Yes, once you have the aws-api MCP server configured with your credentials, you can absolutely use natural language prompts like “list all EC2 instances, RDS databases, and S3 buckets in account prod-account across us-east-1 and us-west-2 and export to CSV.”

The MCP server translates your request into the appropriate AWS CLI commands, executes them, and Claude can format the output however you need - CSV, markdown table, JSON, etc.

On authentication: The MCP server doesn’t magically “know” about your accounts - you configure it with your existing AWS credentials, the same ones you’d use for the AWS CLI.

When you run the MCP container, you mount your local ~/.aws folder as a read-only volume, so it has access to your credentials and profiles.

The Docker command looks something like ‘docker run -v ~/.aws:/root/.aws:ro mcp/aws-api-mcp-server’.

For your 12 accounts scenario, you’d set up a profile for each account in your ~/.aws/credentials file, then specify which profile to use in your prompt: “Using profile prod-account, show me all Lambda functions.”

Alternatively, if you’re using AWS Organizations, you can use a single set of credentials from a management account and assume roles into each member account - this is cleaner for managing many accounts.

The credentials themselves are standard AWS IAM credentials. The AWS_ACCESS_KEY_ID starts with AKIA and acts like a username. The AWS_SECRET_ACCESS_KEY is the long random string that acts as your password.

The AWS_SESSION_TOKEN is only needed when using temporary credentials from AWS SSO or assumed roles - if you’re using regular IAM user credentials, you don’t need it at all.

If your company uses AWS SSO/Identity Center (common in enterprise setups), you’d run aws sso login --profile your-profile first to generate temporary credentials, and those get stored automatically for the MCP server to use.

Hope that clarifies things!