AWS MCP Server Setup for Cursor IDE (2026)

How do you set up the AWS MCP server in Cursor? Install and configure the AWS CLI (aws configure), add an aws block to ~/.cursor/mcp.json that references your AWS profile and region, then restart Cursor. The server reuses your existing local AWS credential chain — there's no separate AWS-specific token to generate, which also means it inherits whatever permissions that credential chain already has, for better or worse.

That last part is worth pausing on before you copy the config below. If aws configure currently points at a profile with broad IAM permissions, your AI assistant now has that same access. Scope it down with a dedicated read-only IAM user (see the recommended policy below) before connecting this to anything beyond a personal sandbox account.

What the AWS MCP Server Can Do

Once connected, you can ask Cursor things like:

The server uses your local AWS credentials, so it works with whatever account and region you're already authenticated against.

Prerequisites

Step 1: Set Up AWS Credentials

The AWS MCP server uses your local AWS credential chain. If you already use the AWS CLI, you're set. If not:

aws configure

Enter your Access Key ID, Secret Access Key, region, and output format. The server will pick up these credentials automatically.

Tip: Use a dedicated IAM user or role with read-only permissions for MCP — you don't want your AI assistant to accidentally mutate production resources.

Step 2: Add to Your Cursor MCP Config

Open ~/.cursor/mcp.json (or Cmd/Ctrl + Shift + P → "Open MCP Settings") and add:

{
  "mcpServers": {
    "aws": {
      "command": "npx",
      "args": ["-y", "@aws/mcp-server-aws"],
      "env": {
        "AWS_PROFILE": "default",
        "AWS_REGION": "us-east-1"
      }
    }
  }
}

Replace default with your AWS CLI profile name if you use named profiles (e.g., production, staging). Replace us-east-1 with your primary region.

Using AWS SSO? The server respects AWS SSO sessions. Just make sure you've run aws sso login before starting Cursor.

Step 3: Restart Cursor

Quit Cursor completely and reopen it. The AWS MCP server will start automatically.

Check that it loaded: View → Output → MCP — you should see the server listed without errors.

Step 4: Test It

Open Cursor chat (Cmd/Ctrl + L) and try:

List my S3 buckets

Or more specifically:

What Lambda functions are deployed in us-east-1?

Recommended IAM Permissions

For read-only access (recommended for most development workflows):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListAllMyBuckets",
        "s3:GetBucketLocation",
        "s3:ListBucket",
        "s3:GetObject",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics",
        "logs:DescribeLogGroups",
        "logs:GetLogEvents",
        "logs:FilterLogEvents",
        "lambda:ListFunctions",
        "lambda:GetFunction",
        "ec2:DescribeInstances",
        "ec2:DescribeSecurityGroups",
        "ecs:ListClusters",
        "ecs:ListServices",
        "rds:DescribeDBInstances",
        "ce:GetCostAndUsage"
      ],
      "Resource": "*"
    }
  ]
}

Scope this down further if you only need specific services.

Practical Workflows

Debugging Lambda Errors

Show me the last 50 error logs from the process-orders Lambda function

Cursor will pull CloudWatch logs and help you diagnose the issue in context with your code.

Infrastructure Audit

Check all my S3 buckets and tell me which ones have public access enabled

Cost Investigation

Which AWS services are costing the most this month, and how does it compare to last month?

Deployment Check

List all ECS services in the production cluster and tell me which ones have tasks running below their desired count

Switching Between AWS Profiles

If you manage multiple AWS accounts, you can have separate MCP server entries for each:

{
  "mcpServers": {
    "aws-production": {
      "command": "npx",
      "args": ["-y", "@aws/mcp-server-aws"],
      "env": {
        "AWS_PROFILE": "production",
        "AWS_REGION": "us-east-1"
      }
    },
    "aws-staging": {
      "command": "npx",
      "args": ["-y", "@aws/mcp-server-aws"],
      "env": {
        "AWS_PROFILE": "staging",
        "AWS_REGION": "us-west-2"
      }
    }
  }
}

Then specify which one to use in your prompt: "Using aws-staging, list the running EC2 instances"

Troubleshooting

"No credentials found"
Run aws sts get-caller-identity in your terminal. If that fails, your credentials aren't configured. Run aws configure or check your AWS SSO session.

"Access denied" errors
Your IAM user/role is missing permissions. Check the policy attached to the credentials and add the required actions from the list above.

Server starts but no tools appear
Fully restart Cursor (quit and reopen). If still not working, check the MCP output panel for startup errors.

Server is slow
AWS API calls have inherent latency. For faster responses, specify the region explicitly in your prompts: "in us-east-1, list..."

If You're Running Workloads on EKS

The permissions and queries above cover AWS's managed services (S3, Lambda, RDS, ECS) at the API level. If your actual workloads run as pods on EKS, this server won't tell you much about what's happening inside the cluster — pod status, container logs, and rollout state live one layer down, at the Kubernetes API, not the AWS API. Pair this with the Kubernetes MCP server for that half of the picture; the two are complementary rather than overlapping.

Frequently Asked Questions

Q: Does the AWS MCP server need its own API key, separate from the AWS CLI?
A: No. It reuses whatever credential chain aws configure (or AWS SSO) already set up locally — the same profiles, the same ~/.aws/credentials file. There's nothing MCP-specific to generate.

Q: Is it safe to connect this to a production AWS account?
A: Only with a scoped-down, read-only IAM policy attached to a dedicated user or role — see the policy above. Connecting an MCP server to a profile with broad admin permissions gives your AI assistant that same broad access, which is a real risk if a prompt is misinterpreted or a tool call is broader than intended.

Q: Can it create or modify AWS resources, or is it read-only?
A: Depends entirely on the IAM permissions attached to the credentials you give it. The policy in this guide is deliberately read-only (List*, Describe*, Get* actions). If you grant write permissions, the server can use them — test any write-capable setup against a non-production account first.

Q: Does this work with AWS Organizations / multiple linked accounts?
A: Yes, via named profiles — set up one AWS CLI profile per account (or per role you assume into) and add a corresponding entry in mcp.json, the same pattern shown in the multi-profile example above.

Q: My queries are slow on a large account — is there a way to speed this up?
A: Specify the region and service explicitly rather than asking broad questions like "list everything." AWS API latency compounds when the server has to enumerate across regions or services you didn't actually need checked.

Q: I need to design or validate a DynamoDB table, not just inspect general AWS resources — does this guide cover that?
A: Not in depth. This guide's read-only policy covers listing and describing DynamoDB tables like any other AWS resource, but data modeling, access-pattern validation, and cost estimation are a different, more specialized tool. See the DynamoDB MCP server setup guide for awslabs.dynamodb-mcp-server, AWS's purpose-built server for that job.

Related Guides

---