AWS MCP
Query and manage AWS resources: EC2, S3, Lambda, CloudFormation, CloudWatch, and more. High blast-radius — scope your IAM permissions carefully.
Overview
| Catalog ID | mcp-aws |
| Category | cloud |
| Auth method | API key |
| Blast radius | high |
| Trust | Verified — published by cendriix |
| Version | 1.2.0 |
| Regions | us-east-1, eu-west-1, ap-southeast-1 |
Tools
| Tool | Description |
|---|---|
describe_instances | Describe EC2 instances. |
list_s3_buckets | List S3 buckets. |
invoke_lambda | Invoke a Lambda function. |
describe_stacks | Describe CloudFormation stacks. |
get_log_events | Get CloudWatch log events. |
Tool parameters
describe_instances
Describe EC2 instances.
| Parameter | Type | Description | |
|---|---|---|---|
instance_ids | array | optional | Instance IDs (optional, all if omitted) |
region | string | optional | AWS region |
invoke_lambda
Invoke a Lambda function.
| Parameter | Type | Description | |
|---|---|---|---|
function_name | string | required | Function name or ARN |
payload | object | optional | JSON payload |
invocation_type | string | optional | Invocation type |
describe_stacks
Describe CloudFormation stacks.
| Parameter | Type | Description | |
|---|---|---|---|
stack_name | string | optional | Stack name or ID |
region | string | optional | AWS region |
get_log_events
Get CloudWatch log events.
| Parameter | Type | Description | |
|---|---|---|---|
log_group | string | required | Log group name |
log_stream | string | optional | Log stream name |
start_time | integer | optional | Start time (epoch ms) |
limit | integer | optional | Max events |
Installing
- Create a dedicated IAM user (e.g. cendriix-mcp) in your AWS account.
- Attach a scoped IAM policy — use ReadOnlyAccess or a custom policy limited to the services you need.
- Generate an Access Key ID and Secret Access Key for the IAM user.
- Paste the Access Key ID and Secret Access Key in the fields below.
- Cendriix will validate connectivity and list available tools.
Authentication. Paste your API key after installing. It is validated, then encrypted at rest in a secrets vault scoped to your tenant.
Blast radius
This MCP is classified high. This MCP can modify infrastructure or reach sensitive data. High-blast-radius tool calls require explicit approval when your organisation enables approval gates in Policies.
Every tool invocation is recorded in your Audit Log. You can remove this MCP at any time from Settings → MCPs, which revokes tool access immediately.
Further reading
- MCP Marketplace — browse and install MCPs
- Policies & Guardrails — approval gates and blast radius
- Audit Log — review tool invocations
Last updated on