aws:ViaAWSMCPService Is Not a Containment Boundary. Here Is What It Is

Service: AWS MCP Server (part of Agent Toolkit for AWS), GA May 6 2026. No charge for the server, you pay only for resources you touch.

Why it fits you specifically: your agent is Claude Code, which you already have on subscription. No Bedrock inference, no ANTHROPIC_API_KEY, no Agent SDK. The AI half of the demo is free. The AWS half is CloudTrail management events and IAM policy, also free. This is a near zero cost blog post.

The thesis: AWS shipped a provenance primitive in IAM. Two global condition keys, confirmed in the Agent Toolkit IAM docs:

• aws:ViaAWSMCPService (Boolean) is true for any request that passed through an AWS managed MCP server.
• aws:CalledViaAWSMCP (String) carries the service principal of the specific server: aws-mcp.amazonaws.com, eks-mcp.amazonaws.com, ecs-mcp.amazonaws.com.

So the same IAM role can be read-write when you use it and read-only when your agent uses it. Same credentials, different authorization, decided by who initiated the call. That is the demo, and it photographs well.