Integrating AWS API MCP Server with Amazon Quick using Amazon Bedrock AgentCore Runtime

TL;DR

• The article demonstrates integrating Amazon Bedrock AgentCore Runtime with Amazon Quick via the Model Context Protocol (MCP) to enable natural language access to AWS services.
• This solution translates natural language queries into AWS CLI commands without requiring users to memorize syntax or switch between interfaces, using the AWS API MCP Server from AWS Marketplace.
• Authentication is handled through Amazon Cognito using a machine-to-machine application type, generating JWT tokens that are validated by AgentCore Runtime against an identity provider discovery URL.
• The estimated monthly cost for a single Enterprise user running approximately 500 queries is $292, driven by a $40/user subscription and a $250/account infrastructure fee.
• Implementation requires an Amazon Quick Enterprise subscription (Professional tier minimum), AWS administrative access, and basic knowledge of IAM, OAuth 2.0, and JWT concepts.

Why It Matters

This integration lowers the barrier to entry for cloud-native AI agents by standardizing how conversational interfaces interact with cloud infrastructure through the Model Context Protocol. By automating the translation of business questions into precise API calls, it reduces operational friction for SREs and DevOps engineers, particularly during incident investigations and capacity planning where speed and accuracy are critical. The solution emphasizes security by enforcing least-privilege execution roles and providing full audit trails, making it suitable for compliance-sensitive enterprise environments.

Key Data

• Estimated Monthly Cost: Approximately $292/month for a single Enterprise user running ~500 queries, comprising a $40/user Amazon Quick subscription and a $250/account infrastructure fee.
• Subscription Requirement: Amazon Quick Enterprise subscription (Professional tier minimum) is mandatory for the solution.
• Estimated Setup Time: 30–45 minutes to complete the manual deployment prerequisites and configuration.
• Authentication Protocol: Uses OAuth 2.0 client credentials flow with Amazon Cognito machine-to-machine applications to generate JWT tokens.
• Query Example: "Show me all running EC2 instances in us-east-1" serves as the primary use case for demonstrating natural language to API translation.

Technical Details

• Architecture Flow: The Amazon Quick custom agent interprets user intent, obtains a JWT from Amazon Cognito, and passes it to the Amazon Bedrock AgentCore Runtime. The Runtime validates the token against the configured Cognito identity provider before invoking the AWS API MCP Server running in a containerized environment.
• MCP Integration: The AWS API MCP Server acts as the translation layer, converting the natural language intent into specific AWS CLI commands. This server is accessed via AWS Marketplace and runs within the secure AgentCore Runtime environment.
• Security & Authorization: The system enforces least-privilege access by executing commands using a pre-configured IAM execution role. Authentication relies on AgentCore Identity to validate bearer tokens in the Authorization header, rejecting unauthorized requests automatically.
• Prerequisites: The setup requires creating an Amazon Cognito user pool (specifically a machine-to-machine application type), IAM roles/policies, an AgentCore Runtime agent, and CloudWatch log groups. Familiarity with URL encoding in the AWS CLI is noted as required for the walkthrough.

Industry Insight

• Standardization of Agent Interfaces: The use of Model Context Protocol (MCP) suggests a shift toward standardized protocols for connecting AI agents with cloud infrastructure, reducing the need for custom integration code for every new use case.
• Cost Implications for Enterprise AI: The fixed infrastructure fee of $250/account per month alongside per-user subscription costs indicates that AWS is positioning this as a premium enterprise feature, targeting organizations with significant operational overheads where the cost is justified by time saved on manual API scripting.
• Security-First Design: By integrating deeply with existing IAM and Cognito frameworks rather than creating new identity silos, this approach lowers the adoption barrier for security teams, ensuring that AI-driven operations remain within established compliance and audit boundaries (CloudWatch trails).

zon Cognito?
A: No, your existing agent code requires no modification. You only need to add the authorizer configuration to your runtime deployment during the CreateAgentRuntime operation.

Q: What is the primary benefit of using the AWS API MCP Server over manually scripting API calls?
A: It allows users to ask questions in natural language, which are automatically translated into accurate AWS CLI commands. This eliminates the need to memorize API syntax, reduces human error, and enables faster cross-service queries without context-switching between dashboards.

Q: What are the specific AWS service prerequisites for implementing this solution?
A: You need access to create Amazon Cognito user pools, IAM roles and policies, Amazon Bedrock AgentCore Runtime agents, and Amazon CloudWatch Log groups. Additionally, an Amazon Quick Enterprise subscription and access to the AWS Marketplace for the AWS API MCP Server are required.