MCP Server Terraform vs MCP Server Aws Sso

aws_sso_login

Initiate AWS SSO device authorization flow to obtain temporary credentials. This flow works as follows: 1. Generates a unique user verification code and authentication URL 2. Opens a browser to AWS SSO login page (if `launchBrowser: true`) 3. You enter the verification code and complete AWS SSO login 4. Background polling automatically collects and caches the token 5. The cached token is used by other AWS SSO tools **IMPORTANT FOR AI ASSISTANTS**: When the tool returns authentication instructions: - ALWAYS check if a browser window opened automatically - If browser opened: Guide the user to complete authentication - If no browser opened: Instruct user to manually open the URL and enter code - Always provide both the verification code and URL as backup Prerequisites: - AWS SSO must be configured with a start URL and region - Browser access is required for authentication - You must have an AWS SSO account with appropriate permissions Returns: Authentication status, session details, verification code and URL

aws_sso_status

Check current AWS SSO authentication status. Verifies if a valid cached token exists and its expiration time. Does NOT perform authentication - only checks status. If no valid token exists, instructs you to run `aws_sso_login`. Use before calling `aws_sso_ls_accounts` or `aws_sso_exec_command`. Returns: Authentication status, session details, expiration time, next steps

aws_sso_ls_accounts

List all AWS accounts and roles accessible through AWS SSO. Provides essential information needed for `aws_sso_exec_command`: - Fetches all accessible accounts with IDs, names, and emails - Retrieves all available roles for each account - Handles pagination internally - Caches account and role information Prerequisites: - MUST first authenticate using `aws_sso_login` - AWS SSO must be configured with a start URL and region Returns: Account list with IDs, names, roles, and session status

aws_sso_exec_command

Execute AWS CLI command using temporary credentials from AWS SSO. Workflow: 1. Verifies valid AWS SSO authentication token 2. Obtains temporary credentials for account and role 3. Executes the AWS CLI command 4. Caches credentials for future use (1 hour) Prerequisites: - MUST first authenticate using `aws_sso_login` - AWS CLI MUST be installed on the system - AWS SSO must be configured Required: `accountId`, `roleName`, `command` Optional: `region` Returns: Execution context, command output, errors, exit code

aws_sso_ec2_exec_command

Execute shell command on EC2 instance via SSM using AWS SSO credentials. No SSH access or inbound ports required. Uses SSM's RunShellScript document. Prerequisites: - MUST first authenticate using `aws_sso_login` - EC2 instance MUST have SSM Agent installed - Instance needs IAM role with AmazonSSMManagedInstanceCore policy - Your role needs `ssm:SendCommand` and `ssm:GetCommandInvocation` permissions Required: `instanceId`, `accountId`, `roleName`, `command` Optional: `region` Returns: Execution context, command output, errors, troubleshooting guidance