AWS MCP Server

Connect the AWS MCP Server to give Bayes access to your AWS account. Your collection agent calls the server from inside your AWS account. It uses an IAM role that you create, so Monte Carlo never holds AWS credentials.

Bayes uses it like any other custom MCP server: when you chat with it and when it troubleshoots an alert.

One way to use it: let Bayes read your CloudWatch Logs while it troubleshoots an alert. When a job fails and a table goes stale, Bayes can find the job's error message and include it in its findings. See Example: investigate failed Glue jobs.

The IAM role is the only limit

Other custom MCP servers are limited to tools marked read-only. The AWS MCP Server is different. Its main tool runs a short script that calls AWS APIs. That script can read data, and it can also create, change, or delete resources.

Monte Carlo tells Bayes to only read. That instruction is not a security boundary. Bayes can make a mistake, and text it reads from a tool result could try to steer it. The IAM role you give Monte Carlo is what limits what Bayes can do.

So set up the role carefully:

• Create a dedicated role for Monte Carlo. Don't reuse your collection agent's execution role or any other existing role.
• Grant only the read actions Bayes needs, on only the resources they need. For example, logs:FilterLogEvents on one log group.
• Don't attach broad managed policies such as ReadOnlyAccess. They can read data across your whole account, such as S3 objects.
• Review changes to the role like you would review access for a person.

Anything the role can read can reach the LLM and is stored with the conversation. See Custom MCP Servers Technical Overview.

Requirements

• A collection agent deployed in your AWS account. See AWS: Agent Deployment.
• The latest versions of the agent and the data collector. See upgrading the agent and Upgrading the Data Collector.
• If the agent runs in a VPC, it needs outbound HTTPS access to the AWS MCP Server.
• An AWS region where the AWS MCP Server runs. Not every region has it. Check the AWS MCP Server endpoints for the current list. The region is part of the server's URL, https://aws-mcp.<region>.api.aws/mcp. The server's region doesn't limit which region Bayes reads from. A role can read logs in any region you allow.
• The settings/mcp-servers/edit permission in Monte Carlo. By default, only Account Owners have it. See MCP Servers permissions.

Step 1: Create the IAM role

Create the role in the same AWS account as your collection agent. The role needs three things:

1. A trust policy that lets the agent's execution role assume it.
2. A tag named MonteCarloData with an empty value. The agent can only assume roles that carry this tag.
3. A permissions policy with only the reads you want to allow.

Find the agent's execution role

For an agent deployed with CloudFormation:

aws cloudformation describe-stack-resource \
  --region <agent-region> --stack-name <agent-stack-name> \
  --logical-resource-id ExecutionRole \
  --query StackResourceDetail.PhysicalResourceId --output text

This prints the role name. Its ARN is arn:aws:iam::<account-id>:role/<role-name>.

For an agent deployed with Terraform, the execution role is the mcd-agent module's mcd_agent_execution_role.

Trust policy

Save this as trust-policy.json, with your execution role's ARN:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/<execution-role-name>"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Permissions policy

This example lets Bayes search one log group, the error log that AWS Glue jobs write to. Save it as permissions-policy.json, with your region and account ID:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "SearchGlueJobErrorLogs",
      "Effect": "Allow",
      "Action": "logs:FilterLogEvents",
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws-glue/jobs/error:*"
    }
  ]
}

To let Bayes read more, add only the actions and resources it needs. Each one is something Bayes can read during any conversation or investigation.

Create the role

aws iam create-role \
  --role-name monte-carlo-logs-read \
  --assume-role-policy-document file://trust-policy.json \
  --tags '[{"Key": "MonteCarloData", "Value": ""}]'

aws iam put-role-policy \
  --role-name monte-carlo-logs-read \
  --policy-name search-glue-job-errors \
  --policy-document file://permissions-policy.json

aws iam get-role --role-name monte-carlo-logs-read --query Role.Arn --output text

The last command prints the role ARN. You need it in the next step.

Step 2: Add the server in Monte Carlo

1. Go to Settings. Under Agentic operations, choose MCP servers.
2. Click Add. If you have no MCP servers yet, the button is Add MCP server.
3. Enter a Name, such as "AWS CloudWatch Logs", and an optional Description. Pick a name that says what the role can read.
4. Enter the MCP server URL for your region, for example https://aws-mcp.us-east-1.api.aws/mcp. Monte Carlo recognizes the AWS MCP Server URL and shows the Connection options. Through your collection agent is selected.
5. Choose the Collection agent.
6. Enter the IAM role ARN from step 1.
7. Click Add.

Monte Carlo saves the server and tests the connection through your agent:

• If the test passes, you return to the list, and the server's row shows Active. This means the agent reached the AWS MCP Server.
• If the test fails, the page stays open and shows Server added, but the connection failed with the reason. The server is already saved. Fix the problem (see Troubleshooting) and click Save.

The test doesn't check what actions the IAM role can perform. AWS checks those the first time Bayes calls an AWS API.

Edit the server

1. Go to Settings. Under Agentic operations, choose MCP servers.
2. Click Edit on the server's row.
3. Change the Collection agent, MCP server URL, or IAM role ARN. To move to another region, change the region in the URL. Leave IAM role ARN blank to keep the saved role.
4. Click Save. Monte Carlo saves your changes and tests the connection. If the test fails, the page shows Changes saved, but the connection failed with the reason.

You can't change a server's Connection type. To switch, delete the server and add it again.

Example: investigate failed Glue jobs

Say a nightly Glue job, orders_daily_load, loads the analytics.orders table. When the job fails, the table goes stale and Monte Carlo raises a freshness alert. The reason for the failure is in the job's error log in CloudWatch Logs, which Monte Carlo can't see on its own.

Here is how to let Bayes read that log when it troubleshoots an alert.

1. Give the role access to the log group

Create the role from step 1 with the permissions policy above. Glue writes job errors to the /aws-glue/jobs/error log group, so the role can search that group and nothing else.

2. Add the server

Add the server as in step 2.

3. Tell Bayes where to look

1. Go to Settings. Under Agentic operations, choose Troubleshooting agent.

2. In the Agent context section, add this to Context:

   For alerts that could be caused by a failed job, such as freshness or volume
   alerts on tables loaded by AWS Glue jobs, search the CloudWatch log group
   /aws-glue/jobs/error in us-east-1. Look for ERROR and Exception messages from
   the 24 hours before the alert. Report the job run ID, the time, and the first
   error message.

3. Click Save.

Name the log group and its region in the context. Bayes can't list your log groups (the role doesn't allow it), so it needs to know exactly where to look.

4. What Bayes does

The next time a freshness alert fires on analytics.orders, Bayes searches /aws-glue/jobs/error while it troubleshoots the alert. If the job failed, Bayes reports the error as evidence. For example, it might find that the run failed with AnalysisException: Column 'discount_code' does not exist, and point to a schema change in the source table.

5. Try it in chat

You can ask Bayes the same kind of question directly in chat:

• "Did any Glue job log errors in /aws-glue/jobs/error in us-east-1 in the last 24 hours?"
• "Why did last night's orders_daily_load run fail? Check /aws-glue/jobs/error in us-east-1."

Troubleshooting

If Bayes doesn't read your logs while it troubleshoots an alert, check that the Agent context names the log group and its region.

Security & data privacy

For how Monte Carlo stores the role ARN and handles tool results, see Custom MCP Servers Technical Overview.