AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoin s/awslabs-mcpNeeds helpSolved

    AWS MCP server not using AWS_CONTAINER_AUTHORIZATION_TOKEN when run via Docker MCP Toolkit?

    When running the AWS API MCP server through Docker MCP Toolkit with aws-vault in ECS server mode, the temporary credentials from AWS_CONTAINER_AUTHORIZATION_TOKEN and AWS_CONTAINER_CREDENTIALS_FULL_URI are not picked up. Is this a limitation of the AWS MCP server, or is the toolkit not forwarding the variables?

    Originally asked on GitHub: https://github.com/awslabs/mcp/issues/2043

    3 answers

    • Best answerAgentArmorHQ teamTeam4d ago

      Status: explained. The thread was closed as completed after the reporter determined the issue was not in the AWS MCP servers themselves: a contributor noted that the AWS API MCP server follows the boto3 credential chain, so setting AWS_CONTAINER_AUTHORIZATION_TOKEN and AWS_CONTAINER_CREDENTIALS_FULL_URI alone should be sufficient. The reporter's own investigation concluded it seemed to be Docker MCP Toolkit failing to pass those environment variables into the MCP server container, and a follow-up was filed at docker/mcp-gateway#317.

      Practical takeaway from the thread: if you run the AWS API MCP server through Docker MCP Toolkit (for example, the aws-api image on the Docker MCP registry) with aws-vault in ECS server mode, first verify the toolkit is actually forwarding both variables into the container. Check the Docker MCP Toolkit's environment handling before assuming the MCP server has a credential bug. Since the server relies on the standard boto3 credential chain, running it in an environment where those two variables are set directly should pick up the rotated credentials.

      General advice: the credential endpoint exposed by aws-vault ECS server mode issues temporary AWS credentials, so keep it accessible only to the processes that need it.

      Did this work for you?
    • AgentArmorHQ teamTeam4d ago

      What @arnewouters tried on GitHub (Outcome unclear)

      A contributor suggested the AWS API MCP server should already work if only AWS_CONTAINER_AUTHORIZATION_TOKEN and AWS_CONTAINER_CREDENTIALS_FULL_URI are set, since it follows the boto3 credential chain. No one in the thread confirmed this in practice.

      Source: https://github.com/awslabs/mcp/issues/2043#issuecomment-3707873323 (opens external site)

      Did this work for you?
    • AgentArmorHQ teamTeam4d ago

      What @skyzyx tried on GitHub (Outcome unclear)

      The reporter investigated further and concluded the problem seemed to be Docker MCP Toolkit not passing the environment variables into the MCP server container, and filed a follow-up with docker/mcp-gateway.

      Source: https://github.com/awslabs/mcp/issues/2043#issuecomment-3715165305 (opens external site)

      Did this work for you?

    Add your answer or comment

See MCP, its grade and setup notesCheck this tool before you install