mcp/iam-mcp-server repository overview

⁠AWS IAM MCP Server

IAM user, role, group, and policy management.

What is an MCP Server?⁠

⁠MCP Info

⁠Image Building Info

Attribute	Details
Dockerfile	https://github.com/awslabs/mcp/blob/636aca8e109b5559006044f035bb89c16e9e5410/src/iam-mcp-server/Dockerfile⁠
Commit	636aca8e109b5559006044f035bb89c16e9e5410
Docker Image built by	Docker Inc.
Docker Scout Health Score
Verify Signature	COSIGN_REPOSITORY=mcp/signatures cosign verify mcp/iam-mcp-server --key https://raw.githubusercontent.com/docker/keyring/refs/heads/main/public/mcp/latest.pub
Licence	Apache License 2.0

⁠Available Tools (29)

⁠Tools Details

⁠Tool: add_user_to_group

Add a user to an IAM group.

⁠Tool: attach_group_policy

Attach a managed policy to an IAM group.

⁠Tool: attach_user_policy

Attach a managed policy to an IAM user.

⁠Tool: create_access_key

Create a new access key for an IAM user.

⁠Tool: create_group

Create a new IAM group.

This tool creates a new IAM group in your AWS account. The group will be created without any permissions by default - you'll need to attach policies separately.

⁠Security Best Practices:

• Use descriptive group names that indicate the group's purpose
• Set appropriate paths for organizational structure
• Follow the principle of least privilege when assigning permissions later Parameters|Type|Description -|-|- group_name|string|The name of the new IAM group confirmed|boolean optional|Must be true to confirm this write operation path|string optional|The path for the group

⁠Tool: create_role

Create a new IAM role.

⁠Tool: create_user

Create a new IAM user.

This tool creates a new IAM user in your AWS account. The user will be created without any permissions by default - you'll need to attach policies separately.

⁠Security Best Practices:

• Use descriptive user names that indicate the user's role or purpose
• Set appropriate paths for organizational structure
• Consider using permissions boundaries to limit maximum permissions
• Follow the principle of least privilege when assigning permissions later Parameters|Type|Description -|-|- ctx|string|MCP context for error reporting user_name|string|The name of the new IAM user confirmed|boolean optional|Must be true to confirm this write operation path|string optional|The path for the user permissions_boundary|string optional|ARN of the permissions boundary policy

⁠Tool: delete_access_key

Delete an access key for an IAM user.

⁠Tool: delete_group

Delete an IAM group.

⁠Tool: delete_role_policy

Delete an inline policy from an IAM role.

This tool removes an inline policy from the specified role. The policy document will be permanently deleted and cannot be recovered.

⁠Tool: delete_user

Delete an IAM user.

⁠Tool: delete_user_policy

Delete an inline policy from an IAM user.

This tool removes an inline policy from the specified user. The policy document will be permanently deleted and cannot be recovered.

⁠Tool: detach_group_policy

Detach a managed policy from an IAM group.

⁠Tool: detach_user_policy

Detach a managed policy from an IAM user.

⁠Tool: get_group

Get detailed information about a specific IAM group.

This tool retrieves comprehensive information about an IAM group including group members, attached policies, and inline policies. Use this to get a complete picture of a group's configuration and membership.

⁠Usage Tips:

• Use this after list_groups to get detailed information about specific groups
• Review attached policies to understand group permissions
• Check group members to see who has these permissions Parameters|Type|Description -|-|- group_name|string|The name of the IAM group to retrieve

⁠Tool: get_managed_policy_document

Retrieve the policy document for a managed policy.

This tool retrieves the policy document for a specific managed policy version. Use this to examine the actual permissions and wildcards in managed policies.

⁠Tool: get_role_policy

Retrieve an inline policy for an IAM role.

This tool retrieves the policy document for a specific inline policy attached to a role.

⁠Tool: get_user

Get detailed information about a specific IAM user.

This tool retrieves comprehensive information about an IAM user including attached policies, group memberships, and access keys. Use this to get a complete picture of a user's permissions and configuration.

⁠Usage Tips:

• Use this after list_users to get detailed information about specific users
• Review attached policies to understand user permissions
• Check access keys to identify potential security issues Parameters|Type|Description -|-|- ctx|string|MCP context for error reporting user_name|string|The name of the IAM user to retrieve

⁠Tool: get_user_policy

Retrieve an inline policy for an IAM user.

This tool retrieves the policy document for a specific inline policy attached to a user.

⁠Tool: list_groups

List IAM groups in the account.

This tool retrieves a list of IAM groups from your AWS account with optional filtering. Use this to get an overview of all groups or find specific groups by path prefix.

⁠Usage Tips:

• Use path_prefix to filter groups by organizational structure
• Adjust max_items to control response size for large accounts
• Results may be paginated for accounts with many groups Parameters|Type|Description -|-|- max_items|integer optional|Maximum number of groups to return path_prefix|string optional|Path prefix to filter groups (e.g., "/division_abc/")

⁠Tool: list_policies

List IAM policies in the account.

⁠Tool: list_role_policies

List all inline policies for an IAM role.

This tool retrieves the names of all inline policies attached to the specified role.

⁠Tool: list_roles

List IAM roles in the account.

⁠Tool: list_user_policies

List all inline policies for an IAM user.

This tool retrieves the names of all inline policies attached to the specified user.

⁠Tool: list_users

List IAM users in the account.

This tool retrieves a list of IAM users from your AWS account with optional filtering. Use this to get an overview of all users or find specific users by path prefix.

⁠Usage Tips:

• Use path_prefix to filter users by organizational structure
• Adjust max_items to control response size for large accounts
• Results may be paginated for accounts with many users Parameters|Type|Description -|-|- ctx|string|MCP context for error reporting max_items|integer optional|Maximum number of users to return path_prefix|string optional|Path prefix to filter users (e.g., "/division_abc/")

⁠Tool: put_role_policy

Create or update an inline policy for an IAM role.

This tool creates a new inline policy or updates an existing one for the specified role. Inline policies are directly embedded in a single user, role, or group and have a one-to-one relationship with the identity.

⁠Tool: put_user_policy

Create or update an inline policy for an IAM user.

This tool creates a new inline policy or updates an existing one for the specified user. Inline policies are directly embedded in a single user, role, or group and have a one-to-one relationship with the identity.

⁠Security Best Practices:

• Follow the principle of least privilege when creating policies
• Use managed policies for common permissions that can be reused
• Regularly review and audit inline policies
• Test policies using simulate_principal_policy before applying Parameters|Type|Description -|-|- policy_document|string|The policy document in JSON format (string or dict) policy_name|string|The name of the inline policy user_name|string|The name of the IAM user confirmed|boolean optional|Must be true to confirm this write operation

⁠Tool: remove_user_from_group

Remove a user from an IAM group.

⁠Tool: simulate_principal_policy

Simulate IAM policy evaluation for a principal.

⁠Use this MCP Server

{
  "mcpServers": {
    "awslabs-iam": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "AWS_REGION",
        "-e",
        "AWS_PROFILE",
        "-e",
        "AWS_ACCESS_KEY_ID",
        "-e",
        "AWS_SECRET_ACCESS_KEY",
        "mcp/iam-mcp-server"
      ],
      "env": {
        "AWS_REGION": "us-east-1",
        "AWS_PROFILE": "default",
        "AWS_ACCESS_KEY_ID": "AKIAIOSFODNN7EXAMPLE",
        "AWS_SECRET_ACCESS_KEY": "your-aws-secret-access-key"
      }
    }
  }
}

Why is it safer to run MCP Servers with Docker?⁠