AWS IAM

AWS IAM MCP Server

IAM user, role, group, and policy management.

What is an MCP Server?⁠

MCP Info

Image Building Info

Attribute	Details
Dockerfile	https://github.com/awslabs/mcp/blob/636aca8e109b5559006044f035bb89c16e9e5410/src/iam-mcp-server/Dockerfile⁠
Commit	636aca8e109b5559006044f035bb89c16e9e5410
Docker Image built by	Docker Inc.
Docker Scout Health Score
Verify Signature	COSIGN_REPOSITORY=mcp/signatures cosign verify mcp/iam-mcp-server --key https://raw.githubusercontent.com/docker/keyring/refs/heads/main/public/mcp/latest.pub
Licence	Apache License 2.0

Available Tools (29)

Tools Details

Tool: add_user_to_group

Add a user to an IAM group.

Tool: attach_group_policy

Attach a managed policy to an IAM group.

Tool: attach_user_policy

Attach a managed policy to an IAM user.

Tool: create_access_key

Create a new access key for an IAM user.

Tool: create_group

Create a new IAM group.

This tool creates a new IAM group in your AWS account. The group will be created without any permissions by default - you'll need to attach policies separately.

Security Best Practices:

• Use descriptive group names that indicate the group's purpose
• Set appropriate paths for organizational structure
• Follow the principle of least privilege when assigning permissions later Parameters|Type|Description -|-|- group_name|string|The name of the new IAM group confirmed|booleanoptional|Must be true to confirm this write operation path|stringoptional|The path for the group

Tool: create_role

Create a new IAM role.

Tool: create_user

Create a new IAM user.

This tool creates a new IAM user in your AWS account. The user will be created without any permissions by default - you'll need to attach policies separately.

Security Best Practices:

• Use descriptive user names that indicate the user's role or purpose
• Set appropriate paths for organizational structure
• Consider using permissions boundaries to limit maximum permissions
• Follow the principle of least privilege when assigning permissions later Parameters|Type|Description -|-|- ctx|string|MCP context for error reporting user_name|string|The name of the new IAM user confirmed|booleanoptional|Must be true to confirm this write operation path|stringoptional|The path for the user permissions_boundary|stringoptional|ARN of the permissions boundary policy

Tool: delete_access_key

Delete an access key for an IAM user.

Tool: delete_group

Delete an IAM group.

Tool: delete_role_policy

Delete an inline policy from an IAM role.

This tool removes an inline policy from the specified role. The policy document will be permanently deleted and cannot be recovered.

Tool: delete_user

Delete an IAM user.

Tool: delete_user_policy

Delete an inline policy from an IAM user.

This tool removes an inline policy from the specified user. The policy document will be permanently deleted and cannot be recovered.

Tool: detach_group_policy

Detach a managed policy from an IAM group.

Tool: detach_user_policy

Detach a managed policy from an IAM user.

Tool: get_group

Get detailed information about a specific IAM group.

This tool retrieves comprehensive information about an IAM group including group members, attached policies, and inline policies. Use this to get a complete picture of a group's configuration and membership.

Usage Tips:

• Use this after list_groups to get detailed information about specific groups
• Review attached policies to understand group permissions
• Check group members to see who has these permissions Parameters|Type|Description -|-|- group_name|string|The name of the IAM group to retrieve

Tool: get_managed_policy_document

Retrieve the policy document for a managed policy.

This tool retrieves the policy document for a specific managed policy version. Use this to examine the actual permissions and wildcards in managed policies.

Tool: get_role_policy

Retrieve an inline policy for an IAM role.

This tool retrieves the policy document for a specific inline policy attached to a role.

Tool: get_user

Get detailed information about a specific IAM user.

This tool retrieves comprehensive information about an IAM user including attached policies, group memberships, and access keys. Use this to get a complete picture of a user's permissions and configuration.

Usage Tips:

• Use this after list_users to get detailed information about specific users
• Review attached policies to understand user permissions
• Check access keys to identify potential security issues Parameters|Type|Description -|-|- ctx|string|MCP context for error reporting user_name|string|The name of the IAM user to retrieve

Tool: get_user_policy

Retrieve an inline policy for an IAM user.

This tool retrieves the policy document for a specific inline policy attached to a user.

Tool: list_groups

List IAM groups in the account.

This tool retrieves a list of IAM groups from your AWS account with optional filtering. Use this to get an overview of all groups or find specific groups by path prefix.

Usage Tips:

• Use path_prefix to filter groups by organizational structure
• Adjust max_items to control response size for large accounts
• Results may be paginated for accounts with many groups Parameters|Type|Description -|-|- max_items|integeroptional|Maximum number of groups to return path_prefix|stringoptional|Path prefix to filter groups (e.g., "/division_abc/")

Tool: list_policies

List IAM policies in the account.

Tool: list_role_policies

List all inline policies for an IAM role.

This tool retrieves the names of all inline policies attached to the specified role.

Tool: list_roles

List IAM roles in the account.

Tool: list_user_policies

List all inline policies for an IAM user.

This tool retrieves the names of all inline policies attached to the specified user.

Tool: list_users

List IAM users in the account.

This tool retrieves a list of IAM users from your AWS account with optional filtering. Use this to get an overview of all users or find specific users by path prefix.

Usage Tips:

• Use path_prefix to filter users by organizational structure
• Adjust max_items to control response size for large accounts
• Results may be paginated for accounts with many users Parameters|Type|Description -|-|- ctx|string|MCP context for error reporting max_items|integeroptional|Maximum number of users to return path_prefix|stringoptional|Path prefix to filter users (e.g., "/division_abc/")

Tool: put_role_policy

Create or update an inline policy for an IAM role.

This tool creates a new inline policy or updates an existing one for the specified role. Inline policies are directly embedded in a single user, role, or group and have a one-to-one relationship with the identity.

Tool: put_user_policy

Create or update an inline policy for an IAM user.

This tool creates a new inline policy or updates an existing one for the specified user. Inline policies are directly embedded in a single user, role, or group and have a one-to-one relationship with the identity.

Security Best Practices:

• Follow the principle of least privilege when creating policies
• Use managed policies for common permissions that can be reused
• Regularly review and audit inline policies
• Test policies using simulate_principal_policy before applying Parameters|Type|Description -|-|- policy_document|string|The policy document in JSON format (string or dict) policy_name|string|The name of the inline policy user_name|string|The name of the IAM user confirmed|booleanoptional|Must be true to confirm this write operation

Tool: remove_user_from_group

Remove a user from an IAM group.

Tool: simulate_principal_policy

Simulate IAM policy evaluation for a principal.

Use this MCP Server

{
  "mcpServers": {
    "awslabs-iam": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "AWS_REGION",
        "-e",
        "AWS_PROFILE",
        "-e",
        "AWS_ACCESS_KEY_ID",
        "-e",
        "AWS_SECRET_ACCESS_KEY",
        "mcp/iam-mcp-server"
      ],
      "env": {
        "AWS_REGION": "us-east-1",
        "AWS_PROFILE": "default",
        "AWS_ACCESS_KEY_ID": "AKIAIOSFODNN7EXAMPLE",
        "AWS_SECRET_ACCESS_KEY": "your-aws-secret-access-key"
      }
    }
  }
}

Why is it safer to run MCP Servers with Docker?⁠