OAuth support for the AWS MCP Server

You can now connect AI agents directly to the AWS MCP Server using AWS Sign-In. Agents connect using industry-standard OAuth without requiring additional authentication software. Existing AWS identities, sign-in methods, IAM permissions, and governance controls you have already set up continue to apply.

Developers can authorize agents interactively through a browser or programmatically using non-interactive (headless) authorization. Administrators can govern OAuth access using familiar IAM policies together with new OAuth capabilities, including global condition keys, token introspection and revocation APIs, dynamic client registration, and CloudTrail audit events.

To learn more, see the OAuth Support for the AWS MCP Server blogpost, Sign-In with OAuth 2.0 in the AWS Sign-In User Guide, and Setting up the AWS MCP Server in the Agent Toolkit for AWS User Guide.