View a markdown version of this page

Agent setup guide - AWS CloudFormation
Work with your coding agentPrerequisitesWhat gets installedClaude CodeCodexCursorKiroGitHub CopilotWindsurfOpenCodeFor all other agents compatible with agent skills and MCP Server configurationWhat you can do with your agentIAM permissionsRelated resources

Agent setup guide

The Agent Toolkit for AWS on GitHub provides the aws-core plugin and its bundled aws-cloudformation skill. The skill helps AI coding agents author and validate CloudFormation templates, troubleshoot deployments, and generate AWS CDK code. The plugin also configures the AWS MCP Server for documentation search and AWS API access.

Work with your coding agent

For a quick-start reference, you can drop this link directly into your agent's context:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/agent-setup-guide.md

Choose the installation method that matches your development environment.

Prerequisites

Ensure the following prerequisites are in place:

  • uv installed on your system.

  • Node.js (v18+) installed on your system (required for skills installation).

  • (Optional) An AWS account with IAM credentials set up on your local machine. Credentials are required for tools that execute AWS API calls (template validation, deployment troubleshooting), but not for documentation search. If you do not have credentials configured, see Configuring the AWS CLI for detailed instructions.

What gets installed

Component What it provides
aws-cloudformation skill Template authoring with secure defaults, 3-layer validation pipeline (cfn-lint, cfn-guard, change sets), and root-cause diagnosis of failed stacks using CloudFormation events and CloudTrail correlation.
AWS IaC MCP Server Documentation search (CloudFormation and CDK), template validation, compliance checks, deployment troubleshooting, and CDK best practices -- all running locally on your machine.

Claude Code

Install the aws-core plugin

Run the following command to install the plugin from the official Claude Code marketplace:

/plugin install aws-core@claude-plugins-official

This installs the aws-cloudformation skill, other core AWS skills, agent hooks, and the AWS MCP Server configuration in one step.

Install AWS IaC MCP Server

Replace AWS_PROFILE with your local AWS profile name.

claude mcp add awslabs-aws-iac-mcp \
  -e AWS_PROFILE=default \
  -e AWS_REGION=us-east-1 \
  -e FASTMCP_LOG_LEVEL=ERROR \
  --scope user \
  -- uvx awslabs.aws-iac-mcp-server@latest

Codex

Install CloudFormation skill

npx skills add aws/agent-toolkit-for-aws/skills --skill aws-cloudformation --yes --global

Install AWS IaC MCP Server

Replace AWS_PROFILE with your local AWS profile name.

codex mcp add awslabs-aws-iac-mcp \
  --env AWS_PROFILE=default \
  --env AWS_REGION=us-east-1 \
  --env FASTMCP_LOG_LEVEL=ERROR \
  -- uvx awslabs.aws-iac-mcp-server@latest

Cursor

Install CloudFormation skill

npx skills add aws/agent-toolkit-for-aws/skills --skill aws-cloudformation --yes --global

Install AWS IaC MCP Server

Add the following to .cursor/mcp.json under "mcpServers". Replace AWS_PROFILE with your local AWS profile name.

"awslabs.aws-iac-mcp": {
  "command": "uvx",
  "args": ["awslabs.aws-iac-mcp-server@latest"],
  "env": {
    "AWS_PROFILE": "default",
    "AWS_REGION": "us-east-1",
    "FASTMCP_LOG_LEVEL": "ERROR"
  }
}

Kiro

Install CloudFormation skill in Kiro CLI

npx skills add aws/agent-toolkit-for-aws/skills --skill aws-cloudformation --yes --global

Install AWS IaC MCP Server

Add the following to ~/.kiro/settings/mcp.json under "mcpServers". Replace AWS_PROFILE with your local AWS profile name.

"awslabs.aws-iac-mcp": {
  "command": "uvx",
  "args": ["awslabs.aws-iac-mcp-server@latest"],
  "env": {
    "AWS_PROFILE": "default",
    "AWS_REGION": "us-east-1",
    "FASTMCP_LOG_LEVEL": "ERROR"
  },
  "disabled": false
}

Install Kiro powers (from Kiro IDE)

Install the following Kiro power that provides specialized CloudFormation context and tools to Kiro agents on-demand:

GitHub Copilot

Install CloudFormation skill

npx skills add aws/agent-toolkit-for-aws/skills --skill aws-cloudformation --yes --global

Install AWS IaC MCP Server

Add the following to .vscode/mcp.json under "mcpServers". Replace AWS_PROFILE with your local AWS profile name.

"awslabs.aws-iac-mcp": {
  "command": "uvx",
  "args": ["awslabs.aws-iac-mcp-server@latest"],
  "env": {
    "AWS_PROFILE": "default",
    "AWS_REGION": "us-east-1",
    "FASTMCP_LOG_LEVEL": "ERROR"
  }
}

Windsurf

Install CloudFormation skill

npx skills add aws/agent-toolkit-for-aws/skills --skill aws-cloudformation --yes --global

Install AWS IaC MCP Server

Add the following to /.codeium/windsurf/mcp_config.json under "mcpServers". Replace AWS_PROFILE with your local AWS profile name.

"awslabs.aws-iac-mcp": {
  "command": "uvx",
  "args": ["awslabs.aws-iac-mcp-server@latest"],
  "env": {
    "AWS_PROFILE": "default",
    "AWS_REGION": "us-east-1",
    "FASTMCP_LOG_LEVEL": "ERROR"
  }
}

OpenCode

Install CloudFormation skill

npx skills add aws/agent-toolkit-for-aws/skills --skill aws-cloudformation --yes --global

Install AWS IaC MCP Server

Add the following to /.config/opencode/opencode.jsonc under "mcpServers". Replace AWS_PROFILE with your local AWS profile name.

"awslabs.aws-iac-mcp": {
  "command": "uvx",
  "args": ["awslabs.aws-iac-mcp-server@latest"],
  "env": {
    "AWS_PROFILE": "default",
    "AWS_REGION": "us-east-1",
    "FASTMCP_LOG_LEVEL": "ERROR"
  }
}

For all other agents compatible with agent skills and MCP Server configuration

For any other agent that supports the open-source agent skills format and MCP Server configuration, follow these steps:

Install CloudFormation skill

npx skills add aws/agent-toolkit-for-aws/skills --skill aws-cloudformation --yes --global

Install AWS IaC MCP Server

Add the AWS IaC MCP Server to your agent's MCP client configuration file under "mcpServers". Replace AWS_PROFILE with your local AWS profile name.

"awslabs.aws-iac-mcp": {
  "command": "uvx",
  "args": ["awslabs.aws-iac-mcp-server@latest"],
  "env": {
    "AWS_PROFILE": "default",
    "AWS_REGION": "us-east-1",
    "FASTMCP_LOG_LEVEL": "ERROR"
  }
}

What you can do with your agent

Once configured, your agent can help you with:

Task Example prompt
Author a template "Create a CloudFormation template for a VPC with public and private subnets"
Validate before deploying "Validate my template at ./template.yaml and check for security issues"
Troubleshoot a failure "My stack 'my-app' in us-east-1 failed to deploy. What happened?"
Search documentation "What properties does AWS::ECS::Service support?"
CDK guidance "Show me CDK best practices for Lambda functions"
Compliance checks "Check if my template complies with security best practices"

IAM permissions

The MCP server requires the following AWS permissions for full functionality:

For template validation and compliance: No AWS permissions required (local validation only).

For deployment troubleshooting:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResources",
        "cloudtrail:LookupEvents"
      ],
      "Resource": "*"
    }
  ]
}