AWS-Auth
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| aws_list_profilesA | List all available local AWS profiles, current active default profile, and configured regions. |
| aws_switch_profileB | Switch the default AWS credentials profile in ~/.aws/credentials to a specific profile name. Args: profile_name: Name of the AWS profile to set as default (e.g. 'dev', 'prod', 'qa') |
| aws_get_caller_identityA | Get current AWS caller identity (Account ID, IAM Role/User ARN, User ID) using STS. Args: profile_name: Optional profile name to check. If omitted, checks the default profile. |
| aws_get_session_envA | Get raw AWS session environment variables (AccessKey, SecretKey, SessionToken, Region) for isolated subprocess execution. Args: profile_name: AWS profile name (defaults to 'default') |
| aws_ensure_credentialsB | Check if AWS credentials are valid, and automatically refresh using cached SSO refresh token if expired. Args: profile_name: AWS profile name (defaults to 'default') |
| aws_list_ec2_instancesB | List EC2 instances in a specific AWS region using the specified profile. Args: region: AWS region (e.g. 'us-east-1', 'us-west-2') profile_name: AWS profile name to use (default: 'default') |
| aws_list_eks_clustersB | List EKS clusters in a specific AWS region and optionally configure local ~/.kube/config. Args: region: AWS region (e.g. 'us-east-1', 'us-west-2') profile_name: AWS profile name to use (default: 'default') update_kubeconfig: If True, automatically configures kubeconfig for found clusters |
| aws_update_kubeconfigB | Configure local kubeconfig to connect to a specific EKS cluster. Args: cluster_name: Name of the EKS cluster region: AWS region of the cluster profile_name: AWS profile name to authenticate with |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 8 tools
Most tools are clearly distinct by resource and action (list_profiles, switch_profile, get_caller_identity, list_ec2_instances). Minor overlap exists between aws_ensure_credentials and aws_get_caller_identity/aws_get_session_env (all credential/session related), and aws_update_kubeconfig overlaps with aws_list_eks_clusters' update_kubeconfig flag.
Every tool follows a strict aws_verb_noun pattern (aws_list_profiles, aws_switch_profile, aws_get_caller_identity, aws_list_ec2_instances). Fully predictable and consistent conventions throughout.
Eight tools is well-scoped for an auth/session + light resource-discovery server. Each tool earns its place without redundancy or bloat.
Core auth lifecycle is covered: profile listing/switching, credential validation/refresh, session env, caller identity, plus EKS/EC2 discovery and kubeconfig setup. Minor gaps like assume-role or profile creation/cleanup are absent but agents can work around them via the existing profile tools.