AWS Single Sign-On MCP Server

When exposed as a set of tools via the Model Context Protocol (MCP) to an AI coding assistant, this API transforms from a backend service into a powerful, interactive interface for intelligent automation. The value lies in allowing the AI agent to dynamically query the current state of identity and access within the AWS environment based on natural language instructions from a developer. For instance, a developer can instruct the AI to "list all the AWS accounts I currently have access to" or "show me what roles I can assume in the data-production account," and the agent will invoke the appropriate MCP-bound tools (/assignment/accounts and /assignment/roles) to fetch and present this information. This immediate visibility helps developers understand their access scope without navigating complex console menus. The AI can also be directed to perform specific, context-aware tasks such as "fetch temporary credentials for the AdminRole in account 123456789012 so I can run a specific CLI command," which the agent would execute by calling /federation/credentials and securely providing the resulting temporary access key, secret key, and session token for the developer's immediate use. Furthermore, the /logout endpoint can be wrapped as a tool to allow the AI to "terminate my current session" as a security measure after a task is complete, adding a layer of operational hygiene.

Implementing this API as an MCP server requires strict adherence to security best practices, primarily centered on authentication and authorization. Although the direct API authentication method may be listed as "None" in the context of the endpoint definitions, this is because the API relies on the security of the federated user's initial session token (x-amz-sso_bearer_token), which must be securely obtained through the AWS SSO authentication flow and passed with each request. This bearer token is a short-lived, sensitive credential that represents the user's authenticated identity. Therefore, the MCP server itself must be configured to handle this token with extreme care—it should never be logged, persisted unnecessarily, or exposed in error messages. The underlying IAM Identity Center setup must follow the principle of least privilege, ensuring that the roles and account assignments granted to users provide only the permissions absolutely necessary for their function. When developers interact with the AI assistant, they are effectively operating within the constraints of their own Identity Center permissions; the AI cannot exceed the access granted to the authenticated user. Configuration guidelines should emphasize that the MCP server runs in a secure, ephemeral environment, the bearer token is passed securely between the client and the server, and all communication occurs over encrypted channels (HTTPS). Regular audits of Identity Center permission sets and account assignments are crucial to maintain a robust security posture.