Skip to main content
Back to all guides
Guide

AWS MCP Servers for Claude Code: A Practical Setup Guide

How I set up AWS MCP servers with Claude Code to query infrastructure, estimate costs, and generate IaC from the terminal — with read-only safety modes baked in.

Justin Pursati
8 min read
AWSMCP ServersClaude CodeAIInfrastructureAutomationDeveloper Tools

🚀 AWS MCP Servers for Claude Code: A Practical Setup Guide

How I wire AWS MCP servers into Claude Code for day-to-day infrastructure work

A guide by Justin Pursati, Sati Technology, Inc.

AWS Solutions Architect / Developer | SaaS builder

📋 This Guide is for Claude Code: This guide specifically shows how to set up AWS MCP servers with Claude Code (claude.ai/code). All commands use the claude CLI that comes with Claude Code.

💡 Developer-Friendly: All commands are presented in separate, easily copy-pasteable bash blocks for your convenience.

🚀 Why I Use These

These MCP (Model Context Protocol) servers let Claude Code work directly against AWS, with read-only modes available everywhere. In practice they let me:

  • ✅ Query infrastructure without opening the console
  • ✅ Analyze costs before deploying resources
  • ✅ Generate IaC with built-in security scanning
  • ✅ Check compliance with read-only safety modes
  • ✅ Document systems from the live account

Bottom line: less time clicking around the AWS console, more time building.

📋 Prerequisites

Before starting this guide, ensure you have:

  1. Claude Code installed - Download from claude.ai/code
  2. AWS CLI configured with valid credentials (aws configure)
  3. Terminal access to run the claude CLI commands

💡 Note: This guide uses the claude command-line tool that comes with Claude Code. All MCP servers will be integrated directly into your Claude Code environment.

⚡ 5-Minute Quick Start

⚠️ CRITICAL FIRST STEP: You MUST install the AWS Core Server before any other AWS MCP servers! Also, make sure you set the values for the Environment Variables before adding ANY servers!

Step 1: Set Your Environment Variables

Copy and paste this entire block into your terminal:

export AWS_PROFILE="your-aws-profile"
export AWS_REGION="us-east-1"
export MCP_LOG_LEVEL="ERROR"
export DDB_READONLY="true"
export MCP_SAFE_MODE="true"
export LAMBDA_PREFIX="prod-"
export COST_THRESHOLD="1000"

To make these permanent, add the above to your shell profile (~/.bashrc, ~/.zshrc, or ~/.profile).

Step 2: Install AWS Core Server (REQUIRED FIRST!)

⚠️ IMPORTANT: Always install the AWS Core Server before any other AWS MCP servers.

claude mcp add awslabs.core-mcp-server -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -- uvx awslabs.core-mcp-server@latest

Step 3: Install Your First Functional Server

# Enable AI-powered DynamoDB queries (safe read-only mode)
claude mcp add awslabs.dynamodb-mcp-server -e DDB-MCP-READONLY=$DDB_READONLY -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -- uvx awslabs.dynamodb-mcp-server@latest

That's it! You can now ask Claude to query your DynamoDB tables safely.

💼 Common Business Scenarios

Scenario 1: Cost Analysis Before Deployment

"What will this infrastructure cost us?"

claude mcp add awslabs.cost-analysis-mcp-server -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -e AWS_PROFILE=$AWS_PROFILE -- uvx awslabs.cost-analysis-mcp-server@latest

Business Value: Get accurate cost estimates before committing resources. No more budget surprises.

Scenario 2: Safe Production Access for Developers

"Let developers query production data without risk" — Don't use this in a regulated industry like HIPAA or SOC2 compliant environments without having the proper permission or BAA in place. *There are other ways to achieve this that meet the requirements of the regulations.

export PROD_PROFILE="production-readonly"
export DDB_READONLY="true"
claude mcp add awslabs.dynamodb-mcp-server -e DDB-MCP-READONLY=$DDB_READONLY -e AWS_PROFILE=$PROD_PROFILE -e AWS_REGION=$AWS_REGION -- uvx awslabs.dynamodb-mcp-server@latest

Business Value: Developers get answers without production access, which means fewer one-off tickets to whoever owns the account.

Scenario 3: Infrastructure Documentation Generator

"Document an AWS setup straight from the live account"

Step 1: Install Core Server (if not already installed)

claude mcp add awslabs.core-mcp-server -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -- uvx awslabs.core-mcp-server@latest

Step 2: Add documentation server

claude mcp add awslabs.aws-documentation-mcp-server -e AWS_DOCUMENTATION_PARTITION=aws -- uvx awslabs.aws-documentation-mcp-server@latest

Business Value: Always up-to-date documentation. Perfect for audits and onboarding.

Scenario 4: Serverless Development Accelerator

"Go from idea to a deployed Lambda function without leaving the terminal"

claude mcp add awslabs.aws-serverless-mcp-server -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -- uvx awslabs.aws-serverless-mcp-server@latest --allow-write --allow-sensitive-data-access

Business Value: AI-assisted serverless development. From idea to deployment in minutes.

📚 Complete Server Catalog

🎯 Core Server (INSTALL THIS FIRST!)

AWS Core MCP Server - Required Foundation

claude mcp add awslabs.core-mcp-server -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -- uvx awslabs.core-mcp-server@latest

Purpose: Manages and coordinates all other AWS MCP servers. This is the foundation that enables other servers to work properly.

🏗️ Infrastructure as Code

AWS CDK Server - Best Practices Built-In

Install CDK CLI first:

npm install -g aws-cdk

Add CDK server with security scanning:

claude mcp add awslabs.cdk-mcp-server -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -- uvx awslabs.cdk-mcp-server@latest

Features: CDK patterns, security scanning with CDK Nag, compliance validation

Terraform Server - Infrastructure with Guardrails

claude mcp add awslabs.terraform-mcp-server -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -- uvx awslabs.terraform-mcp-server@latest

Features: Terraform workflows, Checkov security scanning, AWS best practices

💾 Database Access

DynamoDB Server - NoSQL with Safety

Safe mode (recommended):

claude mcp add awslabs.dynamodb-mcp-server -e DDB-MCP-READONLY=$DDB_READONLY -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -- uvx awslabs.dynamodb-mcp-server@latest

Full access (use with caution):

claude mcp add awslabs.dynamodb-mcp-server -e DDB-MCP-READONLY=false -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -- uvx awslabs.dynamodb-mcp-server@latest

⚡ Compute & Serverless

Lambda Tool Server - Function as a Service

Basic setup:

claude mcp add awslabs.lambda-tool-mcp-server -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -- uvx awslabs.lambda-tool-mcp-server@latest

Filtered by prefix:

claude mcp add awslabs.lambda-tool-mcp-server -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -e FUNCTION_PREFIX=$LAMBDA_PREFIX -- uvx awslabs.lambda-tool-mcp-server@latest

Specific functions only:

claude mcp add awslabs.lambda-tool-mcp-server -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -e FUNCTION_LIST="billing-calculator,user-auth,data-processor" -- uvx awslabs.lambda-tool-mcp-server@latest

AWS Serverless Server - SAM CLI Integration

Read-only mode (default):

claude mcp add awslabs.aws-serverless-mcp-server -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -- uvx awslabs.aws-serverless-mcp-server@latest

Write-enabled mode (use with caution):

claude mcp add awslabs.aws-serverless-mcp-server -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -- uvx awslabs.aws-serverless-mcp-server@latest --allow-write --allow-sensitive-data-access

Features: Complete serverless application lifecycle management with SAM CLI

EKS Server - Kubernetes Made Simple

Read-only mode (default):

claude mcp add awslabs.eks-mcp-server -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -- uvx awslabs.eks-mcp-server@latest

Full cluster management (production use with caution):

claude mcp add awslabs.eks-mcp-server -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -e AWS_PROFILE=$AWS_PROFILE -e AWS_REGION=$AWS_REGION -- uvx awslabs.eks-mcp-server@latest --allow-write --allow-sensitive-data-access

📊 Analytics & Documentation

AWS Documentation Server - Always Current Docs

claude mcp add awslabs.aws-documentation-mcp-server -e AWS_DOCUMENTATION_PARTITION=aws -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -- uvx awslabs.aws-documentation-mcp-server@latest

Features: Access to complete AWS documentation, best practices, and service information

Cost Analysis Server - Pre-Deployment Pricing

claude mcp add awslabs.cost-analysis-mcp-server -e FASTMCP_LOG_LEVEL=$MCP_LOG_LEVEL -e AWS_PROFILE=$AWS_PROFILE -- uvx awslabs.cost-analysis-mcp-server@latest

Features: Analyze AWS costs and provide pre-deployment cost estimates for infrastructure planning

🛠️ Development Tools

Shopify Dev Server

claude mcp add shopify-dev-mcp -- npx -y @shopify/dev-mcp@latest

Puppeteer Server - Web Automation

claude mcp add puppeteer -- npx -y @modelcontextprotocol/server-puppeteer

🔒 Enterprise Security Best Practices

Environment-Based Configuration

Development Environment:

export AWS_PROFILE="dev-full-access"
export DDB_READONLY="false"
export ALLOW_WRITES="--allow-write"

Staging Environment:

export AWS_PROFILE="staging-limited"
export DDB_READONLY="true"
export ALLOW_WRITES=""

Production Environment:

export AWS_PROFILE="prod-readonly"
export DDB_READONLY="true"
export ALLOW_WRITES=""
export REQUIRE_APPROVAL="true"

IAM Policy Examples

Read-Only DynamoDB Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:DescribeTable",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:GetItem",
        "dynamodb:ListTables"
      ],
      "Resource": "*"
    }
  ]
}

Audit Everything - Don't forget to login to the AWS CLI before running!

Enable CloudTrail for all MCP operations:

aws cloudtrail create-trail --name mcp-audit-trail --s3-bucket-name your-audit-bucket

📈 Where the Time Goes

The day-to-day wins I notice once these servers are in place:

  • Fewer context switches — I ask Claude Code about the account instead of jumping to the console
  • Fewer fat-finger mistakes — read-only modes mean a query can't accidentally change anything
  • Docs that match reality — generated from the live account, not a stale wiki page
  • Faster onboarding — a new collaborator can ask the codebase and the account questions in plain English

Your mileage will vary with how much AWS work you actually do, but the friction reduction is real.

🎯 Next Steps

  1. Install the Core Server first - This is required before any other AWS MCP servers
  2. Start with one functional server - Start with the DynamoDB server in read-only mode
  3. Expand gradually - Add servers as you get comfortable
  4. Measure impact - Track time saved and errors avoided
  5. Iterate - Drop the servers you don't use, keep the ones you do

Need Help?

If you get stuck or want a second pair of eyes on an IAM policy, email me at hello@satitechnology.com.

🚨 Quick Reference Card

Save this for easy access:

ALWAYS FIRST: Install Core Server

claude mcp add awslabs.core-mcp-server -- uvx awslabs.core-mcp-server@latest

Safe production query:

export AWS_PROFILE="prod-ro"
export DDB_READONLY="true"
claude mcp add awslabs.dynamodb-mcp-server -e DDB-MCP-READONLY=$DDB_READONLY -e AWS_PROFILE=$AWS_PROFILE -- uvx awslabs.dynamodb-mcp-server@latest

Cost analysis:

claude mcp add awslabs.cost-analysis-mcp-server -e AWS_PROFILE=$AWS_PROFILE -- uvx awslabs.cost-analysis-mcp-server@latest

That's the whole setup. Install your first server, point Claude Code at your account in read-only mode, and go from there.

About

I'm Justin Pursati, the one engineer behind Sati Technology, Inc. and the maker of Zentrr. I build custom AI and software on AWS — agents, internal tools, and the infrastructure that runs them.

If you have a project in mind, tell me about it or email hello@satitechnology.com.

📞 Contact Information

Justin Pursati

Owner/Operator of Sati Technology, Inc

AWS Solutions Architect/Developer | AI Integration Specialist

📧 jpursati@satitechnology.com

🔗 https://www.linkedin.com/in/justin-pursati/

📱 Schedule a call: https://calendly.com/jpursati/30min

© 2025 Sati Technology, Inc.

Back to all guides