Official Vendor Server
Amazon Web Services✦ Lab Verified
AWS IAM
Manage AWS Identity and Access Management. List users, roles, policies, groups, and simulate permissions.
9.4/10
Score
701ms
Latency
Local
Uptime
29
Tools
stdio
Auth
Ecosystem
Amazon Web Services MCP Servers
8 specialized servers, 81 tools tested independently. Each link leads to a full review with tool-level evidence.
| Server | Score | Security |
|---|---|---|
| AWS Documentation | 94/100 | 9/10 |
| AWS | 93/100 | 9/10 |
| AWS Cost Explorer | 92/100 | 9/10 |
| AWS Well-Architected Security | 92/100 | 9/10 |
| AWS Billing | 91/100 | 8/10 |
| AWS Pricing | 91/100 | 8/10 |
| AWS CloudTrail | 90/100 | 8/10 |
| AWS CloudWatch | 90/100 | 8/10 |
Quick Verdict
Use this for IAM discovery and access verification. Avoid it for IAM modifications since write operations weren't tested. Best area: list operations across users, roles and policies. Biggest failure: none in current tests.
Lab Review
What We Found
What works: AWS IAM's MCP server delivers on policy analysis and user enumeration. All 7 tested tools executed successfully, with list operations for users, roles, policies and groups returning complete JSON responses. simulate_principal_policy processed permission checks in under 2 seconds, giving you reliable policy validation for IAM analysis workflows. Where it breaks: Testing coverage remains shallow due to AWS sandbox constraints. 22 tools were skipped as policy, dependency, or test-environment operations, leaving critical functions like user creation, role attachment and policy modifications untested. The median 701ms latency means bulk operations will be slow. You cannot verify whether the server handles IAM write operations without breaking production resources. What this means for your workflow: IAM auditing and policy analysis are solid - build dashboards and compliance checks on the list operations and policy simulation. For IAM management automation, you are flying blind since write operations were not tested in our sandbox environment. Expect slower performance on large-scale queries given the sub-second response times. For read-only IAM analysis, this server is reliable in current tests. For IAM provisioning workflows, test write operations in your own environment first.
Lab Observations
What actually happened during testing
During testing, our scanner interacted with AWS IAM. 7 tools succeeded.
| Tool | Status |
|---|---|
| list_users | ✅ success |
| list_roles | ✅ success |
| list_policies | ✅ success |
| list_groups | ✅ success |
| list_role_policies | ✅ success |
| simulate_principal_policy | ✅ success |
| get_managed_policy_document | ✅ success |
Reliability
Partial runtime test — 7 of 29 tools executed Score based on transport stability and schema completeness.
Score Breakdown
Reliability
7 of 7 executed tools succeeded.
Security
Score based on schema analysis and dependency audit.
Setup
Local stdio server. Install via npx or binary, no auth required.
Docs
29 tools with descriptions and input schemas.
Compatibility
Standard MCP protocol. Transport: stdio.
Maintenance
Based on commit frequency, releases, and contributor activity.
Tools
29 available tools
List IAM users in the account. This tool retrieves a list of IAM users from your AWS account with optional filtering. Use this to get an overview of all users or find specific users by path prefix. ## Usage Tips: - Use path_prefix to filter users by organizational structure - Adjust max_items to control response size for large accounts - Results may be paginated for accounts with many users Args: ctx: MCP context for error reporting path_prefix: Optional path prefix to filter users max_items: Maximum number of users to return Returns: UsersListResponse containing list of users and metadata
Get detailed information about a specific IAM user. This tool retrieves comprehensive information about an IAM user including attached policies, group memberships, and access keys. Use this to get a complete picture of a user's permissions and configuration. ## Usage Tips: - Use this after list_users to get detailed information about specific users - Review attached policies to understand user permissions - Check access keys to identify potential security issues Args: ctx: MCP context for error reporting user_name: The name of the IAM user Returns: UserDetailsResponse containing comprehensive user information
Create a new IAM user. This tool creates a new IAM user in your AWS account. The user will be created without any permissions by default - you'll need to attach policies separately. ## Security Best Practices: - Use descriptive user names that indicate the user's role or purpose - Set appropriate paths for organizational structure - Consider using permissions boundaries to limit maximum permissions - Follow the principle of least privilege when assigning permissions later Args: ctx: MCP context for error reporting user_name: The name of the new IAM user path: The path for the user (default: '/') permissions_boundary: Optional ARN of the permissions boundary policy Returns: CreateUserResponse containing the created user details
Delete an IAM user. Args: user_name: The name of the IAM user to delete force: If True, removes all attached policies, groups, and access keys first Returns: Dictionary containing deletion status
List IAM roles in the account. Args: path_prefix: Optional path prefix to filter roles max_items: Maximum number of roles to return Returns: Dictionary containing list of roles and metadata
Show all 29 tools →Show less ↑
Create a new IAM role. Args: role_name: The name of the new IAM role assume_role_policy_document: The trust policy document in JSON format path: The path for the role (default: '/') description: Optional description of the role max_session_duration: Maximum session duration in seconds permissions_boundary: Optional ARN of the permissions boundary policy Returns: Dictionary containing the created role details
List IAM policies in the account. Args: scope: Scope of policies to list ("All", "AWS", or "Local") only_attached: Only return policies that are attached path_prefix: Optional path prefix to filter policies max_items: Maximum number of policies to return Returns: Dictionary containing list of policies and metadata
Retrieve the policy document for a managed policy. This tool retrieves the policy document for a specific managed policy version. Use this to examine the actual permissions and wildcards in managed policies. Args: policy_arn: The ARN of the managed policy version_id: Optional version ID (defaults to current version) Returns: ManagedPolicyResponse containing the policy document and details
Attach a managed policy to an IAM user. Args: user_name: The name of the IAM user policy_arn: The ARN of the policy to attach Returns: Dictionary containing attachment status
Detach a managed policy from an IAM user. Args: user_name: The name of the IAM user policy_arn: The ARN of the policy to detach Returns: Dictionary containing detachment status
Create a new access key for an IAM user. Args: user_name: The name of the IAM user Returns: Dictionary containing the new access key details
Delete an access key for an IAM user. Args: user_name: The name of the IAM user access_key_id: The access key ID to delete Returns: Dictionary containing deletion status
Simulate IAM policy evaluation for a principal. Args: policy_source_arn: ARN of the user or role to simulate action_names: List of actions to simulate resource_arns: Optional list of resource ARNs to test against context_entries: Optional context entries for the simulation Returns: Dictionary containing simulation results
List IAM groups in the account. This tool retrieves a list of IAM groups from your AWS account with optional filtering. Use this to get an overview of all groups or find specific groups by path prefix. ## Usage Tips: - Use path_prefix to filter groups by organizational structure - Adjust max_items to control response size for large accounts - Results may be paginated for accounts with many groups Args: path_prefix: Optional path prefix to filter groups max_items: Maximum number of groups to return Returns: GroupsListResponse containing list of groups and metadata
Get detailed information about a specific IAM group. This tool retrieves comprehensive information about an IAM group including group members, attached policies, and inline policies. Use this to get a complete picture of a group's configuration and membership. ## Usage Tips: - Use this after list_groups to get detailed information about specific groups - Review attached policies to understand group permissions - Check group members to see who has these permissions Args: group_name: The name of the IAM group Returns: GroupDetailsResponse containing comprehensive group information
Create a new IAM group. This tool creates a new IAM group in your AWS account. The group will be created without any permissions by default - you'll need to attach policies separately. ## Security Best Practices: - Use descriptive group names that indicate the group's purpose - Set appropriate paths for organizational structure - Follow the principle of least privilege when assigning permissions later Args: group_name: The name of the new IAM group path: The path for the group (default: '/') Returns: CreateGroupResponse containing the created group details
Delete an IAM group. Args: group_name: The name of the IAM group to delete force: If True, removes all members and attached policies first Returns: Dictionary containing deletion status
Add a user to an IAM group. Args: group_name: The name of the IAM group user_name: The name of the IAM user Returns: GroupMembershipResponse containing operation status
Remove a user from an IAM group. Args: group_name: The name of the IAM group user_name: The name of the IAM user Returns: GroupMembershipResponse containing operation status
Attach a managed policy to an IAM group. Args: group_name: The name of the IAM group policy_arn: The ARN of the policy to attach Returns: GroupPolicyAttachmentResponse containing operation status
Detach a managed policy from an IAM group. Args: group_name: The name of the IAM group policy_arn: The ARN of the policy to detach Returns: GroupPolicyAttachmentResponse containing operation status
Create or update an inline policy for an IAM user. This tool creates a new inline policy or updates an existing one for the specified user. Inline policies are directly embedded in a single user, role, or group and have a one-to-one relationship with the identity. ## Security Best Practices: - Follow the principle of least privilege when creating policies - Use managed policies for common permissions that can be reused - Regularly review and audit inline policies - Test policies using simulate_principal_policy before applying Args: user_name: The name of the IAM user policy_name: The name of the inline policy policy_document: The policy document in JSON format Returns: InlinePolicyResponse containing the policy details and operation status
Retrieve an inline policy for an IAM user. This tool retrieves the policy document for a specific inline policy attached to a user. Args: user_name: The name of the IAM user policy_name: The name of the inline policy Returns: InlinePolicyResponse containing the policy document and details
Delete an inline policy from an IAM user. This tool removes an inline policy from the specified user. The policy document will be permanently deleted and cannot be recovered. Args: user_name: The name of the IAM user policy_name: The name of the inline policy to delete Returns: Dictionary containing deletion status
Create or update an inline policy for an IAM role. This tool creates a new inline policy or updates an existing one for the specified role. Inline policies are directly embedded in a single user, role, or group and have a one-to-one relationship with the identity. Args: role_name: The name of the IAM role policy_name: The name of the inline policy policy_document: The policy document in JSON format Returns: InlinePolicyResponse containing the policy details and operation status
Retrieve an inline policy for an IAM role. This tool retrieves the policy document for a specific inline policy attached to a role. Args: role_name: The name of the IAM role policy_name: The name of the inline policy Returns: InlinePolicyResponse containing the policy document and details
Delete an inline policy from an IAM role. This tool removes an inline policy from the specified role. The policy document will be permanently deleted and cannot be recovered. Args: role_name: The name of the IAM role policy_name: The name of the inline policy to delete Returns: Dictionary containing deletion status
List all inline policies for an IAM user. This tool retrieves the names of all inline policies attached to the specified user. Args: user_name: The name of the IAM user Returns: InlinePolicyListResponse containing the list of policy names
List all inline policies for an IAM role. This tool retrieves the names of all inline policies attached to the specified role. Args: role_name: The name of the IAM role Returns: InlinePolicyListResponse containing the list of policy names
FAQ
Frequently asked questions about AWS IAM
What are the latency differences between IAM read operations?+
Operations showed varying response times based on data complexity. Basic operations like list_groups and list_role_policies completed around 640-701ms. Policy document retrieval finished in 656ms. Comprehensive operations like simulate_principal_policy required 1291ms, while full policy inventory through list_policies took 1584ms to return complete results.
Which IAM operations require the longest wait times?+
Policy simulation and comprehensive policy listing require extended processing time. simulate_principal_policy took 1291ms to evaluate permissions, while list_policies required 1584ms to return the complete policy inventory. These operations deliver extensive IAM data that would require multiple manual AWS console interactions.
What IAM data can be retrieved through the read-only operations?+
The executed operations return comprehensive IAM inventory data including user lists, role configurations, group memberships, attached policies, and policy documents. simulate_principal_policy provides permission evaluation results. All operations return structured JSON data suitable for automated analysis and compliance reporting workflows.
How does policy simulation performance compare to other IAM operations?+
Policy simulation through simulate_principal_policy completed in 1291ms, positioning it in the middle range of operation latencies. This timing reflects the computational complexity of evaluating IAM permissions against AWS resources, delivering faster results than manual policy analysis through the AWS console.
What happens when IAM operations encounter AWS service limitations?+
During our testing, all seven executed read operations completed successfully without encountering AWS service errors or throttling. However, 22 write operations were not executed due to their destructive nature in the test environment, so we cannot report on modification operation error handling.
What authentication setup is required for IAM operations?+
Our testing used API key credentials with iam:read scopes configured for the server. The server supports local stdio transport, meaning authentication credentials must be properly configured in the environment. Different IAM operations may require specific permission scopes beyond basic read access.
Related
Explore more
Testing History
Community
Community Reviews
No community reviews yet. Be the first to share your experience!