour and AWS Sign-in refreshes them for up to 12 hours. AWS also notes multi-profile switching isn't supported with OAuth.

Option B: SigV4 with the MCP Proxy for AWS

1. Install the AWS CLI 2.32.0 or later.
2. Sign in:

aws login

AWS says this auto-rotates credentials every 15 minutes for sessions up to 12 hours. Check them with aws sts get-caller-identity.

1. Install uv if you don't have it. AWS's macOS and Linux command:

curl -LsSf https://astral.sh/uv/install.sh | sh

1. Add the proxy to Claude Code with AWS's command:

claude mcp add-json aws-mcp '{"type":"stdio","command":"uvx","args":["mcp-proxy-for-aws-cli@latest","https://aws-mcp.us-east-1.api.aws/mcp","--metadata","AWS_REGION=us-west-2"],"env":{}}'

The endpoint Region picks the server you connect to. AWS_REGION sets the default Region for AWS operations; without it, AWS says operations default to us-east-1.

Check that it works

Run claude mcp list and look for ✔ Connected. AWS says the first connection can take a few minutes to initialize. In a session, run /mcp; AWS says you should see tools like aws___search_documentation and aws___retrieve_skill.

Example prompts:

• "What AWS Regions are available?" (AWS's own test prompt; uses aws___list_regions)
• "Search the AWS docs for how to set up S3 bucket versioning." (uses aws___search_documentation)
• "Is Amazon Bedrock available in eu-west-1?" (uses aws___get_regional_availability)

AWS's tools page also lists aws___run_script, which runs Python with AWS API access in a sandbox. That tool can change resources.

Permissions and safety

• IAM is the ceiling. The server acts with your credentials. Use a role scoped to what Claude needs, not an admin role.
• Read-only needs SigV4. AWS's decision guide says to choose SigV4 if you need to "hide write-capable tools from the agent entirely."
• Approve script runs. Keep aws___run_script on ask. Claude Code's permission rules target this server as mcp__aws-mcp__*, so you can allow documentation tools and still be asked about scripts.
• Audit. The AWS MCP server profile covers the IAM condition keys for agent-only policies and CloudTrail logging.

A broad role turns any prompt injection into a real incident. Read excessive permissions in MCP servers and the MCP Security Center.

If it doesn't work

AWS's troubleshooting table lists these errors:

• ExpiredTokenException. Temporary credentials expired. Run aws login again, or aws sso login --profile your-profile-name for SSO. Restart Claude Code afterward.
• UnrecognizedClientException. Credentials are invalid or from the wrong partition. Run aws sts get-caller-identity and reconfigure.
• InvalidSignatureException. Often clock skew. AWS says SigV4 needs your clock within 5 minutes of AWS servers.
• 400 error page after OAuth sign-in. Your IAM principal lacks signin:AuthorizeOAuth2Access and signin:CreateOAuth2Token. Attach AWSMCPSignInOAuthAccessPolicy.
• No AWS credentials found. Configure credentials, then reconnect.

AWS also says that if tool calls fail with credential errors on an unlisted client, append ?oauth=initialize to the URL to trigger the OAuth flow explicitly.

Next step

Read the AWS MCP server profile for the full tool list and IAM controls. More setups are in the connection guides hub. For a team rollout with scoped roles, see our Claude Code consulting service.

Frequently asked questions