Amazon Web Services (AWS) Connector

TL;DR

• Connect your agent to an AWS account through a regional AWS Model Context Protocol (MCP) endpoint.
• Use an Azure managed identity and OpenID Connect (OIDC) federation for accessing AWS resources.
• Create the required AWS IAM role named SREAgentRole, restrict its trust to the selected managed identity, and grant only the permissions your investigations need.
• Test the connection, review the discovered tools, and save the connector.

What the connector enables

The AWS connector gives your agent access to tools exposed by the AWS MCP service so it can investigate and help resolve issues in your AWS environment. Available operations depend on the tools returned by the service, the permissions attached to your AWS role, and the tool approval policies configured on your agent.

You can create separate connections for different AWS accounts. After connecting, manage shared AWS tools and approvals on the Tools page under MCP Servers + services. These settings are shared across AWS connections.

How authentication works

The connector uses your selected Azure managed identity to obtain an identity token. AWS Security Token Service (STS) validates that token against the OIDC provider and role trust policy you configure, then issues temporary credentials for SREAgentRole. The connector uses those credentials to obtain access to the AWS MCP service.

The role's trust policy determines who can assume the role. Its attached permission policies determine what that role can do. Both must be configured correctly.

Prerequisites

• An existing SRE Agent.
• Permission to create or update connectors on the agent.
• An Azure managed identity available in the agent's managed identity selector.
• Access to the target AWS account with permission to configure IAM identity providers, roles, and policies.
• The target AWS account's 12-digit account ID.

Step 1: Add an AWS cloud provider connection

Open Build + setup, go to Extensions > Cloud providers, and select Create connection > Amazon Web Services (AWS).

Start the Connect AWS wizard from the Cloud providers page.

Step 2: Select the managed identity and get its details

In Complete prerequisites, select the managed identity the connector will use. The wizard displays AWS setup instructions populated with values for that identity.

Select a managed identity to get the values needed for AWS identity federation.

Keep those instructions open while you configure AWS. You will need:

Value	Where it is used
Tenant ID	OIDC provider URL and the role trust policy's condition keys
Managed identity client ID	OIDC provider audience and the trust policy's aud condition
Managed identity principal ID	The trust policy's sub condition
Original audience	The trust policy's oaud condition: 59f0a04a-b322-4310-adc9-39ac41e9631e

Step 3: Set up identity federation in AWS

Use the setup script to configure federation for your selected managed identity.

Or configure manually in the AWS console using the instructions below:

With the managed identity details available, switch to the AWS console. Complete the identity provider, role, and trust-policy setup before returning to the connector wizard.

Add an OIDC identity provider

1. In the AWS console, open IAM > Identity providers and select Add provider.
2. Choose OpenID Connect.
3. Enter the Provider URL: https://login.microsoftonline.com/<TENANT_ID>/v2.0.
4. Enter the Audience: the selected managed identity's client ID.
5. Select Add provider.

Register the selected managed identity's tenant as an OIDC provider and its client ID as the audience.

Create the AWS IAM role

Select the trusted entity

1. Open IAM > Roles and select Create role.
2. Choose Web identity as the trusted entity type.
3. Select the identity provider you configured in the previous step.
4. Select the managed identity's client ID as the Audience.
5. Select Next.

Use the OIDC provider and audience configured for your selected managed identity.

Attach permissions

Attach the mandatory AWS-managed policy AWSMCPSignInOAuthAccessPolicy. Add any other AWS permission policies needed for your use case.

Attach the policy required to sign in to the AWS MCP service.

Grant only the access you need

The MCP sign-in policy does not replace permissions for the AWS resources you want to investigate. Start with the minimum resource permissions your use case requires. Grant write permissions only when you intend the agent to perform those operations, and configure tool approvals accordingly.

Name and create the role

Enter SREAgentRole as the role name, review the configuration, and create the role. The role name is fixed by the connector.

Create the role with the exact name SREAgentRole.

Restrict the role's trust policy

Open IAM > Roles > SREAgentRole > Trust relationships > Edit trust policy.

Configure the federated principal and conditions as follows, replacing the placeholders with your AWS account ID and the values shown in the agent's setup instructions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<ACCOUNT_ID>:oidc-provider/login.microsoftonline.com/<TENANT_ID>/v2.0"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "login.microsoftonline.com/<TENANT_ID>/v2.0:aud": "<MI_CLIENT_ID>",
          "login.microsoftonline.com/<TENANT_ID>/v2.0:oaud": "59f0a04a-b322-4310-adc9-39ac41e9631e",
          "login.microsoftonline.com/<TENANT_ID>/v2.0:sub": "<MI_PRINCIPAL_ID>"
        }
      }
    }
  ]
}

Select Update policy after reviewing the changes. Keep all three conditions so the trust is restricted to the intended identity and audience.

Restrict the role's trust to your selected managed identity. Use your own tenant ID in every condition key.

Step 4: Configure and test the connection

Return to the SRE Agent wizard and select Next to open Test connection.

Field	What to enter
Connection name	A unique name of 2-32 letters, digits, or hyphens, starting with a letter and ending with a letter or digit; for example, aws-production
AWS MCP server endpoint	Select a regional endpoint from the dropdown
AWS account ID	The 12-digit ID of the AWS account containing SREAgentRole

The endpoint selector currently offers N. Virginia, Oregon, Singapore, Sydney, Tokyo, Frankfurt, Ireland, and London.

Select Test connection and wait for a successful result. You must test successfully before proceeding. If you change the managed identity, endpoint, account ID, or connection name, test the connection again.

Enter the AWS connection details and confirm that Test connection succeeds before continuing.

Step 5: Review tools and connect

1. Select Next to open Review tools and connect.
2. Review the tool names and descriptions returned by the AWS MCP service.
3. Select Connect provider to save the connection.

Step 6: Confirm the connector is connected

The wizard returns to Cloud providers. Find your connection under Amazon Web Services (AWS) and confirm that its status is Connected. Select Refresh to check the latest status.

A saved AWS connection appears in the list with Connected status.

Manage tool availability and approval policies on the Tools page under MCP Servers + services.

Step 7: Use SRE Agent chat for AWS resources

You can now use SRE Agent chat to investigate resources in the connected AWS account. Specify the account or connection name, resource, region, and time window so the agent can focus its investigation.

For example:

Using my aws-dev connection, list the EC2 instances in ap-southeast-1.

Investigate errors for my Lambda function <FUNCTION_NAME> in <REGION>
over the last hour using my aws-dev connection.

Replace the example connection name and resource details with your own. The agent can access only the resources and operations allowed by the AWS role's permissions, the available MCP tools, and your agent's tool approval policies. Add permissions for additional resources only as needed.

Troubleshooting

Symptom	What to check
AWS connection option is unavailable	Confirm your deployment exposes the Cloud providers page.
Cannot test or save	Confirm you have permission to write connectors and that all required fields are valid.
Connection test fails	Verify the account ID, exact role name and ARN, OIDC provider URL and audience, all three trust-policy conditions, and the required MCP sign-in policy.
Test succeeded but you cannot continue after editing a field	Run Test connection again for the updated configuration.
Connection works but an AWS operation is denied	Check the role's resource permissions and the agent's shared AWS tool approval policies.

Related capabilities

• Connectors: How connectors give your agent access to external systems.
• Tool Access Policies: Control which tool operations require approval.
• Global Tools Page: Manage tools and their approval settings.