A
MCP server · Infrastructure
Govern the AWS MCP server.
The AWS MCP server can reach your cloud. Allow describe/read, deny resource creation and IAM, and tag production as off-limits.
Per-tool policy
An MCP server is a bag of tools. Enable them one at a time.
Connect AWS once; HiveKey gates each tool per role. Read-only by default, writes on purpose, destructive ops denied.
mcp / aws governed
describe_resources allow
read_logs allow
create_resource deny
modify_iam deny
Read-only and staging only; deny creates, IAM, and anything tagged production.
In the path
HiveKey sits between the agent and AWS.
Agent
wants a tool call
HiveKey
scope · guard · log
AWS MCP
only allowed tools
Put the AWS MCP server under one policy.
Connect AWS, gate each tool per role, and log every call — across your whole agent fleet.