EC2 MCP Server: Give AI Agents Access to Instance Status, Metrics, and Fleet Health

Why Give AI Access to EC2?

AWS EC2 runs your compute fleet across regions, availability zones, and instance families. When instances degrade, CPU spikes, disk fills up, or security groups drift, diagnosing the problem means navigating the EC2 console, checking CloudWatch metrics, correlating across multiple instances, and reading security group rules.

An MCP server for EC2 lets your AI agent check instance status, monitor CPU and network metrics, list running instances by tag, and inspect security group configurations directly from Claude, Cursor, or Windsurf through DataFaucet.

What Becomes Possible

Once your AI agent has EC2 access:

• "Which instances in the prod cluster are running above 80% CPU?"
• "What's the status of the web-server fleet? Any degraded instances?"
• "Show me all instances launched in the last 24 hours"
• "What security group rules does the api-server instance have?"
• "Which instances are using the old AMI that needs patching?"
• "How much network traffic is the data-pipeline instance pushing?"

How It Works

1. Go to DataFaucet and enter your EC2 console URL
2. Authenticate with your AWS IAM credentials
3. Browse instances, check metrics, review security groups as you normally would
4. Each API call becomes an MCP tool your AI can invoke
5. Deploy and connect to Claude, Cursor, or Windsurf

The AI agent uses whatever EC2 permissions your IAM role grants.

Security Best Practices

• Read-only IAM policy — use AmazonEC2ReadOnlyAccess managed policy
• No RunInstances/TerminateInstances — prevent AI from launching or killing compute
• No ModifyInstanceAttribute — block instance type changes through AI
• No AuthorizeSecurityGroupIngress — prevent security group modifications
• Tag-based resource conditions — restrict to specific environments in IAM policy
• No SSM access — block Systems Manager commands to prevent shell access through AI

Use Cases by Role

SRE/DevOps: Incident response. "What's the health of the production fleet? Any instances in impaired status? What's the CPU trend?" during on-call incidents.

Backend developers: Environment debugging. "Is my staging instance running? What's the instance type and current load?" without leaving the editor.

Platform engineers: Fleet management. "Which instances are still on the old generation type? How many are using provisioned IOPS vs gp3?"

Security engineers: Posture audit. "Which security groups have 0.0.0.0/0 ingress rules? Any instances with public IPs that shouldn't have them?"

EC2 Console vs AI Agent

Getting Started

Set up read-only access for your AI agent:

1. Create an IAM policy with read-only EC2 access:

```json

{

"Effect": "Allow",

"Action": ["ec2:DescribeInstances", "ec2:DescribeInstanceStatus",

"ec2:DescribeSecurityGroups", "ec2:DescribeVolumes",

"ec2:DescribeSubnets", "ec2:DescribeVpcs",

"cloudwatch:GetMetricData"],

"Resource": "*"

}

```

1. Add tag-based conditions to limit scope to specific environments
2. Point DataFaucet at your EC2 console
3. Authenticate with the read-only IAM credentials