AWS's new IaC MCP server lets your AI assistant lint CloudFormation and correlate CloudTrail

I have spent enough Friday afternoons squinting at a stack event that says only CREATE_FAILED to be interested in anything that promises to shorten that loop. AWS has published a walkthrough of a new IaC MCP Server for CloudFormation, and it lines up with the shape of that pain more directly than any of the earlier AI-in-cloud efforts I have tried.

The gist

The Infrastructure as Code MCP Server plugs into an MCP-compatible AI assistant and exposes four tools the assistant can call while you are drafting or debugging CloudFormation:

• search_cloudformation_documentation, which pulls the current resource property reference and example snippets straight into the chat.
• validate_cloudformation_template, a syntax pass with cfn-lint before you go anywhere near the console.
• check_cloudformation_template_compliance, policy checks with cfn-guard so the assistant cannot cheerfully hand you a bucket that is public by default.
• troubleshoot_cloudformation_deployment, which correlates stack events with CloudTrail API calls to point at the actual failure.

Kiro is the assistant AWS uses throughout the walkthrough. The post says the server is compatible with other MCP-capable assistants but does not name any.

Why a working engineer might care

The bit I keep replaying in my head is the troubleshoot step. Normally a CloudFormation failure is a two-tab exercise: stack events on one side, CloudTrail on the other, and you as the human doing the correlation. Handing that join to the assistant is the kind of quiet minutes saved I would notice on my next stuck deploy. You will feel this on the next ROLLBACK_COMPLETE you inherit.

The documentation search matters for a different reason. If you have ever asked a general chat model for a CloudFormation snippet, you know the tax of half-remembered property names and silently guessed defaults. Grounding the assistant in the current resource reference is what turns "plausible" into "deployable".

Getting it running

The setup lives in a public sample repo. You clone the sample, point your AI assistant's MCP config at the server, and deploy a small IAM role stack the walkthrough uses to give the tools the permissions they need:

git clone https://github.com/aws-samples/sample-accelerate-cloudformation-with-iac-mcp-server.git

aws cloudformation deploy \
  --template-file iac-mcp-blog-role-stack.yaml \
  --stack-name iac-mcp-blog-role-stack \
  --capabilities CAPABILITY_NAMED_IAM

You will also need AWS CLI credentials on the box (the blog uses us-east-1 throughout) and an IAM identity that can actually run CloudFormation and read CloudTrail. The MCP Server is a helper, not a deployer. It hands the template back and lets you run the aws cloudformation call yourself.

The rough edges

Two caveats worth marking up now, both flagged in the AWS post.

CloudTrail lag. The troubleshoot tool reads CloudTrail, and CloudTrail events take between five and fifteen minutes to appear. If your instinct is to hit "diagnose" the moment a stack fails, you will get a shrug. Give it a coffee and try again.

The ROLLBACK_COMPLETE dead end. If a stack lands in ROLLBACK_COMPLETE, CloudFormation still refuses to let you update it. The assistant cannot get around this rule: you have to delete and redeploy. Which is exactly the moment you rediscover whether your stack was safe to delete.

There is a third, unwritten one worth naming. An MCP-driven authoring loop is only as good as the trust you extend to the assistant, and check_cloudformation_template_compliance is what shifts some of that back onto cfn-guard rules you actually own. It puts a policy check between vibes and prod, which I like.

Where this sits in the IaC-plus-AI shelf

HashiCorp has been threading agent workflows through Terraform Cloud, and Pulumi has offered natural-language authoring for a while. Both of those live at the CLI or SaaS layer. The MCP shape is different because the server is a set of tools the assistant chooses to call, rather than a specific vendor UI. That means the same server can sit behind whichever MCP-capable assistant your team already tolerates, which is probably the more honest measure of adoption.

What I am watching next

Whether AWS ships a matching MCP server for CDK, which is where a lot of CloudFormation authors have already migrated. And whether other cloud vendors publish comparable, tool-shaped servers instead of yet another wrapper chat window. If you try the walkthrough this week, tell me what your first troubleshoot query looked like. Mine is going to be the DynamoDB table I have been putting off.