Agentic Data Plane

AWS Managed MCP Servers

Give agents access to Amazon S3, Amazon Simple Notification Service (Amazon SNS), Amazon Simple Queue Service (Amazon SQS), and Amazon Bedrock through managed MCP servers. On an environment hosted on Amazon Web Services (AWS), AI Gateway can assume an AWS Identity and Access Management (IAM) role that you create, so you store no AWS credentials.

After reading this page, you will be able to:

  • Set up an IAM role that AI Gateway can assume with no stored AWS credentials

  • Configure an AWS managed MCP server to authenticate with that role

  • Troubleshoot a server whose role AI Gateway can’t assume

Prerequisites

To set up a server that stores no AWS credentials, you need:

What these MCP servers do

Each type works with one AWS resource that you name in its configuration, and its tools act on that resource:

Type Resource Tools

AWS S3

One S3 bucket and an optional key prefix that the server adds to keys in that bucket

list_objects, get_object, put_object, delete_object, head_object, copy_object, and generate_presigned_url

AWS SNS

One SNS topic

publish, which publishes a message to the topic

AWS SQS

One SQS queue

send, which sends a message to the queue

AWS Bedrock

One Amazon Bedrock embedding model

embed, which computes vector embeddings for text

The AWS Redshift type authenticates to AWS in the same way, and it has its own setup guide. See AWS Redshift Managed MCP Server.

Choose an authentication method

Each type’s Auth section sets the AWS region and how the server authenticates to AWS. It offers three methods:

Method How it works What Agentic Data Plane stores

Gateway Assume Role

AI Gateway uses its own AWS role to assume an IAM role that you create. It works only on an environment hosted on AWS.

No credentials. The configuration holds the Amazon Resource Name (ARN) of your role.

Assume Role

AI Gateway uses an IAM user’s access keys to assume an IAM role that you name.

The IAM user’s access key ID, secret access key, and an optional session token, in Secrets store.

Static Credentials

AI Gateway signs every request with an IAM user’s access keys.

The IAM user’s access key ID, secret access key, and an optional session token, in Secrets store.

On an environment hosted on AWS, use Gateway Assume Role when your security policy rules out long-lived credentials. An environment hosted on another cloud has no AWS identity for AI Gateway to use, so choose Assume Role or Static Credentials there.

For Static Credentials, store the IAM user’s access key ID and secret access key in Agentic Data Plane’s Secrets store with the AI Gateway scope, using UPPER_SNAKE_CASE names such as AWS_ACCESS_KEY_ID. Then select them in Access Key ID Secret Ref and Secret Access Key Secret Ref. The Assume Role method takes the same secrets under Source Credentials, plus the Role Arn of the role to assume, and an optional External ID and Session Name.

Gather the values the trust policy needs

A role’s trust policy decides who can assume the role. AI Gateway calls AWS Security Token Service (AWS STS) with its own role, and it sends an external ID made of your environment ID and the server’s name. With Gateway Assume Role, AI Gateway sets this external ID for each server, and you can’t change it in the server’s configuration. Other MCP servers send their own external IDs, so a trust policy that requires one server’s external ID doesn’t admit the others.

Collect these values before you create the role:

Value Where it comes from

Environment ID

The ID on the environment’s detail page in Redpanda Cloud.

AWS account ID

The AWS account that you deployed the environment into. With the AWS CLI signed in to that account, run aws sts get-caller-identity and read Account.

Server name

The name for the MCP server. Choose it now. The external ID contains it, and you can’t rename a server after you create it.

AI Gateway’s role ARN

Built from the AWS account ID and the environment ID: arn:aws:iam::<aws-account-id>:role/aigw-<environment-id>

External ID

Built from the environment ID and the server name: <environment-id>/<server-name>

For example, take the environment d0example1cluster234 in the AWS account 123456789012, and a server named orders-queue. AI Gateway’s role ARN is arn:aws:iam::123456789012:role/aigw-d0example1cluster234, and the external ID is d0example1cluster234/orders-queue.

Grant the permissions the tools need

Write a permissions policy that grants the actions your server’s tools need, and save it as permissions-policy.json. The role’s permissions policy decides what the server can do in AWS, so grant only the actions for the tools your agents use, on the resource that the server works with:

Type Tool IAM actions Resource

AWS S3

list_objects

s3:ListBucket

The bucket, for example arn:aws:s3:::example-reports

AWS S3

get_object and head_object

s3:GetObject, plus s3:GetObjectVersion to read a specific version

The objects, for example arn:aws:s3:::example-reports/*

AWS S3

put_object

s3:PutObject, plus s3:GetObject to write with if_match

The objects

AWS S3

delete_object

s3:DeleteObject, plus s3:DeleteObjectVersion to delete a specific version

The objects

AWS S3

copy_object

s3:GetObject and s3:GetObjectAnnotation on the source object, and s3:PutObject and s3:PutObjectAnnotation on the copy, plus s3:PutObjectTagging to copy an object that has tags

The source object and the objects in the server’s bucket

AWS S3

generate_presigned_url

s3:GetObject for a download URL, or s3:PutObject for an upload URL

The objects

AWS SNS

publish

sns:Publish

The topic, for example arn:aws:sns:us-east-1:123456789012:orders

AWS SQS

send

sqs:SendMessage

The queue, for example arn:aws:sqs:us-east-1:123456789012:orders

AWS Bedrock

embed

bedrock:InvokeModel

The model, for example arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0

For example, this permissions policy lets a server send messages to one queue:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sqs:SendMessage",
      "Resource": "arn:aws:sqs:us-east-1:123456789012:orders"
    }
  ]
}

For AWS S3, keep these points in mind:

  • If you set a Prefix on the server, you can limit the object resources to it, for example arn:aws:s3:::example-reports/data/uploads/*.

  • The copy_object tool can read its source object from another bucket. The role’s permissions policy decides which source objects it can read.

  • A URL from generate_presigned_url uses the role’s permissions and stops working when the session that signed it expires, even if the tool reports a later expires_at time. By default, the tool sets a URL to expire after one hour (3600 seconds), but a session lasts only 900 seconds unless you set Duration Seconds.

  • Without s3:ListBucket, S3 answers a request for a missing object with an access-denied error instead of a not-found error.

If a customer managed key from AWS Key Management Service (AWS KMS) encrypts the bucket, topic, or queue, also grant the role these permissions on the key:

  • S3 bucket: kms:GenerateDataKey to write objects, and kms:Decrypt to read them

  • SNS topic: kms:GenerateDataKey* and kms:Decrypt

  • SQS queue: kms:GenerateDataKey and kms:Decrypt

The key’s policy must let IAM policies grant these permissions. The default key policy already does this in the key’s own account. If the key is in another AWS account, its key policy must also allow the role or the role’s account.

Create the IAM role

Create the role with the AWS CLI. The role must be under the /redpanda-adp/ path, and the AWS Management Console can’t set a role’s path.

This configuration refers to a third-party product. Specific UI elements may not be up to date. For current syntax, see the AWS documentation for aws iam create-role and aws iam put-role-policy.

  1. Save this trust policy as trust-policy.json, with your values in place of the placeholders:

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<aws-account-id>:role/aigw-<environment-id>"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<environment-id>/<server-name>"
        }
      }
    }
  ]
}

    The principal is AI Gateway’s role, not your whole account. To learn why, see Limits.

  2. Create the role under the /redpanda-adp/ path:

    aws iam create-role \
  --role-name <role-name> \
  --path /redpanda-adp/ \
  --assume-role-policy-document file://trust-policy.json

    Replace <role-name> with a name for the role, for example orders-queue-sender. The role’s ARN is arn:aws:iam::<aws-account-id>:role/redpanda-adp/<role-name>. You enter it when you create the server.

  3. Add the permissions policy that you saved as permissions-policy.json to the role as an inline policy:

    aws iam put-role-policy \
  --role-name <role-name> \
  --policy-name <policy-name> \
  --policy-document file://permissions-policy.json

    Replace <policy-name> with a name for the policy, for example orders-queue-send.

Create the server

Create the server in the Agentic Data Plane UI:

  1. Open MCP servers in the sidebar.

  2. Click Add MCP server.

  3. Click the card for the type: AWS S3, AWS SNS, AWS SQS, or AWS Bedrock.

  4. Replace the suggested Name with the server name from the external ID, and optionally add a Description.

  5. Fill in the type’s own fields:

    Type Field Value

    AWS S3

    Bucket, and optionally Prefix

    The bucket’s name, for example example-reports, and a key prefix such as data/uploads/

    AWS SNS

    Topic Arn

    The topic’s ARN, for example arn:aws:sns:us-east-1:123456789012:orders

    AWS SQS

    URL

    The queue’s URL, for example https://sqs.us-east-1.amazonaws.com/123456789012/orders

    AWS Bedrock

    Model

    The embedding model’s ID, for example amazon.titan-embed-text-v2:0

  6. If the form shows an AWS section for AWS SNS, AWS SQS, or AWS Bedrock, leave it empty. It’s a deprecated copy of Auth.

  7. In the Auth section:

    1. Set Region to the AWS region of the resource, for example us-east-1.

    2. Leave Endpoint empty.

    3. In the Auth selector, choose Gateway Assume Role.

    4. Set Role Arn to the ARN of the role you created, for example arn:aws:iam::123456789012:role/redpanda-adp/orders-queue-sender.

    5. Optional: Set Duration Seconds, the length of each AWS session. Keep 0 for the default of 900 seconds, or choose a value from 900 to 3600.

  8. Click Create server.

The create form turns Enable code mode on by default for AWS Bedrock and leaves it off for the other AWS types. The rpk ai mcp-server create command has no code-mode flag. To add code mode from the CLI, create a Code MCP server named <server-name>-code with --code.mcp-servers <server-name>. See Code Mode.

Create the server with rpk ai

Run rpk ai mcp-server create with the type’s --managed.config payload. This example creates the orders-queue server for AWS SQS:

rpk ai mcp-server create orders-queue --enabled --managed.config '{
  "@type": "type.googleapis.com/redpanda.mcps.aws_sqs.v1.AWSSQSMCPConfig",
  "url": "https://sqs.us-east-1.amazonaws.com/123456789012/orders",
  "auth": {
    "region": "us-east-1",
    "gateway_assume_role": {
      "role_arn": "arn:aws:iam::123456789012:role/redpanda-adp/orders-queue-sender",
      "duration_seconds": 900
    }
  }
}'

The auth block is the same for every AWS type. For the other types, change @type and the type’s own fields:

@type Type’s own fields

type.googleapis.com/redpanda.mcps.aws_s3.v1.AWSS3MCPConfig

bucket, and optionally prefix

type.googleapis.com/redpanda.mcps.aws_sns.v1.AWSSNSMCPConfig

topic_arn

type.googleapis.com/redpanda.mcps.aws_bedrock.v1.AWSBedrockMCPConfig

model

Verify the connection

Creating the server succeeds even if AI Gateway can’t assume the role, so check the connection before an agent uses the server:

  1. Open the server’s Inspector tab.

  2. Confirm that the tool list loads. If AI Gateway can’t assume the role, the tab shows the error instead. See Troubleshooting.

  3. Optional: To check the permissions policy too, run one of the server’s tools from the Inspector tab, such as list_objects for AWS S3 or embed for AWS Bedrock. See Run a tool. A tool that the policy doesn’t allow fails with an AWS authorization error.

Limits

Keep these limits in mind when you use Gateway Assume Role:

  • Server name reuse. The external ID combines the environment ID and the server name. If you delete a server and create another with the same name, the new server sends the same external ID and can assume the same role.

  • Other AI Gateway features. A trust policy that names AI Gateway’s role admits every AI Gateway feature that assumes IAM roles, not only MCP servers. Grant permission to create and modify large language model (LLM) providers (dataplane_adp_llmprovider_create and dataplane_adp_llmprovider_update) and guardrails (dataplane_adp_guardrail_create and dataplane_adp_guardrail_update) only to users you trust with every role whose trust policy names AI Gateway’s role. See LLM provider permissions and Guardrail permissions.

  • Role account. AI Gateway can assume a role in the AWS account that you deployed the environment into when the role’s trust policy names AI Gateway’s role ARN, as in the example on this page. For a role in another AWS account, or a role whose trust policy names a whole account as the principal, AI Gateway’s own role also needs permission to assume it. AI Gateway’s role doesn’t have that permission by default.

  • Resources in other accounts. To reach an S3 bucket, SNS topic, or SQS queue in another account, keep the role in the environment’s account, not the resource’s. Then allow the role in both the resource’s own policy and the role’s permissions policy.

  • Role path. AI Gateway accepts only roles under /redpanda-adp/. It checks the role ARN when you save the server and again before it calls AWS STS.

  • Session length. A session lasts from 900 to 3600 seconds. AI Gateway gets each session by using its own role to assume yours, and AWS limits a session obtained that way to one hour. AI Gateway requests a new session when the current one expires.

  • Audit trail. The role session name is mcp-<server-name>, truncated to 64 characters. AWS CloudTrail logs show it in the ARN of the identity that made each call.

Troubleshooting

Common symptoms and fixes:

Symptom What to check

Saving the server fails with Role ARN must name a role under the /redpanda-adp/ path, for example arn:aws:iam::123456789012:role/redpanda-adp/MyRole.

The role isn’t under the /redpanda-adp/ path. Create a role with --path /redpanda-adp/, and use its ARN.

Saving the server fails with Session duration must be 0, for the default of 900 seconds, or at least 900 seconds.

Set Duration Seconds to 0, or to a value from 900 to 3600.

The Inspector tab shows an error containing with External ID and AWS answered AccessDenied

AWS refused to let AI Gateway assume the role. The message shows the role ARN and the external ID that AI Gateway sent. Check that the trust policy’s principal is AI Gateway’s role ARN, and that its sts:ExternalId condition matches that external ID exactly. If the role is in another AWS account, or its trust policy names a whole account, see Limits.

The Inspector tab shows this gateway has no AWS identity of its own, which is expected on clusters that do not run on AWS

Your environment isn’t hosted on AWS. Use Assume Role or Static Credentials instead.

The Inspector tab shows an error ending in This can be temporary; the gateway tries again on the next request

The call to AWS STS failed with an error other than access denied, or AI Gateway couldn’t refresh its own AWS credentials. If the message includes the error AWS returned, fix what it names. Otherwise, open the Inspector tab again after a few minutes. If the error persists, contact Redpanda Support.

Running rpk ai mcp-server create or rpk ai mcp-server update fails with invalid protojson for google.protobuf.Any, followed by unknown field "gateway_assume_role"

Your rpk ai plugin predates this authentication method. Run rpk ai upgrade to update it.

A tool call fails with an AWS authorization error, such as AccessDenied or, for Amazon SNS, AuthorizationError

The role’s permissions policy doesn’t allow the action that the tool needs. The resource’s own policy or its KMS key policy can also deny it. See Grant the permissions the tools need.

Next steps