mcp/aws-dataprocessing-mcp-server repository overview

⁠AWS Data Processing MCP Server

Data processing and transformation services.

What is an MCP Server?⁠

⁠MCP Info

⁠Image Building Info

Attribute	Details
Dockerfile	https://github.com/awslabs/mcp/blob/76ec6993aec4c6281e5250cbeba8db6a5863f2ff/src/aws-dataprocessing-mcp-server/Dockerfile⁠
Docker Image built by	Docker Inc.
Docker Scout Health Score
Verify Signature	COSIGN_REPOSITORY=mcp/signatures cosign verify mcp/aws-dataprocessing-mcp-server --key https://raw.githubusercontent.com/docker/keyring/refs/heads/main/public/mcp/latest.pub
Licence	Apache License 2.0

⁠Available Tools (32)

⁠Tools Details

⁠Tool: add_inline_policy

Add a new inline policy to an IAM role.

This tool creates a new inline policy with the specified permissions and adds it to an IAM role. Inline policies are embedded within the role and cannot be attached to multiple roles. Commonly used for granting data processing services access to AWS resources, enabling Glue jobs to access data sources, and configuring permissions for CloudWatch logging and S3 access.

⁠Requirements

• The server must be run with the --allow-write flag
• The role must exist in your AWS account
• The policy name must be unique within the role
• You cannot modify existing policies with this tool

⁠Permission Format

The permissions parameter can be either a single policy statement or a list of statements.

⁠Single Statement Example

{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:PutObject"],
    "Resource": "arn:aws:s3:::example-bucket/*"
}

⁠Common Data Processing Permission Examples

⁠Glue Job Permissions

{
    "Effect": "Allow",
    "Action": [
        "glue:*",
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:ListBucket",
        "iam:PassRole"
    ],
    "Resource": "*"
}

⁠EMR Cluster Permissions

{
    "Effect": "Allow",
    "Action": [
        "elasticmapreduce:*",
        "ec2:DescribeInstances",
        "ec2:DescribeSecurityGroups",
        "s3:ListBucket",
        "s3:GetObject",
        "s3:PutObject"
    ],
    "Resource": "*"
}

⁠Athena Query Permissions

{
    "Effect": "Allow",
    "Action": [
        "athena:*",
        "glue:GetDatabase",
        "glue:GetTable",
        "glue:GetPartition",
        "s3:GetObject",
        "s3:ListBucket",
        "s3:PutObject"
    ],
    "Resource": "*"
}

⁠Usage Tips

• Follow the principle of least privilege by granting only necessary permissions
• Use specific resources rather than "*" whenever possible
• Consider using conditions to further restrict permissions
• Group related permissions into logical policies with descriptive names Parameters|Type|Description -|-|- permissions|string|Permissions to include in the policy as IAM policy statements in JSON format. Can be either a single statement object or an array of statement objects. policy_name|string|Name of the inline policy to create. Must be unique within the role. role_name|string|Name of the IAM role to add the policy to. The role must exist.

⁠Tool: analyze_s3_usage_for_data_processing

Analyze S3 bucket usage patterns for data processing services (Glue, EMR, Athena).

This tool helps identify which buckets are actively used by data processing services and which ones might be idle or underutilized.

⁠Tool: create_data_processing_role

Create a new IAM role for data processing services.

This tool creates a new IAM role with the appropriate trust relationship for the specified data processing service (Glue, EMR, or Athena). It can also attach managed policies and add an inline policy to the role.

⁠Requirements

• The server must be run with the --allow-write flag
• The role name must be unique within your AWS account
• Valid AWS credentials with permissions to create IAM roles

⁠Service Types

• glue: Creates a role that can be assumed by the Glue service
• emr: Creates a role that can be assumed by the EMR service
• athena: Creates a role that can be assumed by the Athena service

⁠Common Managed Policies. add these policies

• Glue: 'arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole'
• EMR: 'arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole'
• Athena: 'arn:aws:iam::aws:policy/service-role/AmazonAthenaFullAccess'

⁠Usage Tips

• Always provide a descriptive name and description for the role
• Attach only the necessary managed policies to follow least privilege
• Use inline policies for custom permissions specific to your use case
• Consider adding S3 access permissions for data sources and targets Parameters|Type|Description -|-|- role_name|string|Name of the IAM role to create. Must be unique within your AWS account. service_type|string|Type of data processing service: 'glue', 'emr', or 'athena'. description|string optional|Optional description for the IAM role. inline_policy|string optional|Optional inline policy to add to the role. managed_policy_arns|string optional|Optional list of managed policy ARNs to attach to the role.

⁠Tool: get_policies_for_role

Get all policies attached to an IAM role.

This tool retrieves all policies associated with an IAM role, providing a comprehensive view of the role's permissions and trust relationships. It helps you understand the current permissions, identify missing or excessive permissions, troubleshoot data processing issues, and verify trust relationships for service roles.

⁠Requirements

• The role must exist in your AWS account
• Valid AWS credentials with permissions to read IAM role information

⁠Response Information

The response includes role ARN, assume role policy document (trust relationships), role description, managed policies with their documents, and inline policies with their documents.

⁠Usage Tips

• Use this tool before adding new permissions to understand existing access
• Check the assume role policy to verify which services or roles can assume this role
• Look for overly permissive policies that might pose security risks
• Use with add_inline_policy to implement least-privilege permissions
• For Glue jobs, ensure the role has access to required data sources and targets
• For EMR clusters, verify EC2 instance profile permissions
• For Athena queries, check S3 bucket access permissions Parameters|Type|Description -|-|- role_name|string|Name of the IAM role to get policies for. The role must exist in your AWS account.

⁠Tool: get_roles_for_service

Get all IAM roles that can be assumed by a specific AWS service.

This tool retrieves all IAM roles in your AWS account that have a trust relationship with the specified service. It helps you identify which roles can be used for services like Glue jobs, EMR clusters, or Athena queries, making it easier to select the appropriate role when creating these resources.

⁠Service Types

Common service types include:

• glue: AWS Glue service (glue.amazonaws.com)
• emr: Amazon EMR service (elasticmapreduce.amazonaws.com)
• athena: Amazon Athena service (athena.amazonaws.com)
• You can also specify other AWS service principals

⁠Response Information

The response includes a list of roles that can be assumed by the specified service, with details such as role name, ARN, description, creation date, and the full assume role policy document.

⁠Usage Tips

• Use this tool to find existing roles before creating new ones
• Verify that roles have the necessary permissions for your use case
• For Glue jobs, look for roles with AWSGlueServiceRole or similar policies
• For EMR clusters, look for roles with AmazonElasticMapReduceRole or similar policies
• For Athena queries, look for roles with AmazonAthenaFullAccess or similar policies Parameters|Type|Description -|-|- service_type|string|Type of data processing service: 'glue', 'emr', 'athena', or other AWS service name.

⁠Tool: list_s3_buckets

List S3 buckets that have 'glue' in their name and are in the specified region.

This tool helps identify S3 buckets commonly used for data processing workflows, particularly those related to AWS Glue operations. It provides usage statistics and idle time information to help with resource management.

⁠Requirements

• Valid AWS credentials with permissions to list S3 buckets
• S3:ListAllMyBuckets permission

⁠Response Information

The response includes bucket name, creation date, region, object count, last modified date, and idle time analysis.

⁠Usage Tips

• Use this tool to find existing data processing buckets before creating new ones
• Monitor idle buckets that haven't been accessed for 90+ days
• Verify bucket regions match your data processing service regions
• Check object counts to understand bucket usage patterns Parameters|Type|Description -|-|- region|string optional|AWS region to filter buckets by (defaults to AWS_REGION environment variable)

⁠Tool: manage_aws_athena_data_catalogs

Manage AWS Athena data catalogs with both read and write operations.

This tool provides operations for managing Athena data catalogs, including creating, retrieving, listing, updating, and deleting data catalogs. Data catalogs are used to organize and access data sources in Athena, enabling you to query data across various sources like AWS Glue Data Catalog, Apache Hive metastores, or federated sources.

⁠Requirements

• The server must be run with the --allow-write flag for create-data-catalog, delete-data-catalog, and update-data-catalog operations
• Appropriate AWS permissions for Athena data catalog operations

⁠Operations

• create-data-catalog: Create a new data catalog
• delete-data-catalog: Delete an existing data catalog
• get-data-catalog: Get information about a single data catalog
• list-data-catalogs: List all data catalogs
• update-data-catalog: Update an existing data catalog

⁠Usage Tips

• Use list-data-catalogs to find available data catalogs
• Data catalogs can be of type LAMBDA, GLUE, HIVE, or FEDERATED
• Parameters are specific to the type of data catalog

⁠Example

# List all data catalogs
{'operation': 'list-data-catalogs', 'max_results': 10}

# Create a Glue data catalog
{
    'operation': 'create-data-catalog',
    'name': 'my-glue-catalog',
    'type': 'GLUE',
    'description': 'My Glue Data Catalog',
    'parameters': {'catalog-id': '123456789012'},
}

⁠Tool: manage_aws_athena_databases_and_tables

Manage AWS Athena databases and tables with read operations.

This tool provides operations for retrieving information about databases and tables in Athena data catalogs. These are read-only operations that do not modify any resources.

⁠Requirements

• Appropriate AWS permissions for Athena database and table operations

⁠Operations

• get-database: Get information about a single database
• get-table-metadata: Get metadata for a specific table
• list-databases: List all databases in a data catalog
• list-table-metadata: List metadata for all tables in a database

⁠Usage Tips

• Use list-databases to find available databases in a data catalog
• Use list-table-metadata to find available tables in a database
• The expression parameter for list-table-metadata supports filtering tables by name pattern

⁠Example

# List all databases in a catalog
{'operation': 'list-databases', 'catalog_name': 'AwsDataCatalog', 'max_results': 10}

# Get metadata for a specific table
{
    'operation': 'get-table-metadata',
    'catalog_name': 'AwsDataCatalog',
    'database_name': 'my_database',
    'table_name': 'my_table',
}

⁠Tool: manage_aws_athena_named_queries

Manage saved SQL queries in AWS Athena.

This tool provides operations for creating, retrieving, updating, and deleting named queries in AWS Athena. Named queries are saved SQL statements that can be easily reused, shared with team members, and executed without having to rewrite complex queries.

⁠Requirements

• The server must be run with the --allow-write flag for create-named-query, delete-named-query, and update-named-query operations
• Appropriate AWS permissions for Athena named query operations

⁠Operations

• batch-get-named-query: Get details for up to 50 named queries by their IDs
• create-named-query: Save a new SQL query with a name and description
• delete-named-query: Remove a saved query
• get-named-query: Retrieve a single named query by ID
• list-named-queries: List available named query IDs
• update-named-query: Modify an existing named query

⁠Example

# Create a named query
create_response = await manage_aws_athena_named_queries(
    operation='create-named-query',
    name='Daily Active Users',
    description='Query to calculate daily active users',
    database='analytics',
    query_string='SELECT date, COUNT(DISTINCT user_id) AS active_users FROM user_events GROUP BY date ORDER BY date DESC',
    work_group='primary',
)

# Later, retrieve the named query
query = await manage_aws_athena_named_queries(
    operation='get-named-query', named_query_id=create_response.named_query_id
)

⁠Tool: manage_aws_athena_query_executions

Execute and manage AWS Athena SQL queries.

This tool provides comprehensive operations for AWS Athena query management, including starting new queries, monitoring execution status, retrieving results, and analyzing performance statistics.

⁠Requirements

• The server must be run with the --allow-write flag if start-query-execution contains any write operation for example DDL commands, Insert, Update, Delete Commands or any flag updates
• Appropriate AWS permissions for Athena query operations

⁠Operations

• batch-get-query-execution: Get details for up to 50 query executions by their IDs
• get-query-execution: Get complete information about a single query execution
• get-query-results: Retrieve the results of a completed query
• get-query-runtime-statistics: Get performance statistics for a query execution
• list-query-executions: List available query execution IDs (up to 50)
• start-query-execution: Execute a new SQL query
• stop-query-execution: Cancel a running query

⁠Example

# Start a new query
response = await manage_aws_athena_queries(
    operation='start-query-execution',
    query_string='SELECT * FROM my_database.my_table LIMIT 10',
    query_execution_context={'Database': 'my_database', 'Catalog': 'my_catalog'},
    work_group='primary',
)

# Get the query results
results = await manage_aws_athena_queries(
    operation='get-query-results', query_execution_id=response.query_execution_id
)

⁠Tool: manage_aws_athena_workgroups

Manage AWS Athena workgroups with both read and write operations.

This tool provides operations for managing Athena workgroups, including creating, retrieving, listing, updating, and deleting workgroups. Workgroups allow you to isolate queries for different user groups and control query execution settings.

⁠Requirements

• The server must be run with the `--allow-write

[...]