AWS Terraform

You run a containerized MCP server that enables Terraform on AWS to follow best practices, infrastructure as code patterns, and security checks with Checkov. This server exposes Terraform-related workflows and checks that you can access from your MCP clients to plan, validate, and apply infrastructure changes safely.

How to use

You connect to the AWS Terraform MCP Server from your MCP client to execute Terraform commands, run Terragrunt workflows, search AWS provider documentation, perform security scans, and analyze Terraform Registry modules. Use the standard docker-based configuration shown in the example snippets to start the MCP server locally, then configure your client to call the server through the provided command.

How to install

{
  "mcpServers": {
    "aws_terraform_mcp": {
      "name": "aws_terraform_mcp",
      "type": "stdio",
      "command": "docker",
      "args": ["run", "--rm", "--interactive", "--env", "FASTMCP_LOG_LEVEL=ERROR", "ghcr.io/stv-io/aws-terraform-mcp-server:latest"],
      "env": []
    }
  }
}

Prerequisites

For local usage you need a container runtime such as Docker. If you prefer alternative runtimes or direct server testing, ensure you have Python 3.10+ and uv installed for local development and testing workflows.

Security considerations

Follow a structured development workflow with integrated validation and security scanning. Review all Checkov warnings and fix issues when possible, and use the AWSCC provider for consistent API behavior and secure defaults. Conduct independent assessments before applying changes to production environments.

Development and testing

You can build and run the container locally, or test the published image from the container registry. Use the following patterns to validate behavior, both for local Docker usage and direct server testing.

# Run the latest image locally (Docker)
docker run --rm --interactive ghcr.io/stv-io/aws-terraform-mcp-server:latest

Notes on usage with MCP clients

Two example client configurations show how to integrate the MCP server with Windsurf IDE and Cursor IDE. They both run the MCP server via Docker and set a log level to reduce noise during operation.

Resources and concepts you can access

The server provides tools to execute Terraform and Terragrunt commands, search AWS provider documentation, search AWSCC provider documentation, access AWS-IA modules, run security scans with Checkov, and analyze Terraform Registry modules. You can use these capabilities to streamline your infrastructure workflows while maintaining security and compliance.

Examples of MCP client configurations (inline)

{
  "name": "AWS Terraform MCP Server",
  "command": "docker",
  "args": [
    "run", "--rm", "--interactive",
    "--env", "FASTMCP_LOG_LEVEL=ERROR",
    "ghcr.io/stv-io/aws-terraform-mcp-server:latest"
  ],
  "env": {},
  "disabled": false,
  "autoApprove": []
}

Versioning and licensing

This project uses semantic versioning with automated releases based on conventional commits. It is licensed under the Apache License 2.0.

Support

For issues and questions, use the issue tracker on the hosting platform. Look for dedicated MCP server support channels or discussions related to AWS Terraform MCP Server.

Available tools

ExecuteTerraformCommand

Run Terraform commands (init, plan, validate, apply, destroy) within the MCP server to manage infrastructure as code.

ExecuteTerragruntCommand

Execute Terragrunt workflows with advanced features to manage multi-account or multi-region configurations.

SearchAwsProviderDocs

Search and retrieve AWS provider documentation to assist resource configuration and usage.

SearchAwsccProviderDocs

Search AWSCC provider documentation for enhanced API coverage and guidance.

SearchSpecificAwsIaModules

Access AWS-IA GenAI modules such as Bedrock, OpenSearch, SageMaker, and Streamlit for guided module usage.

RunCheckovScan

Perform security and compliance scanning using Checkov to identify misconfigurations.

SearchUserProvidedModule

Analyze modules from the Terraform Registry provided by users.