ECS MCP Server: Give AI Agents Access to Container Service Status, Tasks, and Deployments

Why Give AI Access to ECS?

AWS ECS runs your containerized workloads across clusters, services, and task definitions. When deployments stall, tasks crash loop, services fail health checks, or capacity runs out, diagnosing the problem means navigating the ECS console, checking task status, reading event logs, and correlating across services.

An MCP server for ECS lets your AI agent check service health, inspect running tasks, monitor deployment progress, and search container logs directly from Claude, Cursor, or Windsurf through DataFaucet.

What Becomes Possible

Once your AI agent has ECS access:

• "Is the payment-service deployment rolling out successfully?"
• "Which tasks in the api-cluster are in STOPPED state? What exit codes?"
• "How many running tasks does the worker-service have vs desired count?"
• "What's the CPU and memory utilization across the production cluster?"
• "Show me the last 5 task failures for the notification-service"
• "Which services have pending deployments that haven't stabilized?"

How It Works

1. Go to DataFaucet and enter your ECS console URL
2. Authenticate with your AWS IAM credentials
3. Browse clusters, check services, inspect tasks as you normally would
4. Each API call becomes an MCP tool your AI can invoke
5. Deploy and connect to Claude, Cursor, or Windsurf

The AI agent uses whatever ECS permissions your IAM role grants.

Security Best Practices

• Read-only IAM policy — use AmazonECS_ReadOnlyAccess managed policy
• No RunTask/StopTask — prevent AI from launching or killing containers
• No UpdateService — block scaling or deployment changes through AI
• No DeregisterTaskDefinition — prevent task definition deletions
• Cluster-scoped ARNs — restrict to specific cluster names in IAM policy
• No ExecuteCommand — block container shell access through AI

Use Cases by Role

Backend developers: Deployment tracking. "Did my PR deploy successfully? Is the new version receiving traffic?" while staying in the editor.

SRE/DevOps: Incident triage. "Which services are degraded? How many tasks are crash looping? What's the cluster capacity?" during on-call.

Platform engineers: Capacity planning. "What's the average CPU reservation across clusters? Which services are over-provisioned?"

Release managers: Deployment monitoring. "Which services have active deployments? Any stuck rollbacks? What's the deployment history for auth-service?"

ECS Console vs AI Agent

Getting Started

Set up read-only access for your AI agent:

1. Create an IAM policy with read-only ECS access:

```json

{

"Effect": "Allow",

"Action": ["ecs:DescribeClusters", "ecs:ListClusters",

"ecs:DescribeServices", "ecs:ListServices",

"ecs:DescribeTasks", "ecs:ListTasks",

"ecs:DescribeTaskDefinition",

"logs:FilterLogEvents", "logs:GetLogEvents"],

"Resource": "*"

}

```

1. Add cluster-based conditions to limit scope
2. Point DataFaucet at your ECS console
3. Authenticate with the read-only IAM credentials