Building a Serverless MCP Server for Multi-Account Amazon Quick Management
Learn how to deploy Elthree, an open-source MCP server that provides AI agents and developers with 98 tools for managing Amazon Quick assets across multiple AWS accounts through cross-account IAM roles, permission auditing, and bulk operations.
Building a Serverless MCP Server for Multi-Account Amazon Quick Management
Managing Amazon Quick at scale across multiple AWS accounts presents unique challenges. While Quick is powerful for business intelligence and AI-powered analytics, native tooling requires separate console access for each account, lacks bulk operation capabilities, and provides limited visibility into permission inheritance across users, groups, and folders.
I built Elthree MCP Server to address these gaps by providing a serverless solution that connects multiple AWS accounts through cross-account IAM roles and exposes 98 MCP (Model Context Protocol) tools that give AI agents the same management capabilities available through the web UI.
Architecture Overview
Elthree is built as a modular CDK-deployed stack consisting of:
- Core Infrastructure: Lambda functions, API Gateway, Amazon Cognito, DynamoDB, and AWS Secrets Manager
- CloudFront Distribution: Fronts the web application for global access
- Cross-Account IAM Roles: Enables secure, credential-rotation-based access to connected accounts
- Five Service Modules: Authentication, account management, asset management, identity management, and migration capabilities
The modular design allows you to deploy only the components you need. Each connected account receives per-module role levels (Full, ReadWrite, ReadOnly) enforced at both the API and MCP tool level.
Key Capabilities
Multi-Account Management
Connect any number of AWS accounts through cross-account IAM roles with automatic credential rotation—no long-term keys stored. The bootstrap wizard guides you through adding accounts in minutes, after which you can browse all assets from a single interface.
Three-Axis Permission Auditing
One of the most powerful features is the permission audit suite that answers three critical questions:
- User-Centric Audit (
get_user_access): "What can this user see?" with Two-Search-Diff classification - Group-Centric Audit (
get_group_access): "What can this group see?" with direct group ARN search - Asset-Centric Audit (
get_asset_permissions): "Who has access to this asset?" with folder inheritance and group expansion
The opt-in
include_paths parameter detects whether access is direct or inherited, enumerates folder contents, and resolves folder inheritance chains.Bulk Operations
Native Quick requires clicking through the console one asset at a time. Elthree provides:
- Bulk rename across dashboards and datasets
- Bulk move operations between folders
- Bulk permission updates across accounts
- Bulk group membership management
- Bulk user registration across namespaces
These operations are available through both the web UI and MCP tools.
AI Agent Integration
Elthree exposes 98 MCP tools covering asset management, identity, migration, permissions, and account configuration. AI agents can perform the same operations available in the web UI through a standardized protocol, enabling automated workflows and intelligent asset management.
Migration Support
Moving assets between accounts requires scripting against the Asset Bundle API, tracking job status, handling dependency resolution, and managing VPC/credential overrides. Elthree wraps this complexity with:
- Compatibility analysis before migration
- Job tracking and status monitoring
- Migration history recording what was moved, when, and between which accounts
- Dependency resolution and override management
Deployment
The project uses AWS CDK for infrastructure as code with a multi-stack architecture that provides stable route logical IDs. The deployment includes:
- 15 Lambda handlers for different service operations
- 1000+ automated tests for reliability
- Built-in security scanning (Gitleaks, Semgrep)
- Comprehensive documentation including deployment guides, API reference, and security policies
To deploy your own instance, follow the Developer Guide which covers CDK deployment options and cross-account setup using AWS-recommended authentication patterns.
Security Considerations
Security is built into every layer:
- Cross-account access uses IAM roles with automatic credential rotation
- Per-module role levels enforce least-privilege access
- All API calls respect account-level permissions
- MCP tools inherit the same permission model as the web UI
- Secrets Manager stores sensitive configuration
- CloudFront provides DDoS protection and global distribution
See the Security Policy for detailed security practices and reporting procedures.
What's Next
Version 5.0 introduced the permission audit suite and modular CDK architecture. The backlog includes planned enhancements for advanced filtering, additional bulk operations, and expanded MCP tool coverage.
Whether you're managing Quick across multiple accounts, building AI agents that need Quick management capabilities, or simply looking for better visibility into permission inheritance, Elthree provides a serverless, secure, and extensible foundation.
Resources
The project is licensed under MIT-0 and welcomes contributions following the Contributing Guide .
Here's the article body in a markdown artifact you can copy directly into the AWS Builder Center entry box. The content is ready to paste and includes all the key technical details about the Elthree MCP Server project.
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article