agent-toolkit-for-aws: AWS's official toolkit for wiring your coding agent into 300+ cloud services

AWS built this one themselves, which matters more than it sounds. agent-toolkit-for-aws is the official successor to earlier AWS Labs MCP experiments — built from customer feedback, Apache 2.0, and wired into Claude Code's plugin marketplace by default. The pitch: give your coding agent real, official access to AWS services instead of community-maintained wrappers that lag behind API changes.

What's in the box

Four Claude Code plugins ship from the official Anthropic marketplace. aws-core handles the everyday stuff: service selection, CDK/CloudFormation, serverless, containers, S3, observability, and deployment. aws-agents covers Amazon Bedrock and AgentCore for building AI systems. aws-data-analytics wires in S3 Tables, Glue, and Athena for ETL workflows. aws-agents-for-devsecops adds incident investigation, vulnerability scanning, and penetration testing.

Underneath all four sits the AWS MCP Server: a managed endpoint covering 300+ AWS services, sandboxed Python execution, real-time AWS docs search, and CloudWatch/CloudTrail integration for enterprise audit logging.

When it earns its install

If you regularly deploy to AWS from the Claude Code terminal, /plugin install aws-core@claude-plugins-official is a 30-second install that genuinely pays off. The agent gains working knowledge of which S3 storage class fits your access pattern, how to wire up Lambda IAM policies correctly, and how to read CloudWatch logs without you pasting errors manually. One thoughtful design detail: IAM condition keys that distinguish agent actions from human actions, so your audit trail reflects who — or what — touched your infrastructure.

The honest caveat

Most of this value disappears if your AWS credentials aren't stable. Real-time docs search works unauthenticated, but everything that touches actual cloud services needs valid creds in place. If you're on IAM Identity Center or any setup that rotates short-lived tokens, mid-task auth failures are a real risk — and the agent's error output won't always make the root cause obvious. The skills are also intentionally broad rather than deep: you'll get a solid starting point for Glue ETL or a Bedrock agent setup, but review the output before it touches anything production-critical.

# Claude Code — install the core AWS plugin
/plugin install aws-core@claude-plugins-official

# DevSecOps bundle (reload and run setup after)
/plugin install aws-agents-for-devsecops@claude-plugins-official
/reload-plugins
/aws-agents-for-devsecops:setup

# Kiro, fx, and other agents
npx skills add aws/agent-toolkit-for-aws/skills

Full source at github.com/aws/agent-toolkit-for-aws. Supports Claude Code, Codex, Cursor, Kiro, and fx. Apache 2.0.