What's New

AWS has added cross-account and cross-role access to the AWS MCP Server, a component of the Agent Toolkit for AWS. This feature enables developers using AI coding agents such as Kiro, Claude Code, or Codex to seamlessly switch between multiple AWS accounts and IAM roles within a single session, without restarting the server or manually rotating credentials. Each tool call can now specify a named AWS CLI profile, allowing agents to target different accounts and roles on a per-request basis.

How It Works

• The MCP Proxy for AWS (mcp-proxy-for-aws) is configured at startup with an explicit allowlist of AWS CLI profiles, supplied via the --profile CLI flag or the AWS_MCP_PROXY_PROFILES environment variable; the first profile listed becomes the default.
• The proxy injects an aws_profile parameter into the tool schemas for call_aws, run_script, get_presigned_url, get_tasks, and suggest_aws_commands, making profile selection a first-class part of each tool call.
• When an agent invokes a tool, the proxy inspects the aws_profile value: if absent it signs with the default profile; if present and valid it routes through a dedicated connection signed with that profile's credentials; if invalid it rejects the call and returns the list of allowed profiles.
• The aws_profile parameter is stripped before the request is forwarded to the backend AWS MCP Server, so the server itself never handles credential routing logic.
• Routing is fully stateless — each call carries its own identity, meaning parallel requests across different profiles cannot interfere with one another.
• Prerequisites include AWS CLI profiles pre-configured in ~/.aws/config and ~/.aws/credentials, mcp-proxy-for-aws version 1.6.0 or later, and valid IAM permissions for each profile.

Why It's Important

• Multi-account AWS environments are the norm for production workloads (separate accounts for dev, staging, prod, security, logging, etc.), and previously every account switch required stopping the AI session, editing credentials, and restarting the MCP server — a significant productivity tax.
• Eliminating restarts means AI-assisted workflows can span account boundaries in a single conversational context, preserving the agent's reasoning state and reducing context loss.
• Per-call profile specification removes the risk of credential bleed — commands are explicitly routed to the intended account, reducing the chance of accidental writes to the wrong environment.
• The explicit startup allowlist enforces a security boundary: the agent cannot discover or use profiles beyond those declared, limiting blast radius if an agent behaves unexpectedly.
• DevOps and platform engineers working across many accounts (e.g., correlating CloudWatch logs from production and staging simultaneously) can now do so in a single session, accelerating incident diagnosis and cross-environment configuration tasks.

How It's Different

• Before this feature: switching AWS accounts required a full stop-edit-restart cycle for every profile change, breaking the AI coding session and losing conversational context; now switching is a parameter on each individual tool call.
• Compared to manual CLI profile switching: the agent autonomously selects the correct profile per request based on task context, rather than requiring the developer to manually export AWS_PROFILE or pass --profile flags.
• Compared to long-term credential injection: credentials are never embedded in the MCP server itself; the proxy handles signing, keeping the server stateless and credential-agnostic.
• Stateless per-call routing vs. session-scoped identity: unlike traditional SDK sessions that hold a single identity for their lifetime, each MCP tool call carries its own credential context, enabling safe parallelism across accounts.
• Explicit allowlist vs. open profile discovery: the proxy only exposes profiles declared at startup, unlike a raw AWS CLI invocation where any profile in ~/.aws/config could be referenced, providing a tighter security posture for agent-driven automation.

When to Prefer It

• Use this feature when your team operates a standard multi-account AWS Organization (e.g., separate accounts for production, staging, development, and security) and you want AI agents to assist with cross-environment tasks without manual credential rotation.
• Ideal for DevOps engineers diagnosing incidents that span account boundaries, such as correlating CloudWatch metrics or logs from a production account with deployment artifacts in a CI/CD account.
• Well-suited for platform engineers who need to apply consistent infrastructure changes (IAM policies, S3 bucket policies, Lambda configurations) across multiple accounts in a single automated workflow.
• Prefer this approach when you want to enforce least-privilege per environment — configure a read-only profile as the default and require the agent to explicitly select a write-capable profile only when needed.
• Appropriate for teams using AI coding agents (Kiro, Claude Code, Codex, Cursor, or any MCP-compatible agent) who want auditability and guardrails around multi-account operations rather than relying on unrestricted terminal access.
• Use when running parallel agent tasks that target different accounts simultaneously, since the stateless per-call routing ensures requests cannot cross-contaminate each other's credentials.

Availability

• GA Status: Generally available as of June 5, 2026.
• Supported Regions: US East (N. Virginia) and Europe (Frankfurt) only at launch; other regions are not yet supported.
• Minimum Version Requirement: mcp-proxy-for-aws version 1.6.0 or later is required; earlier versions do not support the aws_profile parameter injection.
• Scope Limitation: Multi-profile support is specific to the AWS MCP Server; profile switching is not available when using the MCP Proxy to connect to other MCP servers.
• Pricing: No additional charge for the MCP Server feature itself; standard AWS service charges apply for any AWS API calls made through the agent (e.g., CloudWatch, Lambda, S3).
• Compatible Agents: Works with any MCP-compatible AI coding agent, including Kiro, Claude Code, Codex, and Cursor.
• Profile Discovery Restriction: Only profiles explicitly declared at proxy startup are accessible to the agent; profiles present in ~/.aws/config but not listed are not discoverable.

Related Resources

• https://aws.amazon.com/products/developer-tools/agent-toolkit-for-aws/
• https://docs.aws.amazon.com/agent-toolkit/latest/userguide/multi-account-access.html