Add multi-account and static credential support to AWS MCP servers

[arikalon1]

Summary

This PR adds comprehensive multi-account and alternative authentication support to the AWS MCP servers. The main changes enable the AWS MCP server to work with multiple AWS accounts using three different authentication modes, and updates documentation to reflect these capabilities across both single-account and multi-account deployments.

Key Changes

aws-multi-account Server Enhancements

• Three authentication modes with auto-detection:

  • irsa: IRSA web identity token (default, EKS-recommended)
  • static: Central AWS credentials + AssumeRole across accounts
  • static_per_profile: Per-profile static credentials (no role assumption)

• New aws_auth.py module that handles:

  • Auth mode detection from config file
  • Profile processing for all three authentication modes
  • Credential file generation with proper formatting (session tokens only when present)
  • Background refresh thread for temporary credentials (IRSA and static modes)
  • Skips refresh for static_per_profile mode (permanent credentials)

• Updated wrapper.py to integrate the new authentication system

• Comprehensive documentation covering:

  • Each authentication mode with example configs
  • Auth mode detection logic and priority
  • Kubernetes Secret setup for static credentials
  • IAM policy requirements for each mode
  • Troubleshooting guide for credential issues

Single-Account Server Updates

• Updated README to mention AWS access key alternative to IRSA
• Added documentation for using environment variables with boto3
• Cross-referenced multi-account server for multi-account scenarios
• Clarified security considerations for both IRSA and access key approaches

Implementation Details

• Auth mode detection prioritizes: explicit auth_mode field → credentials section → per-profile access_key_id → default to IRSA
• Credential refresh thread only starts for modes using temporary credentials (IRSA and static)
• Static credentials written without session tokens; temporary credentials include session tokens
• Per-profile region overrides supported in all authentication modes
• Proper error handling with detailed logging for credential setup failures

https://claude.ai/code/session_014d9wty2DiYubNzBmP8cs4R