Amazon CloudWatch MCP Server

Amazon Web Services's Amazon CloudWatch MCP server enables AI agents to query operational metrics, inspect log groups, analyze alarms, and run Logs Insights queries. It allows agents to diagnose application health issues, perform root-cause analysis on metric anomalies, and recommend alarm configurations.

Start for free

Benefits with Ory + Amazon CloudWatch MCP Server

Amazon Web Services' Amazon CloudWatch MCP server lets your agents query metrics, search logs with CloudWatch Logs Insights, and review alarms and their history during an investigation. Logs often contain customer identifiers, request payloads, and other sensitive details. Ory Agent Security lets incident responders investigate while agents without a reason to see production logs are denied, and every tool call is tied to the user behind it.

View documentation

Use Cases

— 01 use case

Agent IAM

Incident agents need Read for alarms, logs and metrics, Write only cancels queries, Admin adds nothing, and Block suits agents that write app code.

Explore Agent IAM

Core Functionality

— 04 capabilities

Read, write, admin, or no access
Ory Agent Security classifies every tool on the Amazon CloudWatch MCP server as read, write, or admin, and because the Amazon CloudWatch MCP server is built for investigation, the choice for each user, team, or agent type comes down to read for incident agents or no access for agents with no reason to see production logs.
Enforced before execution
Ory Agent Security checks each tool call against the user, the agent acting for them, and any sub-agent inside the agent harness, so a denied log query stops before it reaches your logs, with nothing to roll back and no gateway to deploy.
Observe, then enforce
Observe mode shows which agents read production logs and on whose behalf without blocking anything, so you can apply Ory's pre-built policy for the Amazon CloudWatch MCP server and enforce it on your own schedule.
Complete audit trail
Every allow and deny decision on the Amazon CloudWatch MCP server streams to your SIEM through OpenTelemetry with the user, agent, and action attached, so you can show who queried logs containing customer data, through which agent.