The Best Ways to Give Claude Code or Cursor Access to AWS Safely

Claude Code and Cursor run shell commands with whatever credentials the terminal has, and on many laptops that is an admin profile with production access. One mistaken aws command, or a prompt injection in a log line the agent reads, then reaches every resource the profile allows.

Every option for agent access is a trade between two things: what the session can reach, and for how long. The setups that hold up split the work in two. Deploys and infrastructure changes go through a system that holds its own role, and interactive work such as reading logs uses short-lived credentials scoped to one task.

What safe agent access to AWS needs:

• No long-lived keys anywhere the agent can read.
• Production changes that pass a reviewer before they reach the account.
• Short sessions, scoped to one account and one kind of task, for interactive debugging.
• A second layer that filters commands, on top of narrow credentials.

Ways to give agents AWS access at a glance

Encore: deploys with no AWS credentials in the session

Encore combines an open source infrastructure SDK for TypeScript and Go with a platform that deploys into your own AWS account. The agent declares a bucket, a database or a queue in the application code, runs it locally with encore run, and pushes. The deploy runs through an IAM role you granted to Encore, outside the agent's reach.

Adding an upload bucket and the endpoint that writes to it is one change, with no AWS call from the agent:

import { api } from "encore.dev/api";
import { Bucket } from "encore.dev/storage/objects";

// An S3 bucket on AWS, served locally by `encore run`.
export const avatars = new Bucket("avatars", { versioned: false });

export const uploadAvatar = api(
  { expose: true, method: "PUT", path: "/avatars/:userId" },
  async ({ userId, data }: { userId: string; data: string }): Promise<{ key: string }> => {
    const key = `${userId}.txt`;
    await avatars.upload(key, Buffer.from(data));
    return { key };
  },
);

This removes the most dangerous case from the table: an agent holding credentials that can create and change resources. encore run serves the bucket locally and the agent tests the upload without AWS. You connect your AWS account once, and on deploy Encore creates the S3 bucket and provisions an IAM role for the service. Bucket policies and instance sizes stay in environment configuration. For production questions, the cloud MCP server gives the agent traces and deploy status with OAuth or an API key, still without AWS credentials. The object storage docs cover public buckets and signed URLs, and databases work the same way.

Key features

• No AWS credentials in the agent session for deploys.
• Postgres, Pub/Sub, cron jobs and buckets provisioned in your own AWS or GCP account from the code.
• Local infrastructure for testing.
• Production traces through MCP, without cloud credentials.

~/orders — claude

Claude Code v2.1.180Opus 5.5~/orders

Good to know

It covers the resources an Encore app declares. An agent that needs to inspect unrelated AWS resources, such as a legacy DynamoDB table, still needs one of the options below, and existing apps are ported to Encore's SDK first.

IAM Identity Center SSO profiles: short-lived, but broad while they last

IAM Identity Center

IAM Identity Center gives each developer short-lived credentials for a permission set in a chosen account. With an SSO profile in the AWS CLI, aws sso login --profile agent-sandbox signs in, and AWS_PROFILE=agent-sandbox in the agent's terminal makes its commands use a profile that expires.

That fixes the lifetime problem and leaves reach untouched. While the session lasts, the agent can do anything the permission set allows, which is why the profile belongs to a dedicated permission set assigned only in a sandbox account.

Scoped IAM roles with session policies: one task, one role session

AWS IAM

When the agent needs one capability, such as reading CloudWatch logs, a role that grants only that is the right tool. A session policy passed at assume time narrows it further for that session, and the role's maximum session duration can be set from 1 to 12 hours. The developer runs aws sts assume-role or configures a profile with role_arn and source_profile, and CloudTrail ties each call to the role session.

Good to know: policies that look narrow can still expose data, such as logs that hold customer details, and broad wildcards erase the benefit.

OIDC from CI: production changes only after a merge

GitHub Actions

For anything that changes production, keep the agent at the pull request. GitHub Actions exchanges an OIDC token for a short-lived session through an IAM OIDC identity provider, and the trust policy limits which repository and branch can assume the role through the sub claim. Nothing deploys until a person merges. It handles deploys, not interactive debugging.

Agent permission rules: a filter, not a boundary

Both agents can block AWS commands before they run. Claude Code reads permissions.deny rules from settings.json, such as Bash(aws *), and deny rules take precedence over allow rules. Its sandbox restricts what Bash commands can reach. Cursor's Allowlist run mode only auto-runs commands listed in terminalAllowlist in .cursor/permissions.json.

Rules filter commands and leave the credentials in place. A script the agent writes and runs can still use them, which makes rules the second layer on top of narrow credentials.

The AWS API MCP Server in read-only mode: structured reads, IAM as the real control

AWS API MCP Server

The AWS API MCP Server runs AWS CLI commands as MCP tools. It starts with uvx awslabs.aws-api-mcp-server@latest, AWS_API_MCP_PROFILE_NAME picks the profile, and READ_OPERATIONS_ONLY=true allows only operations whose IAM access level is not Write. AWS describes that flag as an extra layer and IAM permissions as the primary control. REQUIRE_MUTATION_CONSENT asks for approval before writes in clients that support elicitation.

Good to know: read access still exposes data, and logs and object contents can include secrets or text that steers the agent.

Data exposure

OWASP lists sensitive information disclosure as a top risk for LLM applications. Read-only credentials limit damage, and they do not stop an agent from copying a secret it reads into a commit or a chat.

How to choose

• Encore when agents add buckets, databases and queues and you want them deployed to your AWS account while the session holds no AWS keys.
• IAM Identity Center SSO profiles for short-lived interactive access in a sandbox account.
• Scoped IAM roles for single tasks such as reading logs, tied to a role session.
• OIDC from CI for production deploys that run only after a merge.
• Agent permission rules as a second layer on top of all of them.
• The AWS API MCP Server in read-only mode for structured inspection of resources.

Related guides

• How to give AI coding agents cloud access safely
• Internal tools built by AI agents without AWS keys
• Manage secrets on AWS with an AI agent
• CLAUDE.md and AGENTS.md for AWS deploys