Investigate database pressure
Find the RDS instance, then ask for CPU, connection count or storage metrics over the incident window. Combine the infrastructure evidence with a PostgreSQL or MySQL query through the same endpoint.
Cloud & infrastructure · MCP integration
Give AI a read-only view of your AWS infrastructure.
Investigate an incident with resource state, CloudWatch metrics and alarms in the same conversation. GateRook exposes AWS inventory and monitoring through two MCP tools, using the AWS account and regions you configure. Your AI client receives the permitted results; GateRook resolves the credentials locally.
Connection in GateRook
stage-aws
AWS
stage / QA- Regions
- eu-central-1
- Credentials source
- profile
- Profile
- stage-reader
- Role ARN
- arn:aws:iam::412398765012:role/gw-readonly
The route
Your AI requests a tool. GateRook checks the endpoint policy, resolves credentials locally, and calls the configured service.
Understand the request flowAsk your AI
List the RDS databases in our stage AWS account in eu-central-1.
aws_describe · arguments
{
"connection": "stage-aws",
"region": "eu-central-1",
"type": "AWS::RDS::DBInstance",
"limit": 10
}Example result
{
"provider": "aws",
"account": "412398765012",
"region": "eu-central-1",
"type": "AWS::RDS::DBInstance",
"mode": "list",
"resources": [
{
"identifier": "stage-orders",
"properties": {
"DBInstanceIdentifier": "stage-orders",
"Engine": "postgres"
}
}
],
"count": 1,
"truncated": false,
"nextCursor": null
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Put context to work
What you can do with AWS and AI
Understand a service dependency
Inspect supported instances, load balancers, ECS services and queues. Ask AI to explain the resource relationships using the state returned by AWS.
Triage an alarm
Read current alarm states and the associated metric series before deciding which service to investigate. Every MCP call is available in the activity log.
From service to MCP
How to connect AWS
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select AWS. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Choose the AWS identity
Prepare a local AWS profile or access key with permission to read the resources and metrics you need. If you use AssumeRole, configure its trust relationship and ExternalId before adding the connection.
Add an AWS connection
Open Connections, add AWS, name it stage-aws and choose the stage environment. Enter the regions, credential source and optional role. Keep the generated session policy enabled.
Test the account and scope
Run Test connection and inspect the resolved account. Check the Cloud policy for permitted services, regions and resource filters, then save the connection. A successful identity check does not grant permissions missing from AWS IAM.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure AWS in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Regions | eu-central-1 | Add one or more AWS regions. The first region is the default for tool calls. |
Credentials source | profile | Use an existing AWS profile on this computer, or choose accessKey and enter its secret in the protected field. |
Profile | stage-reader | The named profile must exist in your local AWS configuration. |
Role ARN | arn:aws:iam::412398765012:role/gw-readonly | Optional AssumeRole target. Configure the role trust and ExternalId to match the connection. |
Session policy | generated | When assuming a role, GateRook adds a generated read-only session policy. Without a role, that session policy cannot be enforced by AWS. |
Account ID | 412398765012 | Enter the expected account or inspect the account found by Test connection. Later calls reject an account mismatch. |
Know what you expose
AWS tools and access boundaries
The connector determines what is possible. Endpoint modes and connection policies determine what a particular AI client may use.
| Tool | Purpose | Access behavior |
|---|---|---|
aws_describe | List resources by CloudFormation type, or inspect one identifier returned by a list. Supports allowed regions, parent identifiers, property selection and post-list filters. | Read only |
aws_metrics | Query CloudWatch metrics and metric math, list recently active metrics, or inspect alarms. Query up to ten metrics in one request. | Read only |
Before you enable access
- This connector reads resources and metrics. It does not provision, restart, deploy or delete AWS resources.
- Resource discovery uses AWS Cloud Control and depends on type support and IAM permissions. Some resource types require a parent identifier.
- Connection regions and the environment Cloud policy restrict what can be returned. The gateway cannot grant permissions that the AWS identity does not have.
- The generated AWS session policy applies to AssumeRole sessions; the local read-only tools remain the only exposed operations when a role is not configured.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
AWS connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Can I connect Claude or Cursor to AWS without putting an AWS key in its config?
Yes. Configure AWS credentials or a local profile in GateRook, then connect the AI client to the GateRook endpoint. The client uses gateway authentication; it does not need the AWS secret access key.
Can this AWS MCP connector change infrastructure?
No. Its tools are aws_describe and aws_metrics. Both are read-only. Use the results to investigate and plan a change through your existing deployment process.
Why is a resource missing?
Check the connection region, Cloud policy filters and AWS permissions. Also check whether the CloudFormation type supports the Cloud Control operation and whether its list operation needs a parent.
Keep exploring
Connect the rest of your stack
Google Cloud
Use AI with Google Cloud through GateRook MCP tools. Search Cloud Asset inventory, inspect supported resources live and query Cloud Monitoring with scoped credentials.
Kubernetes
Connect AI to Kubernetes with GateRook. Inspect pods, events and logs over MCP, restrict namespaces, and review rollout restarts or manifest changes before execution.
PostgreSQL
Connect PostgreSQL to an MCP-compatible AI app with GateRook. Explore schemas, run read-only SQL, review changes and keep database credentials out of prompts.
Your infrastructure, on your terms
Bring AWS into the conversation.
Start with one connection. Choose what your AI can do.