Understanding IAM for Managed AWS MCP Servers

**Executive Summary:** This AWS blog post introduces two standardized IAM context keys (aws:ViaAWSMCPService and aws:CalledViaAWSMCP) and a simplified authorization flow for AWS-managed MCP servers to let organizations differentiate AI-agent-initiated API calls from human-initiated ones. It also describes upcoming support for VPC endpoints to enforce network-level controls and provides guidance on IAM policy design, compliance considerations, and operational patterns for securely integrating AI agents into AWS workflows.