AWS MCP server

Overview

This pack gives an agent read and write access to a broad set of AWS services, covering compute, containers, databases, security, event streaming, and DNS. Use it to monitor and manage an AWS account without leaving the conversation.

For setup instructions, see SnapLogic MCP Server quickstart.

Example Prompts

• What budgets are set up on account 123456789012?
• Are we tracking against any AWS budgets this month?
• Show me the first 5 budgets for our production account
• List the budget limits and actual spend for account 123456789012
• Describe the networking-prod stack
• What are the outputs of the api-gateway stack?
• Why is the payments stack in UPDATE_ROLLBACK_COMPLETE?
• Show me the parameters the vpc-core stack was deployed with
• What CloudFormation stacks exist in us-east-1?
• Show me any stacks in ROLLBACK_FAILED or UPDATE_ROLLBACK_FAILED

Tools

Set up the MCP Server tools

1. Download aws_tools.zip.
2. In SnapLogic Designer, open the target project space (or create one), then choose Import Project / Import Pipelines and select the downloaded aws_tools.zip. Designer unpacks each pipeline into the project.
3. Attach the required account to the connectivity snaps (see Connection Setup).
4. Expose the project as an MCP server — each pipeline becomes a tool named after its label. New to this? Start with the MCP quickstart, then use the MCP Server Pipeline Builder to generate the server from the imported pipelines.

Configure account

Attach an API Suite account (OAuth 2.0 or Bearer token) to the HTTP Client snap in Designer after import.

These pipelines ship without credentials by design — attach a valid account in Designer before the tools will execute.

See the SnapLogic account documentation for this connector: API Suite Account Configuration.

AWSBudgetsDescribe

Lists the AWS Budgets defined on an account so you can check budget limits and track spend against them. Pair it with AWSCostExplorerGetCost when a user wants to know not just what they spent, but whether they are over plan.

* Required parameter.

Try asking:

• What budgets are set up on account 123456789012?
• Are we tracking against any AWS budgets this month?
• Show me the first 5 budgets for our production account
• List the budget limits and actual spend for account 123456789012

AWSCloudFormationDescribeStack

Fetches the status, outputs, and parameters for one CloudFormation stack, or for every stack in the region if no name is given. Use it to read a stack's outputs or to investigate why an update failed.

Try asking:

• Describe the networking-prod stack
• What are the outputs of the api-gateway stack?
• Why is the payments stack in UPDATE_ROLLBACK_COMPLETE?
• Show me the parameters the vpc-core stack was deployed with

AWSCloudFormationListStacks

Lists CloudFormation stacks in a region, optionally filtered by one or more stack statuses. Use it to survey what is deployed or to find stacks stuck in a bad state.

Try asking:

• What CloudFormation stacks exist in us-east-1?
• Show me any stacks in ROLLBACK_FAILED or UPDATE_ROLLBACK_FAILED
• List the stacks that are CREATE_COMPLETE in eu-west-1
• Are any stacks currently updating?

AWSCloudTrailLookupEvents

Searches CloudTrail management events by attribute, such as event name, username, or resource, within an optional time window. Use it for audit questions like who changed a resource and when.

Try asking:

• Who terminated EC2 instances in the last 24 hours?
• Show me CloudTrail events with EventName TerminateInstances
• What did the user deploy-bot do yesterday?
• Find all CloudTrail activity on resource prod-db-01 last week

AWSCloudWatchDescribeAlarms

Lists CloudWatch metric alarms in a region, optionally filtered by state or name prefix. Use it at the start of an incident triage to quickly see which alarms are firing.

Try asking:

• What CloudWatch alarms are firing right now?
• Show me all alarms in ALARM state in eu-west-1
• List the alarms whose names start with prod-
• Are there any alarms with insufficient data in us-east-1?

AWSCloudWatchGetMetrics

Queries a CloudWatch metric over a time window and returns the aggregated datapoint series. Use it whenever a user asks for a number over time, such as CPU utilization, request latency, or queue depth.

* Required parameter.

Try asking:

• What was average CPU on instance i-0abc123 over the last 6 hours?
• Chart the maximum ApproximateNumberOfMessagesVisible for the orders queue yesterday
• Get AWS/RDS FreeStorageSpace for prod-db-01 at 5-minute resolution this week
• Show me the sum of Lambda Invocations in AWS/Lambda for the last day

AWSCloudWatchLogsQuery

Searches a CloudWatch Logs log group by filter pattern and time window, returning matching log events. Use it to pull the error lines behind an alarm or to answer 'what did the service log at 3am' questions.

* Required parameter.

Try asking:

• Find ERROR lines in /aws/lambda/order-processor from the last hour
• Search the /ecs/checkout log group for 'timeout'
• Show me the last 50 events in /aws/lambda/notify-oncall
• What did /aws/rds/instance/prod-db-01/error log between those timestamps?

AWSCodePipelineGetState

Fetches the current stage-by-stage state of a named CodePipeline, showing whether each stage succeeded or failed. Use it to confirm a deployment went through and to pinpoint which stage broke.

* Required parameter.

Try asking:

• What's the state of the api-deploy pipeline?
• Did the last run of frontend-release succeed?
• Which stage is the payments pipeline stuck on?
• Show me the stage states for the infra-deploy pipeline in eu-west-1

AWSCostExplorerGetCost

Queries AWS Cost Explorer spend over a date range, with optional grouping by service, region, or linked account. Use it for any 'what did we spend' or 'which service costs the most' question.

* Required parameter.

Try asking:

• What did we spend on AWS last month?
• Break down July costs by SERVICE
• Show me daily spend for the last two weeks
• Which linked account cost the most in Q2?
• Give me unblended cost grouped by REGION for June

AWSECSDescribeServices

Fetches details for one or more named ECS services in a cluster, including task counts, deployment state, and current status. Use it after AWSECSListServices to check whether a service is healthy or whether a deployment has settled.

* Required parameter.

Try asking:

• Is the checkout service healthy in the production cluster?
• Describe the api and worker services in staging-cluster
• How many tasks are actually running for the payments service?
• Show me the current task definition for the web service in prod

AWSECSListServices

Lists the ECS services running in a named cluster, giving you the service identifiers needed to describe or scale them. Use it as the discovery step before calling AWSECSDescribeServices or AWSECSUpdateServiceCount.

* Required parameter.

Try asking:

• What services are running in the production ECS cluster?
• List the services in cluster staging-cluster
• How many ECS services do we have in prod in eu-west-1?
• Show me the first 25 services in the batch cluster

AWSECSUpdateServiceCount

Sets the desired task count on an ECS service, scaling it up, down, or to zero on demand. Use it to handle traffic surges or to pause a service for maintenance.

* Required parameter.

Try asking:

• Scale the checkout service to 6 tasks in the production cluster
• Take the batch-worker service down to zero for the weekend
• Bump the api service in staging-cluster up to 3 tasks
• Scale the web service back to 2 in eu-west-1

AWSEc2Describe

Lists and inspects EC2 instances in a region, optionally scoped to specific instance IDs. Use it first when a user asks what is running, what state a box is in, or to confirm an instance exists before acting on it.

Try asking:

• What EC2 instances are running in eu-west-1?
• Describe instance i-0abc123def456 for me
• Show me the state and instance type of i-0aaa111, i-0bbb222
• Give me the first 10 EC2 instances in us-east-1

AWSEc2Manage

Starts, stops, or reboots one or more EC2 instances by instance ID. Use AWSEc2Describe to find the instance first, then this tool to act on it.

* Required parameter.

Try asking:

• Stop instance i-0abc123def456
• Reboot the two web servers i-0aaa111 and i-0bbb222
• Start the dev instances back up in us-west-2
• Shut down i-0deadbeef in eu-central-1

AWSElastiCacheDescribeClusters

Describes ElastiCache clusters in a region, optionally scoped to one cluster, with per-node detail included by default. Use it to check cluster health, engine version, or node configuration.

Try asking:

• What ElastiCache clusters are running in us-east-1?
• Show me the nodes in the session-cache cluster
• Is the redis-prod cluster available?
• List our cache clusters in eu-west-1 without the node detail

AWSEventBridgePutEvents

Publishes a custom event to an EventBridge bus with a specified source, detail type, and JSON payload. Use it to trigger downstream rules and workflows from a conversation.

* Required parameter.

Try asking:

• Publish an order.created event with the order ID A-1042
• Send a deployment.finished event on the default bus from source ci.pipeline
• Emit an alert event to the ops-bus event bus
• Fire a custom EventBridge event so the downstream rule picks it up

AWSGlueGetCrawlers

Lists the AWS Glue crawlers defined in the account along with their configuration and current state. Use it to discover what crawlers exist before starting one, or to answer 'what is cataloguing this data' questions.

Try asking:

• What Glue crawlers do we have?
• List our crawlers and their current state
• Show me the first 10 Glue crawlers in eu-west-1
• Which crawler is responsible for the sales data catalog?

AWSGlueStartCrawler

Starts a named AWS Glue crawler so the Data Catalog picks up new partitions or schema changes. Use AWSGlueGetCrawlers first to confirm the crawler name, then this to kick it off.

* Required parameter.

Try asking:

• Start the sales-data crawler
• Re-run the s3-events crawler so the new partitions show up
• Kick off the customer-catalog Glue crawler in eu-west-1
• New files landed in the bucket — run the crawler

AWSIAMListUsers

Lists IAM users in the account, optionally scoped to a path prefix to narrow results by team or environment. Use it for access reviews and 'who has an account' questions.

Try asking:

• How many IAM users do we have?
• List the IAM users under the /engineering/ path
• Show me all IAM users so I can run an access review
• Give me the first 25 IAM users in the account

AWSKMSEncryptDecrypt

Encrypts or decrypts a value using a KMS key, selected by an operation parameter. Use it to protect sensitive values before storing them, or to read back values that were encrypted earlier.

* Required parameter.

Try asking:

• Encrypt this API token with the alias/app-secrets KMS key
• Decrypt this ciphertext blob for me
• Use KMS key 1234abcd-12ab-34cd-56ef-1234567890ab to encrypt that value
• Can you decrypt the blob we stored earlier and show me the plaintext?

AWSKinesisDescribeStream

Fetches the summary for a Kinesis data stream, including status, shard count, and retention settings. Use it to verify a stream is active before writing to it, or to answer capacity questions.

* Required parameter.

Try asking:

• Is the clickstream Kinesis stream active?
• How many shards does the events stream have?
• Describe the telemetry-stream in eu-west-1
• What's the retention period on our orders stream?

AWSKinesisPutRecord

Writes a single JSON record to a Kinesis data stream using a partition key to determine the target shard. Use it to inject events into a streaming pipeline from a conversation.

* Required parameter.

Try asking:

• Put a record on the clickstream with partition key user-42
• Write this order payload to the orders stream
• Send a test event to telemetry-stream partitioned by device-7
• Inject one record into the events stream so I can check the consumer

AWSLambdaInvoke

Invokes a Lambda function synchronously or asynchronously with a JSON payload and returns the function's response. Use it when a user wants a function actually run, not just described.

* Required parameter.

Try asking:

• Invoke the order-reprocessor Lambda with {"orderId": "A-1042"}
• Run the nightly-cleanup function and tell me what it returned
• Fire the notify-oncall Lambda asynchronously
• Call the price-check function in eu-west-1 with an empty payload

AWSLambdaListFunctions

Lists Lambda functions deployed in a region, with options to limit results or include all published versions. Use it to discover what functions exist before invoking one, or to answer inventory questions.

Try asking:

• What Lambda functions do we have in us-east-1?
• How many Lambdas are deployed in eu-west-1?
• List all published versions of our Lambda functions
• Show me the first 20 functions so I can find the invoice one

AWSRDSCreateSnapshot

Takes a manual snapshot of an RDS database instance, given the source instance identifier and a name for the new snapshot. Use it before a risky migration or schema change, or when a user asks for an ad-hoc backup outside the automated schedule.

* Required parameter.

Try asking:

• Snapshot prod-db-01 before we run the migration, call it pre-migration-0804
• Take a backup of orders-db named orders-db-manual
• Create an RDS snapshot of staging-db in eu-west-1
• I need a restore point for reporting-db before tonight's deploy

AWSRDSDescribeInstances

Describes RDS database instances in a region, optionally scoped to a single instance. Use it to check whether a database is available, find its endpoint, or take an inventory before a maintenance window.

Try asking:

• What RDS instances do we have in us-east-1?
• Is prod-db-01 available right now?
• Show me the endpoint and engine version for orders-db
• List the first 5 RDS databases in eu-west-1

AWSRoute53ListRecords

Lists the DNS records in a Route 53 hosted zone, optionally filtered by record type. Use it to check what a name currently resolves to before changing it with AWSRoute53UpsertRecord.

* Required parameter.

Try asking:

• What DNS records are in hosted zone Z123456ABCDEFG?
• Show me the A records in our production hosted zone
• List the CNAMEs in zone Z0987654ZYXWVU
• What does api.example.com currently point to?

AWSRoute53UpsertRecord

Creates or replaces a DNS record in a Route 53 hosted zone; the record is created if absent and overwritten if present. Use AWSRoute53ListRecords first to see the current value before making changes.

* Required parameter.

Try asking:

• Point api.example.com at 203.0.113.10 in zone Z123456ABCDEFG
• Update the CNAME for www.example.com to the new load balancer
• Add a TXT record for _acme-challenge.example.com with a 60 second TTL
• Change the A record for staging.example.com and keep the TTL at 300

AWSSecretsManagerGetSecret

Fetches a secret value from AWS Secrets Manager by name or ARN, with an option to read the current or previous version. Use it when a workflow needs a credential stored in Secrets Manager.

* Required parameter.

Try asking:

• Get the value of the prod/db/password secret
• What's the current API key stored in payments/stripe-key?
• Fetch the previous version of the prod/db/password secret
• Read the secret arn:aws:secretsmanager:eu-west-1:123456789012:secret:svc-token

AWSSecurityHubGetFindings

Retrieves Security Hub findings, filterable by severity, resource type, and compliance status. Use it for security posture questions, such as outstanding critical issues, failed compliance checks, or findings against a specific resource class.

Try asking:

• Show me all CRITICAL Security Hub findings
• What compliance checks are FAILED right now?
• List HIGH severity findings on AwsS3Bucket resources
• Are there any critical failed findings in eu-west-1?

AWSStepFunctionsDescribeExecution

Fetches the status, input, and output for a Step Functions execution by ARN. Use it to check whether a workflow succeeded, read back its result, or investigate a failure.

* Required parameter.

Try asking:

• Did that state machine execution succeed?
• What was the output of execution arn:aws:states:us-east-1:123456789012:execution:etl:run-42?
• Show me the input and status for the execution we just started
• Is the nightly ETL run still in progress?

AWSStepFunctionsStartExecution

Starts an execution of a Step Functions state machine with an optional JSON input and execution name. Pair it with AWSStepFunctionsDescribeExecution to follow the run to completion.

* Required parameter.

Try asking:

• Kick off the order-fulfilment state machine with {"orderId": "A-1042"}
• Start the nightly ETL workflow now
• Run the onboarding state machine and name the execution onboard-jordan
• Trigger the reconciliation workflow in eu-west-1 with no input