AWS agent-toolkit documentation change
Summary
Updated supported agents list (added Kiro), clarified authentication methods including OAuth 2.1, emphasized security in rules files, and added IAM scoping recommendation.
Security assessment
Changes emphasize security best practices (least-privilege IAM, secure configuration via rules files) and document new OAuth 2.1 authentication, but lack evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/agent-toolkit/latest/userguide/what-is-agent-toolkit.md b/agent-toolkit/latest/userguide/what-is-agent-toolkit.md index 5bf823421..76dcf8ce6 100644 --- a//agent-toolkit/latest/userguide/what-is-agent-toolkit.md +++ b//agent-toolkit/latest/userguide/what-is-agent-toolkit.md @@ -11 +11 @@ ComponentsWhat can I do with the Agent Toolkit for AWS?How the Agent Toolkit for -The Agent Toolkit for AWS gives AI coding agents the tools, knowledge, and guardrails they need to build, deploy, and manage applications on AWS. It works with the coding agents that developers already use — including Claude Code, Cursor, and Codex — without requiring you to switch tools or learn a new workflow. +The Agent Toolkit for AWS gives AI coding agents the tools, knowledge, and guardrails they need to build, deploy, and manage applications on AWS. It works with the coding agents that developers already use, such as Kiro, Claude Code, Cursor, and Codex. You don't need to switch tools or learn a new workflow. @@ -13 +13 @@ The Agent Toolkit for AWS gives AI coding agents the tools, knowledge, and guard -AI coding agents can handle common AWS tasks like creating an Amazon S3 bucket or launching an Amazon EC2 instance, but they often struggle with complex, multi-step workflows. They choose the wrong service for a use case, misconfigure resources, or repeatedly retry operations on newer services they were not trained on. The Agent Toolkit for AWS addresses this by giving agents secure access to any AWS service, up-to-date documentation, and step-by-step guidance for the tasks where they need it most. +AI coding agents can handle common AWS tasks like creating an Amazon S3 bucket or launching an Amazon EC2 instance. However, they often struggle with complex, multi-step workflows. They choose the wrong service for a use case, misconfigure resources, or repeatedly retry operations on newer services they were not trained on. The Agent Toolkit for AWS addresses these gaps. It gives agents secure access to AWS services, current documentation, and step-by-step guidance. @@ -32 +32 @@ The Agent Toolkit for AWS includes four components that work together: - * **AWS MCP Server** — A managed server that gives agents access to AWS through the Model Context Protocol (MCP). Agents can search AWS documentation and retrieve service information without authentication. To execute AWS API calls, run Python scripts in a sandboxed environment, or follow curated skills, agents authenticate through your existing IAM credentials. All of these capabilities are available through a single endpoint with CloudWatch metrics and IAM-based access controls. + * **AWS MCP Server** – A managed server that gives agents access to AWS through the Model Context Protocol (MCP). Kiro, Claude Code, Cursor, Codex, and other MCP-compatible agents connect to this server. Agents can search AWS documentation and get service information without authentication. To run API calls, execute Python scripts, or follow curated skills, agents authenticate with your existing AWS Identity and Access Management (IAM) credentials. A single endpoint provides all these capabilities, with CloudWatch metrics and IAM-based access controls. @@ -34 +34 @@ The Agent Toolkit for AWS includes four components that work together: - * **Agent skills** — Curated packages of instructions, code scripts, and reference materials that help agents complete specific AWS tasks. Skills are loaded on demand — agents discover and retrieve only the skills relevant to the current task, so they do not consume unnecessary context. Skills cover service selection, step-by-step procedures, troubleshooting, and SDK best practices. + * **Agent skills** – Curated packages of instructions, code scripts, and reference materials that help agents complete specific AWS tasks. Agents load skills on demand. They discover and retrieve only the skills relevant to the current task, so they do not consume unnecessary context. Skills cover service selection, step-by-step procedures, troubleshooting, and SDK best practices. @@ -36 +36 @@ The Agent Toolkit for AWS includes four components that work together: - * **Plugins** — Single-install packages for Claude Code and Codex that bundle the AWS MCP Server configuration and a curated set of agent skills. After you install a plugin, your agent is ready to work with AWS. + * **Plugins** – Single-install packages for Claude Code and Codex that bundle the AWS MCP Server configuration and a curated set of agent skills. After you install a plugin, your agent is ready to work with AWS. Kiro connects to the AWS MCP Server directly and does not require a plugin. @@ -38 +38 @@ The Agent Toolkit for AWS includes four components that work together: - * **Rules files** — Project-level configuration files that set guardrails and preferences for how agents work in your project. Rules files tell agents how to use AWS most effectively — for example, by using the AWS MCP Server, discovering available skills, or searching documentation before acting. + * **Rules files** – Project-level configuration files that set guardrails and preferences for how agents work in your project. Rules files tell agents how to use AWS most effectively and securely. For example, they direct agents to use the AWS MCP Server, discover available skills, or search documentation before acting. @@ -47 +47 @@ With the Agent Toolkit for AWS, your AI coding agent can: - * **Build and deploy applications on AWS** — Your agent creates AWS infrastructure, writes application code, and deploys to production. Skills from the toolkit guide your agent through choosing the right services, configuring them correctly, and following deployment best practices. + * **Build and deploy applications on AWS** – Your agent creates AWS infrastructure, writes application code, and deploys to production. Skills guide your agent through choosing the right services, configuring them correctly, and following deployment best practices. @@ -49 +49 @@ With the Agent Toolkit for AWS, your AI coding agent can: - * **Stay up to date on the latest AWS services** — The AI models that power coding agents are trained on data that can be months or years old. Newer AWS services and recently launched features are often missing from an agent's knowledge. The toolkit gives your agent real-time access to current AWS documentation, API references, and service capabilities. + * **Stay up to date on the latest AWS services** – The AI models that power coding agents are trained on data that can be months or years old. Newer AWS services and recently launched features are often missing from an agent's knowledge. The Agent Toolkit for AWS gives your agent real-time access to current AWS documentation, API references, and service capabilities. @@ -51 +51 @@ With the Agent Toolkit for AWS, your AI coding agent can: - * **Follow tested procedures for complex workflows** — Instead of improvising from general knowledge, your agent follows tested procedures provided by the toolkit for workflows like configuring least-privilege IAM policies, setting up data pipelines, or deploying production-ready serverless applications. + * **Follow tested procedures for complex workflows** – Instead of improvising from general knowledge, your agent follows tested procedures. These include configuring least-privilege IAM policies, setting up data pipelines, and deploying production-ready serverless applications. @@ -53 +53 @@ With the Agent Toolkit for AWS, your AI coding agent can: - * **Troubleshoot operational issues** — Point your agent at a failing deployment, a spike in error rates, or an unexpected cost increase. The toolkit provides skills that help your agent work with CloudWatch logs and metrics, CloudFormation stack status, and troubleshooting procedures. + * **Troubleshoot operational issues** – Point your agent at a failing deployment, a spike in error rates, or an unexpected cost increase. Skills help your agent work with CloudWatch logs and metrics, CloudFormation stack status, and troubleshooting procedures. @@ -55 +55 @@ With the Agent Toolkit for AWS, your AI coding agent can: - * **Operate with security and visibility** — The AWS MCP Server provides CloudWatch metrics for monitoring agent activity, IAM-based access controls, and the ability to set enterprise guardrails — like restricting agents to read-only operations or blocking specific actions through MCP. + * **Operate with security and visibility** – The AWS MCP Server provides CloudWatch metrics for monitoring agent activity and IAM-based access controls. You can also set enterprise guardrails, such as restricting agents to read-only operations or blocking specific actions. @@ -57 +57 @@ With the Agent Toolkit for AWS, your AI coding agent can: - * **Work with any MCP-compatible agent** — The Agent Toolkit for AWS works with Claude Code, Cursor, Codex, Kiro, Windsurf, Cline, and any other agent that supports the Model Context Protocol. + * **Work with any MCP-compatible agent** – The Agent Toolkit for AWS works with Claude Code, Cursor, Codex, Kiro, Windsurf, Cline, and any other agent that supports the Model Context Protocol. @@ -66 +66 @@ The Agent Toolkit for AWS helps your AI coding agent build on AWS in three ways: - * **Skills provide structured guidance** — The agent uses skills that are installed locally via a plugin, or discovers them at runtime through the AWS MCP Server. Skills contain step-by-step instructions, decision guides, and reference materials that guide the agent through complex procedures while following AWS best practices. + * **Skills provide structured guidance** – Your agent uses skills installed locally through a plugin or discovers them at runtime through the AWS MCP Server. Skills contain step-by-step instructions, decision guides, and reference materials. These guide your agent through complex procedures while following AWS best practices. @@ -68 +68 @@ The Agent Toolkit for AWS helps your AI coding agent build on AWS in three ways: - * **Knowledge tools provide current information** — When the agent needs up-to-date information, it can search AWS documentation, retrieve API references, check regional availability, and access the latest AWS service information. + * **Knowledge tools provide current information** – When your agent needs up-to-date information, it can search AWS documentation and retrieve API references. It can also check regional availability and access the latest AWS service information. @@ -70 +70 @@ The Agent Toolkit for AWS helps your AI coding agent build on AWS in three ways: - * **API tools execute authenticated actions** — The AWS MCP Server translates requests into properly formatted AWS API calls, handles authentication using your IAM credentials, and executes the commands with detailed feedback about results and any errors. For complex multi-step operations, agents can write and execute Python scripts in an isolated sandbox using the `run_script` tool. + * **API tools execute authenticated actions** – The AWS MCP Server translates requests into properly formatted AWS API calls, handles authentication with your IAM credentials, and returns detailed feedback about results and errors. For complex multi-step operations, your agent can write and run Python scripts in an isolated sandbox using the `run_script` tool. @@ -77 +77 @@ The AWS MCP Server automatically adds two global condition context keys (`aws:Vi -Authentication and authorization use your existing AWS IAM roles and policies, so you maintain full control over what resources and actions are available. +Authentication and authorization use your existing AWS IAM roles and policies, so you maintain full control over what your agent can access and do. You can authenticate using SigV4 credentials through the MCP Proxy for AWS, or use OAuth 2.1 through AWS Sign-in for a direct connection without local proxy software. See [OAuth 2.1 authentication for AWS MCP Server](./oauth-authentication.html) for OAuth setup. @@ -81 +81 @@ Authentication and authorization use your existing AWS IAM roles and policies, s -We recommend scoping down IAM roles to the minimum permissions that the agent needs to perform its task. +We recommend scoping down IAM roles to the minimum permissions that your agent needs to perform its task.