Quick answer
WorkSpaces Applications exposes a managed MCP endpoint at a regional agentaccess-mcp AWS domain. Requests use Streamable HTTP and must be SigV4-signed with IAM credentials. The desktop session is then selected through a streaming URL for non-domain-joined fleets or a signed SAML assertion for domain-joined fleets.
CloudTrail and CloudWatch provide different evidence. CloudTrail can record session and tool activity, but tool calls are data events that need explicit trail configuration. CloudWatch exposes operational metrics such as invocations, latency, client and server errors, session starts, and session duration. Neither tells you whether the business action was correct.
Identity and transport map
| Layer | Current AWS mechanism | Required control |
|---|---|---|
| MCP request | IAM credentials and SigV4, service agentaccess-mcp | Least-privilege role, short-lived credentials, region match |
| Non-domain session | CreateStreamingURL result passed as a request header | Bind URL to caller and session; protect it as a bearer capability |
| Domain-joined session | Signed SAML assertion plus stack ARN in MCP metadata | IdP policy, certificate-based authentication, assertion audience and expiry |
| Desktop application | App-specific or Windows-integrated identity | Reauthentication and resource-level authorization |
| Model | Bedrock or another model provider identity | Separate invoke scope, region, data handling, and budget |
| Forwarded MCP tool | Tool-specific credentials and policy | Server-side identity propagation and action authorization |
The managed MCP connection cannot safely replace the lower application layers. A desktop that is reachable under one identity may display or change data belonging to many users.
Connection behavior to test
AWS documents BLOCKING as the default connection mode: initialization waits until the desktop is ready. POLLING returns earlier with a connection_status tool until the full tool set becomes available. Test both timeout and retry paths without resubmitting the business action.
Session cleanup is also explicit. A request header can make an MCP DELETE expire the underlying streaming session. The default is false, so the session can continue until the configured disconnect timeout. Closing the agent process therefore does not prove that the WorkSpaces instance stopped or costs ceased.
Only one agent may connect to a unique session at a time, and a named user may have only one active session per fleet. Parallel workers need unique sessions and identities. Reject designs that share a streaming URL between agents.
CloudTrail audit gate
Before the pilot:
- Create a trail that includes the documented agent-access data events.
- Confirm connect, tool-use, and session-end records arrive in the intended account and region.
- Correlate principal, stack, fleet, session, agent run, approval, tool, and business-operation IDs.
- Test access denials and verify they are visible.
- Protect the log destination, enable integrity and retention controls, and restrict readers.
- Document which sensitive values are omitted, redacted, or still exposed.
An audit trail is evidence of requests, not proof that the screen showed the expected record or that the application committed the intended result.
CloudWatch operating gate
AWS currently documents Invocations, Latency, ClientErrors, ServerErrors, McpSessionStart, and McpSessionDuration. Build alerts around rates and distributions, not isolated totals. Add application-level metrics for accepted tasks, human interventions, ambiguous outcomes, duplicate prevention, reconciliation, and cost per accepted completion.
Separate availability from correctness. A low MCP error rate can coexist with an agent clicking the wrong button.
Forwarded tools expand authority
MCP tool forwarding can expose tools from inside the WorkSpaces application session directly to the agent. This may be more deterministic than screen coordinates, but it broadens the action surface. Review each forwarded server’s provenance, schemas, environment, current working directory, network destinations, credentials, resource permissions, timeouts, output handling, and logging.
The AWS sample includes a compatibility tester and warns that some configuration errors can be silent. Treat successful tool listing as discovery evidence only. Continue with the governance guide and local readiness checklist.
Frequently asked questions
How are MCP requests authenticated?
With IAM SigV4 using the regional agentaccess-mcp service endpoint.
How is the desktop session authenticated?
Through a streaming URL for non-domain fleets or SAML plus certificate-based authentication for domain-joined fleets.
Are tool calls automatically in CloudTrail?
AWS classifies them as data events; configure the trail to collect them.
Official sources
- AWS: WorkSpaces Applications MCP server
- AWS: agent access monitoring
- AWS Samples: WorkSpaces agent access
Source check: August 12, 2026; sample revision 94b0e37578ccaca46837c3e9a9c21997c94d746a. Recheck endpoints, IAM actions, connection modes, event names, metrics, and session semantics before implementation.