AWS shipped OAuth for the AWS MCP Server so coding agents can use the same browser login as console/CLI (IAM Identity Center, federation, root/IAM), with Dynamic Client Registration instead of pasted client secrets. Headless bots can use SigV4 client_credentials. IAM still gates every tool call, with new condition keys, token revoke/introspect, and CloudTrail on AuthorizeOAuth2Access.

Key Takeaways

  • ✓Auth: MCP can use console-style browser OAuth without pasted client secrets.
  • ✓Headless: bots with AWS creds can use SigV4 client_credentials.
  • ✓Governance: IAM gates tool calls with revoke/introspect and CloudTrail.
ADSponsored