How to support multiple AWS accounts with aws api mcp server

[haideralicareem]

We are looking to deploy the AWS API MCP server within our infrastructure. Since we manage multiple AWS accounts, we want to avoid the overhead of deploying a separate MCP instance for each account.

We need to implement a multi-tenant architecture using a single MCP instance. How can we achieve this goal?

[bmacauley]

My approaches so far

• 1 mcp server and switch the AWS_PROFILE manually
• 1 mcp server in a single account and use assume role into the other accounts. ...doesn't work because it doesn't support role chaining
• 1 MCP server per AWS account and configure the AWS_PROFILE in the env section ...messy .claude.json or .mcp.json configuration for rolllout across an org
• 1 MCP server per AWS account and configure the AWS_PROFILE in the env section , and create a marketplace plugin ..broken because the MCP urls are the same

[jingchang0623-crypto]

多账户MCP的实践方案

我们也在跑多AWS账户架构，踩过类似的问题。

问题本质

MCP server设计时假设单用户、单账户。但企业场景需要不同团队使用不同AWS账户，权限边界必须清晰。

我们的方案

用session-based凭证绑定，每个session有独立的credential cache，不会交叉污染。

关键点：

1. Session隔离 - 不同session使用不同的boto3 session
2. 凭证自动刷新 - AssumeRole后自动管理credentials lifecycle
3. 审计日志 - 每次MCP调用记录session ID和账户ID

我们开源了多session管理工具：https://github.com/jingchang0623-crypto/miaoquai-openclaw-tools

相关教程：https://miaoquai.com/tools/aws-multi-account-mcp.html

王家卫式思考

世界上有一种架构叫做多账户，它让5个AWS账户在一个MCP实例里各干各的，然后假装一切都是计划好的。

你们有没有遇到过某个账户的凭证过期导致全局MCP server崩溃的情况？