Lza Mcp Server

Landing Zone Accelerator on AWS (LZA) MCP Server

[](LICENSE.txt) [](CODEOFCONDUCT.md)

A Model Context Protocol (MCP) server that enables AI-assisted management of Landing Zone Accelerator on AWS (LZA) deployments through compatible development tools and IDEs.

Documentation: [Contributing](CONTRIBUTING.md) | [Code of Conduct](CODEOFCONDUCT.md) | [Security](SECURITY.md) | [Changelog](CHANGELOG.md) | [License](LICENSE.txt)

Table of Contents

• [Overview](#overview)
• [Privacy Notice](#privacy-notice)
• [Quick Start](#quick-start)
• [Build Process](#build-process)
• [AWS Permissions](#aws-permissions)
• [MCP Client Configuration](#mcp-client-configuration)
• [Kiro IDE: Configuration Validation Hook](#kiro-ide-configuration-validation-hook)
• [Available Tools](#available-tools)
• [Schema Management](#schema-management)
• [Universal Configuration](#universal-configuration)
• [Configuration Operations](#configuration-operations)
• [Pipeline Management](#pipeline-management)
• [Manual Approval (Optional)](#manual-approval-optional)
• [Advanced Topics](#advanced-topics)
• [Troubleshooting](#troubleshooting)

Overview

The LZA MCP Server streamlines Landing Zone Accelerator on AWS operations by providing AI-powered assistance for configuration management, pipeline orchestration, and schema discovery. Organizations can reduce operational complexity and accelerate deployment cycles while maintaining security and compliance standards. The server includes specialized tools for merging LZA Universal Configuration templates, enabling rapid deployment of enterprise-ready, compliance-focused baseline environments.

Key Benefits:

• Accelerated Operations: AI-assisted configuration reduces manual effort and deployment time
• Enhanced Accuracy: Schema validation and intelligent search helping prevent configuration errors while providing a reliable tools to discover LZA capabilities
• Operational Visibility: Real-time pipeline monitoring with automated diagnostics
• Security by Design: Comprehensive input validation and least-privilege IAM policies
• Universal Configuration Integration: Streamlined merging of enterprise-ready compliance templates

Architecture: The server operates as a containerized MCP endpoint, invoked by compatible IDEs (Kiro, Claude Desktop) via stdio transport. All AWS operations use temporary credentials following AWS security best practices.

[Back to top](#landing-zone-accelerator-on-aws-lza-mcp-server)

Privacy Notice

> ⚠️ Data Sharing with AI Providers > This MCP server executes AWS API calls using your credentials and shares the response data with your third-party AI model provider (e.g., Kiro CLI, Claude Desktop, Cursor, VS Code, Kiro IDE). Users are responsible for understanding your AI provider's data handling practices and ensuring compliance with your organization's security and privacy requirements when using this tool with AWS resources.

[Back to top](#landing-zone-accelerator-on-aws-lza-mcp-server)

Quick Start

Prerequisites

• Container Runtime: Docker or Finch (the build process auto-detects which is available)
• AWS credentials with [required IAM permissions](#aws-permissions)
• MCP-compatible IDE (Kiro IDE, Claude Desktop)
• Existing LZA deployment (for pipeline and configuration operations)

> 📋 Supported LZA Deployments > This MCP server supports LZA deployments using S3-based or CodeCommit-based configuration storage. The default LZA deployment stores configuration files in an S3 bucket (aws-accelerator-config-*). When your pipeline uses CodeCommit as its source, getLzaConfiguration and putLzaConfiguration automatically detect this and use the CodeCommit API instead of S3 — no extra configuration required. You can also explicitly target a CodeCommit repository by passing repository_name (and optionally branch) to either tool.

1. Build Container Image

The build process automatically detects whether Docker or Finch is installed and uses the available runtime:

cd src/lza-mcp-server
make build

Using a specific runtime:

# Force Docker
make build CONTAINER_RUNTIME=docker

# Force Finch
make build CONTAINER_RUNTIME=finch

This generates a container image with embedded LZA schemas for versions v1.12.0 and later (mutable).

What if neither is installed?

The build will fail with a helpful error message directing you to installation resources:

• Docker: https://docs.docker.com/get-docker/
• Finch: https://github.com/runfinch/finch

2. Configure AWS Permissions

Create an IAM role or user with the [recommended IAM policy](#aws-permissions). The policy follows least-privilege principles and supports standard LZA deployments.

> ⚠️ Security Recommendation > Use temporary credentials via AWS IAM Identity Center instead of long-term access keys. Temporary credentials reduce risk of credential exposure and align with AWS security best practices.

3. Configure AWS Credentials

The extract-aws-credentials.sh script handles credential extraction from your AWS CLI profile and passes them to the container. This script works with most AWS credential sources:

• Static credentials (access key/secret key)
• IAM Identity Center (SSO)
• IAM roles
• Credential process
• Temporary credentials

For IAM Identity Center users, login to your SSO session before starting the MCP server:

aws sso login --profile your-sso-profile

SSO sessions typically expire after 8-12 hours. If the MCP server reports authentication errors, re-run aws sso login to refresh your session.

The script uses aws configure export-credentials to retrieve temporary credentials from your active session and inject them into the container environment.

4. Configure MCP Client

Add the server configuration to your IDE's MCP settings file:

Kiro IDE: .kiro/settings/mcp.json (workspace) or ~/.kiro/settings/mcp.json (global) Claude Desktop: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)

{
  "mcpServers": {
    "awslabs.lza-mcp-server": {
      "command": "/scripts/extract-aws-credentials.sh",
      "args": [
        "docker", "run",
        "--security-opt=no-new-privileges:true",
        "--cap-drop=ALL",
        "--read-only",
        "--tmpfs", "/tmp:rw,noexec,nosuid,size=200m",
        "--rm", "-i",
        "-v", ":/app/lza-config:rw",
        "-e", "LZA_CONFIG_HOST_PATH=",
        "-e", "AWS_ACCESS_KEY_ID",
        "-e", "AWS_SECRET_ACCESS_KEY",
        "-e", "AWS_SESSION_TOKEN",
        "-e", "AWS_REGION",
        "lza-mcp-server:local"
      ],
      "env": {
        "AWS_PROFILE": "",
        "AWS_REGION": ""
      }
    }
  }
}

> Note: To use Finch instead of Docker, replace "docker" with "finch" in the args array.

Configuration Parameters:

• `: Full path to cloned repository (e.g., /Users/username/repos/lza-mcp-server`)
• `: Local directory for configuration files (e.g., /Users/username/Documents/lza-config`)
• Recommendation: Place within your IDE workspace for easier file access (e.g., .kiro/lza-config for Kiro IDE)
• `: AWS CLI profile name from ~/.aws/credentials or ~/.aws/config`
• `: AWS region where LZA is deployed (e.g., us-east-1`)

Optional Environment Variables:

You can customize the MCP server behavior by adding environment variables to the env section:

"env": {
  "AWS_PROFILE": "",
  "AWS_REGION": "",
  "LZA_PREFIX": "AWSAccelerator",
  "LOG_INSTRUCTIONS": "false",
  "DISABLE_LLM_GUIDANCE": "false"
}

• LZA_PREFIX: The prefix used by your LZA deployment for resource naming (default: AWSAccelerator)
• LZA uses this prefix to name resources like pipelines, CloudFormation stacks, and SSM parameters
• If you customized the prefix during LZA installation, set this to match your deployment
• Example: If your pipeline is named MyOrg-Pipeline, set LZA_PREFIX="MyOrg"
• This affects:
• Pipeline name: {LZA_PREFIX}-Pipeline
• SSM parameter: /accelerator/{LZA_PREFIX}-InstallerStack/version
• CloudFormation stacks: {LZA_PREFIX}-*
• LOG_INSTRUCTIONS: Enable logging of MCP server instructions at startup (default: false)
• Set to true, 1, or yes to enable instruction logging
• Useful for debugging or understanding what instructions are provided to the AI model
• Instructions are logged at INFO level and include all guidance provided to the model
• DISABLE_LLM_GUIDANCE: Disable LLM guidance in tool responses and server instructions (default: false)
• Set to true to strip guidance keys (llm_instructions, next_steps, hint, required_action, instructions_for_assistant, example, troubleshooting, usage_hint) from all tool responses
• Also disables the server-level instructions passed to FastMCP, returning an empty string
• Designed for deployments where an external entity owns workflow orchestration outside of the LZA MCP Server
• When disabled, tool responses contain only operational data (success, error, data, etc.)

>Note: The [credential extraction script](#3-configure-aws-credentials) requires your AWS CLI profile to be ready for use. Complete any profile-specific prerequisites before starting your LZA MCP server (e.g., aws sso login for IAM Identity Center profiles).

4. Verify Installation

Restart your IDE and test connectivity:

Use your tools, check my AWS connectivity

The server will verify credentials and report the authenticated identity.

[Back to top](#landing-zone-accelerator-on-aws-lza-mcp-server)

Build Process

Schema Generation

The container build includes automated schema processing that powers the schema search and discovery tools. This process runs once during make build and takes approximately 30-60 seconds.

What happens during build:

1. Fetch LZA Releases: Queries GitHub API for available LZA versions
2. Clone Source: Downloads LZA source code for each version
3. Extract Schemas: Copies JSON schemas from source/packages/@aws-accelerator/config/lib/schemas
4. Process Schemas: Resolves $ref references and generates search metadata
5. Embed in Image: Creates version-specific directories at /app/json-schemas/{version}/

Schema enhancements:

• Reference Resolution: All $ref pointers resolved for self-contained schemas
• Search Metadata: Pre-computed indexes for property names, types, patterns, and relationships
• Statistics: Property counts, nesting depth, and complexity metrics

This preprocessing enables sub-second schema searches without runtime analysis overhead.

Build Customization

Control which LZA versions and UC releases are included in the container:

# Default build (v1.12.0 to latest LZA, latest UC) - auto-detects runtime
make build

# Custom LZA version range using Makefile
make build LZA_MIN_VERSION=v1.10.0 LZA_MAX_VERSION=v1.14.0

# Direct build with specific runtime (replace 'docker' with 'finch' if needed)
docker build \
  --build-arg LZA_MIN_VERSION=v1.11.0 \
  --build-arg LZA_MAX_VERSION=v1.13.0 \
  --build-arg LZA_UC_RELEASE=v1.0.0 \
  -t lza-mcp-server:local .

> Note: The Makefile auto-detects Docker or Finch. For direct builds, replace docker with finch if using Finch.

Build Arguments:

| Argument | Default | Purpose | |----------|---------|---------| | LZA_MIN_VERSION | v1.12.0 | Earliest LZA version to include | | LZA_MAX_VERSION | latest | Latest LZA version to include | | LZA_UC_RELEASE | latest | Universal Configuration release version |

Note: Including more versions increases build time and image size proportionally. Most users only need schemas matching their deployed LZA version.

[Back to top](#landing-zone-accelerator-on-aws-lza-mcp-server)

AWS Permissions

The MCP server requires specific IAM permissions for LZA operations. This policy follows AWS least-privilege principles.

> 🔒 Privacy Consideration > AWS API responses retrieved using these permissions will be shared with your AI model provider. Review your organization's data classification policies before granting access to sensitive AWS resources.

Recommended IAM Policies

Choose the policy that matches your LZA deployment type. All policies follow AWS least-privilege principles.

| Deployment Type | Description | Policy | |----------------|-------------|--------| | Standard CodePipeline | Default LZA deployment in the management account using CodePipeline and CodeBuild. This is the most common setup. | [standard-codepipeline-policy.json](iam-policies/standard-codepipeline-policy.json) | | External Pipeline — CodePipeline | LZA deployed from a separate orchestration account using CodePipeline with an Accelerator Qualifier. Includes SSM Automation permissions for triggering deployments. | [external-codepipeline-policy.json](iam-policies/external-codepipeline-policy.json) | | External Pipeline — ECS Container | LZA deployed from a separate orchestration account using ECS Fargate tasks with an Accelerator Qualifier. Includes ECS task monitoring, CloudWatch Logs for ECS, and SSM Automation permissions. | [external-ecs-container-policy.json](iam-policies/external-ecs-container-policy.json) |

Policy Variables

Replace these placeholders with your deployment values:

All policies:

• ${HOME-REGION}: AWS region where LZA is deployed (e.g., us-east-1)
• ${PARTITION}: AWS partition (aws, aws-us-gov, or aws-cn)

Standard CodePipeline:

• ${MANAGEMENT_ACCOUNT}: AWS management account ID (12-digit number)
• ${ACCELERATOR_PREFIX}: LZA resource prefix (default: aws-accelerator)

External Pipeline (CodePipeline and ECS Container):

• ${ORCHESTRATION_ACCOUNT}: AWS orchestration account ID where the external pipeline runs (12-digit number)
• ${QUALIFIER}: Accelerator Qualifier set during LZA container/external deployment (e.g., my-lza)

Permission Scope

| Service | Purpose | Reference | |---------|---------|-----------| | STS | Identity verification for connectivity checks | AWS STS Documentation | | SSM | Retrieve deployed LZA version, discover deployment qualifiers, and scan version parameters from Parameter Store | AWS Systems Manager Parameters | | SSM Automation | Start and monitor LZA deployments via SSM Automation documents (external pipelines only) | SSM Automation | | S3 | Read/write LZA configuration files in config bucket (S3-backed deployments) | S3 Bucket Policies | | CodeCommit | Read and write LZA configuration files when the pipeline uses a CodeCommit source (GetFolder, GetBlob, GetBranch, CreateCommit); GetPipeline is used to auto-detect the source type | AWS CodeCommit | | KMS | Encrypt/decrypt configurations using LZA KMS key | AWS KMS Key Policies | | CodePipeline | Monitor and trigger LZA pipeline executions; list pipelines for deployment type detection (external pipelines); inspect source action to auto-detect CodeCommit repositories | [CodePipeline Monit

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: awslabs
• Source: awslabs/lza-mcp-server
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.