Skip to main content
AWS
Tembo acts as an OIDC Identity Provider. Your agents receive short-lived STS credentials that expire automatically — no AWS access keys are stored in Tembo. → Jump to Manual CloudFormation Setup

​
What agents can do

Once connected, agents have access to the AWS Agent Toolkit — AWS’s official MCP service covering 15,000+ APIs across every AWS service:
  • call_aws — execute any authenticated AWS API call
  • suggest_aws_commands — translate natural language to AWS API calls
  • run_script — run Python code with AWS API access in a sandboxed environment
  • search_documentation / read_documentation — search and read all AWS documentation
  • get_presigned_url — generate pre-signed S3 URLs
The default CloudFormation stack grants ReadOnlyAccess. You can modify the role’s policies to expand or restrict what agents are permitted to do.

​
Connect

1

Open the connect modal

Go to Integrations and click Connect next to AWS. Enter a name for this account (e.g. production or dev).
2

Deploy the CloudFormation stack

Click Create via CloudFormation to open a pre-filled stack in your AWS console. If the link shows “Access Denied”, use the manual setup in the section below instead — it creates the same resources.
3

Paste the role ARN

Once the stack is deployed, open the Outputs tab in CloudFormation and copy the RoleArn value. Back in the Tembo connect modal, switch to Enter ARN manually and paste it. Click Connect.
You can connect multiple AWS accounts — each gets its own label and isolated MCP server session.

​
Manual CloudFormation setup

Use this if the one-click CloudFormation link shows “Access Denied”. The template below creates the same IAM resources.
  1. Download the CloudFormation template. It creates an OIDC provider and a cross-account IAM role that trusts Tembo’s issuer, scoped to your org ID.
tembo-identity.json
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Tembo cross-account access via OIDC web identity federation",
  "Parameters": {
    "TemboOrgId": {
      "Type": "String",
      "Description": "Your Tembo organization ID (shown in the connect modal)",
      "MinLength": 1
    }
  },
  "Resources": {
    "TemboOidcProvider": {
      "Type": "AWS::IAM::OIDCProvider",
      "Properties": {
        "Url": "https://app.tembo.io",
        "ClientIdList": ["sts.amazonaws.com"],
        "ThumbprintList": ["0000000000000000000000000000000000000000"]
      }
    },
    "TemboCrossAccountRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Federated": { "Ref": "TemboOidcProvider" }
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "app.tembo.io:aud": "sts.amazonaws.com",
                  "app.tembo.io:sub": { "Fn::Sub": "org:${TemboOrgId}" }
                }
              }
            }
          ]
        },
        "MaxSessionDuration": 3600,
        "ManagedPolicyArns": ["arn:aws:iam::aws:policy/ReadOnlyAccess"]
      }
    }
  },
  "Outputs": {
    "RoleArn": {
      "Description": "Paste this ARN into the Tembo AWS connect modal",
      "Value": { "Fn::GetAtt": ["TemboCrossAccountRole", "Arn"] }
    }
  }
}
Self-hosted Tembo: replace both occurrences of app.tembo.io with your instance’s public hostname (the value of TEMBO_OIDC_ISSUER in your config).
  1. In the AWS CloudFormation console, click Create stack → With new resources.
  2. Choose Upload a template file and upload tembo-identity.json.
  3. Enter your Tembo organization ID when prompted (visible in the connect modal).
  4. Deploy the stack. When it completes, open the Outputs tab and copy the RoleArn value.
  5. Back in Tembo, switch to Enter ARN manually and paste the ARN. Click Connect.

​
How authentication works

Tembo never stores AWS credentials. For each agent run:
  1. Tembo mints a short-lived RS256 JWT (5-minute TTL) signed with its OIDC private key
  2. The JWT is exchanged with AWS STS via AssumeRoleWithWebIdentity
  3. STS validates the JWT by fetching Tembo’s public JWKS endpoint (/.well-known/jwks.json)
  4. Resulting temporary credentials (1-hour TTL) are injected into the agent’s sandbox at startup — they never leave the sandbox environment

​
Troubleshooting

Confirm the OIDC provider URL in your CloudFormation stack matches your Tembo instance exactly (including protocol, no trailing slash). For hosted Tembo this is https://app.tembo.io. Check that the TemboOrgId parameter matches the organization ID shown in the Tembo connect modal.
The agent sandbox requires outbound access to https://aws-mcp.us-east-1.api.aws for the AWS Agent Toolkit MCP service. In self-hosted deployments on a private network, confirm egress to that endpoint is allowed.
The default stack attaches ReadOnlyAccess. To allow write operations, modify the TemboCrossAccountRole in your AWS account and attach additional policies. You can scope permissions tightly using IAM condition keys — the agent’s identity is distinguishable from human calls in CloudTrail.