# AWS Cloud > Operate or inspect any AWS resource through direct SigV4 or SigV4a HTTPS, private/public ECR Docker/OCI Registry HTTP, finite raw-frame SigV4 WSS, Amazon Connect Health or Transcribe signed EventStream WSS, bounded bidirectional AWS IoT MQTT-over-WSS clients, IAM-authenticated AppSync Events and GraphQL subscriptions, or the Amazon Chime SDK Messaging WebSocket event stream in cloud-skills-mcp. Use for AWS, EC2, S3, ECR, IAM, Lambda, RDS, EKS, CloudFormation, Cloud Control, AgentCore, Managed Blockchain, Connect Health, Transcribe, IoT, AppSync, Chime SDK Messaging, or any documented AWS API. - Skill: `tttboy123/aws-cloud` (Agent Skill, multi-file: 4 files) - Install (CLI): `npx skillmds@latest add tttboy123/aws-cloud` - Raw SKILL.md: https://api.skillmd.com/api/skills/tttboy123/aws-cloud/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tttboy123 (https://skillmd.com/u/tttboy123) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/tttboy123/aws-cloud --- # AWS Cloud Use the unified MCP server for documented AWS HTTP APIs. The gateway validates the exact official endpoint, signs requests in-process with AWS SigV4 or SigV4a, derives private/public ECR Registry authorization internally, connects bounded raw SigV4, Connect Health, Transcribe, IoT, and AppSync WebSocket streams internally, and never executes AWS CLI or returns a token or presigned URL. ## Workflow 1. Call `cloud_provider_status` with `provider="aws"`; report only adapter availability and credential source/status. `unverified` is normal before a live API call and is not authentication proof. 2. Verify the service endpoint, HTTP request shape, signing service, region, action, and API version in the official API reference; `aws_api_discover` returns navigation links. 3. Use `aws_api_read` only for operations classified as read-only (`describe*`, `list*`, `get*`, `head*`, `search*`, and similar). 4. For any other operation, obtain explicit human approval for the exact account, region, resources, operation, and expected effect. Then call `aws_api_mutate` with `force=true`. 5. Secret-resource operations require the operator-controlled sensitive gate. Credential issuance or export operations such as STS AssumeRole, login tokens, presigned credentials, and AccessKey creation are never exposed by the gateway. 6. Return the provider RequestId when present. Never return, print, store, or ask the MCP server to reveal credentials. ## MCP arguments - `auth_scheme`: `sigv4` (default), `sigv4a` for multi-region signing, `ecr` for private or public Docker/OCI Registry HTTP with an internal IAM authorization token, `sigv4-ws` for a finite raw-frame IAM WebSocket, `connect-health-ws` for Connect Health Medical Scribe, `transcribe-ws` for Transcribe streaming, `iot-mqtt-ws` for bounded IoT MQTT 3.1.1/5.0 read or bidirectional clients, `kinesisvideo-signaling-ws` for Kinesis Video WebRTC signaling, `appsync-event-ws` for a finite IAM AppSync Events channel subscription, or `appsync-graphql-ws` for a finite IAM AppSync GraphQL subscription. - `service`: SigV4 signing service, such as `ec2`, `s3`, `iam`, or `cloudcontrolapi`. - `operation`: documented action name used for read/write classification. - `region`: required SigV4 signing region; use the documented pseudo-region for global services. - `region_set`: required only for SigV4a, as a comma-separated official region set such as `us-east-1,us-west-*`. It is not a token or credential. - `payload_mode`: use `aws-chunked` only for SigV4 or SigV4a S3 `PutObject` or `UploadPart` streaming bodies. The server creates the 64 KiB chunk framing and HMAC or fixed-length DER-ECDSA chained signatures. - `payload_mode=aws-chunked-trailer`: for SigV4 or SigV4a S3 streaming uploads with a signed trailing checksum. Set `checksum_algorithm` to `crc32`, `crc32c`, `crc64nvme`, `sha1`, or `sha256`; the server computes the value and callers must not supply checksum or signing headers. - `payload_mode=aws-eventstream`: for a finite or bidirectional HTTP/2 SigV4 request whose `body_file` contains consecutive CRC-valid unsigned Amazon EventStream frames. The server validates the 24 MiB per-frame bound, adds chained signing envelopes and a terminal frame, and validates every response frame before atomic output. Set `stream_interval_ms` to pace whole frames; never set `stream_chunk_bytes`, and include `response_file` whenever pacing is enabled. This is not a WebSocket transport. - `method` and `url`: exact official AWS HTTPS request. - `parameters`: optional scalar query parameters; use `body` for Query/JSON protocol payloads. - `headers`, `body`, `body_file`: non-credential request data; local files require an operator-approved root. `connect-health-ws` requires the Medical Scribe configuration in `body` and raw finite audio in `body_file`; `transcribe-ws` requires raw finite audio and optionally accepts a configuration object. These are the controlled cases where both are accepted. - `response_file`: optional new approved-root file for large/binary responses. Use the documented `Range` header for objects larger than the configured per-call limit; existing files are never overwritten. Example read: `aws_api_read(auth_scheme="sigv4", service="ec2", operation="describe-instances", region="us-east-1", method="POST", url="https://ec2.us-east-1.amazonaws.com/", headers={"Content-Type":"application/x-www-form-urlencoded"}, body="Action=DescribeInstances&Version=2016-11-15&MaxResults=20")`. Private ECR Registry example: `aws_api_read(auth_scheme="ecr", service="ecr", operation="ListTags", region="us-west-2", method="GET", url="https://123456789012.dkr.ecr.us-west-2.amazonaws.com/v2/team/app/tags/list", parameters={"n":20})`. Public example: `aws_api_read(auth_scheme="ecr", service="ecr-public", operation="GetManifest", region="us-east-1", method="GET", url="https://public.ecr.aws/v2///manifests/latest")`. The gateway signs the internal GetAuthorizationToken request from the AWS credential chain and never exposes the returned token. Public Registry does not support `/tags/list`. Private layer GET/HEAD may follow only the exact regional Starport S3 307 with Authorization removed; use `response_file` for a bounded atomic layer download. Push/upload/delete/mount calls use the mutation tool and approval gate. Example streaming upload: `aws_api_mutate(auth_scheme="sigv4", payload_mode="aws-chunked", service="s3", operation="put-object", region="us-east-1", method="PUT", url="https://bucket.s3.us-east-1.amazonaws.com/object", body_file="/approved/uploads/object.bin", force=true)`. Example signed checksum upload: `aws_api_mutate(auth_scheme="sigv4", payload_mode="aws-chunked-trailer", checksum_algorithm="crc64nvme", service="s3", operation="put-object", region="us-east-1", method="PUT", url="https://bucket.s3.us-east-1.amazonaws.com/object", body_file="/approved/uploads/object.bin", force=true)`. For an official multi-region S3 endpoint, use either streaming example with `auth_scheme="sigv4a"`, its exact multi-region URL, and the documented `region_set` instead of `region`. Example bidirectional HTTP/2 event stream: `aws_api_mutate(auth_scheme="sigv4", payload_mode="aws-eventstream", service="health-agent", operation="StartMedicalScribeListeningSession", region="us-west-2", method="POST", url="https://streaming.health-agent.us-west-2.api.aws/medical-scribe-stream/", headers={"x-amzn-medscribe-session-id":"","x-amzn-medscribe-domain-id":"","x-amzn-medscribe-subscription-id":"","x-amzn-medscribe-language-code":"en-US","x-amzn-medscribe-media-encoding":"pcm","x-amzn-medscribe-sample-rate":"16000"}, body_file="/approved/streams/medical-scribe.events", response_file="/approved/streams/transcript.events", stream_interval_ms=100, force=true)`. The body file must already contain the documented configuration, audio, and `END_OF_SESSION` logical events; the gateway signs complete frames without exposing AKSK/STS material. Finite raw-frame IAM WebSockets use `auth_scheme="sigv4-ws"`. The gateway signs the exact WSS host/path/query and all allowed caller headers in-process, sends at most 256 client frames of type `json`, `text`, or `binary` (`data_base64`), and atomically records at most 256 server frames or 300 seconds as NDJSON. AgentCore targets additionally enforce the official 32 KiB per-frame limit. Every generic signed WebSocket is forced through `aws_api_mutate` because arbitrary bidirectional frames can have side effects even when an operation label looks read-only. Example AgentCore invocation: `aws_api_mutate(auth_scheme="sigv4-ws", service="bedrock-agentcore", operation="InvokeAgentRuntimeWithWebSocketStream", region="us-west-2", method="GET", url="wss://bedrock-agentcore.us-west-2.amazonaws.com/runtimes//ws?qualifier=prod", headers={"X-Amzn-Bedrock-AgentCore-Runtime-Session-Id":"session-123456789012345678901234567890"}, body={"messages":[{"type":"json","data":{"inputText":"hello"}}],"max_messages":10,"timeout_seconds":30}, response_file="/agentcore.ndjson", force=true)`. Use this generic mode only when the provider protocol uses ordinary WebSocket text/binary frames after the SigV4 Upgrade, such as an AgentCore runtime or Managed Blockchain JSON-RPC node. It does not replace `transcribe-ws`, `iot-mqtt-ws`, either AppSync mode, or a protocol that requires per-frame AWS EventStream signatures. Authorization, STS token, and the signed handshake never enter MCP output; caller-controlled credential/query, WebSocket control headers, redirects, and unbounded sessions are rejected. Connect Health ambient documentation uses `auth_scheme="connect-health-ws"`, `service="health-agent"`, operation `StartMedicalScribeListeningSession`, method `GET`, and the exact `wss://streaming.health-agent..api.aws/medical-scribe-stream-websocket` endpoint in `us-east-1` or `us-west-2`. Supply exactly `session-id`, `domain-id`, `subscription-id`, `language-code=en-US`, `sample-rate`, and `media-encoding=pcm|flac` as parameters. `body` is the documented `MedicalScribeConfigurationEvent` object and must contain the S3 post-stream action and exactly one managed or custom note template; `body_file` is finite raw audio and `response_file` receives atomic transcript NDJSON. Example: `aws_api_mutate(auth_scheme="connect-health-ws", service="health-agent", operation="StartMedicalScribeListeningSession", region="us-west-2", method="GET", url="wss://streaming.health-agent.us-west-2.api.aws/medical-scribe-stream-websocket", parameters={"session-id":"","domain-id":"","subscription-id":"","language-code":"en-US","sample-rate":16000,"media-encoding":"pcm"}, body={"postStreamActionSettings":{"outputS3Uri":"s3:///","clinicalNoteGenerationSettings":{"noteTemplateSettings":{"managedTemplate":{"templateType":"PHYSICAL_SOAP"}}}}}, body_file="/visit.pcm", response_file="/medical-scribe.ndjson", force=true)`. The gateway creates the maximum-60-second presigned Upgrade internally, chains a signature over every configuration/audio/session-control EventStream frame, sends raw `binaryAudioEvent` chunks followed by `END_OF_SESSION`, and publishes output only after a normal provider close. This is always a write operation because it starts a session and produces S3 artifacts. Obtain and record required recording consent before sending PHI, and require trained clinical review of generated output. The signed URL, AKSK/STS token, and frame signatures never enter MCP output. Example realtime transcription: `aws_api_read(auth_scheme="transcribe-ws", service="transcribe", operation="StartStreamTranscriptionWebSocket", region="us-west-2", method="GET", url="wss://transcribestreaming.us-west-2.amazonaws.com:8443/stream-transcription-websocket", parameters={"language-code":"en-US","media-encoding":"pcm","sample-rate":16000,"session-id":"session-1"}, body_file="/approved/audio/input.pcm", response_file="/approved/results/transcript.ndjson")`. The adapter creates the five-minute SigV4 handshake internally, signs every audio event in a chained outer EventStream frame, sends an empty signed terminal event, validates both CRC layers in provider responses, and atomically publishes only bounded JSON event payloads. PCM defaults to 100 ms chunks; use `stream_chunk_bytes` and `stream_interval_ms` only when the documented media format requires another cadence. For `/medical-stream-transcription-websocket`, use `StartMedicalStreamTranscriptionWebSocket` and include the documented `language-code`, `specialty`, and `type`. For `/call-analytics-stream-transcription-websocket`, use `StartCallAnalyticsStreamTranscriptionWebSocket`; when post-call or channel configuration is needed, pass its JSON object as `body` while audio remains in `body_file`. AWS IoT Core uses `auth_scheme="iot-mqtt-ws"`, `service="iotdevicegateway"`, method `GET`, and the exact account endpoint `wss:///mqtt`. `body.protocol_version` is `4` (MQTT 3.1.1, default) or `5`; `client_id` is non-secret bounded UTF-8. Read-only operation `SubscribeMQTT` requires one to eight QoS 0/1 subscriptions, clean start, `max_messages` from 1 to 256, `timeout_seconds` from 1 to 300, and `response_file` for atomic Base64 NDJSON. Example: `aws_api_read(auth_scheme="iot-mqtt-ws", service="iotdevicegateway", operation="SubscribeMQTT", region="us-west-2", method="GET", url="wss://-ats.iot.us-west-2.amazonaws.com/mqtt", body={"protocol_version":5,"client_id":"observer-1","subscriptions":[{"topic_filter":"sensors/+/temperature","qos":1}],"max_messages":10,"timeout_seconds":30}, response_file="/mqtt.ndjson")`. Use mutation-only operation `ClientMQTT` for WSS publishes, unsubscriptions, persistent sessions, retained messages, or Last Will. MQTT 3.1.1 uses `clean_start=false`; MQTT 5 additionally accepts `session_expiry_seconds` up to 604800 and optional `disconnect_session_expiry_seconds` to update or end a nonzero session at DISCONNECT. A resumed session must always declare `max_messages`, `timeout_seconds`, and `response_file`, because AWS can deliver stored QoS 1 traffic immediately after CONNACK even when the plan adds no subscription. Up to eight subscriptions and unsubscriptions and 64 QoS 0/1 publishes may be combined. Publish and Will plans use Base64 payloads and `retain`; MQTT 5 also supports payload format, content type, message expiry, response topic, correlation data, and ordered user properties. Example: `aws_api_mutate(auth_scheme="iot-mqtt-ws", service="iotdevicegateway", operation="ClientMQTT", region="us-west-2", method="GET", url="wss://-ats.iot.us-west-2.amazonaws.com/mqtt", body={"protocol_version":5,"client_id":"device-1","clean_start":false,"session_expiry_seconds":3600,"disconnect_session_expiry_seconds":0,"subscriptions":[{"topic_filter":"devices/device-1/in","qos":1}],"publishes":[{"topic":"devices/device-1/status","qos":1,"retain":true,"payload_base64":"b25saW5l","payload_format":1,"content_type":"text/plain"}],"will":{"topic":"devices/device-1/status","qos":1,"retain":true,"payload_base64":"b2ZmbGluZQ=="},"max_messages":1,"timeout_seconds":30}, response_file="/mqtt-client.ndjson", force=true)`. The adapter generates the five-minute SigV4 WSS query internally, applies AWS IoT's documented STS exception by appending the session token only after signing, requires the `mqtt` subprotocol, checks version-specific CONNACK/SUBACK/UNSUBACK/PUBACK/DISCONNECT reason codes, acknowledges inbound QoS 1 messages, and honors server keepalive. QoS 1 outbound delivery is sequential and bounded by the broker Receive Maximum. Publish pacing enforces the documented 500/s connection quota and the default retained-message 50/s account and 1/s same-topic quotas. The client advertises a 128 KiB packet limit and zero topic aliases and validates broker Maximum QoS, Retain Available, Maximum Packet Size, and session state. QoS 2, subscription identifiers, topic aliases, properties absent from AWS's supported-property table (including Will Delay), caller query/headers/credentials, and unbounded sessions fail closed. Ordinary SigV4 HTTPS `/topics/` publishing remains available for request/response-only use cases. Kinesis Video Streams WebRTC signaling uses `auth_scheme="kinesisvideo-signaling-ws"`, `service="kinesisvideo"`, operation `ConnectAsMaster` or `ConnectAsViewer`, method `GET`, and the exact query-free WSS endpoint returned by `GetSignalingChannelEndpoint`. This is always `aws_api_mutate`: the body contains the matching `role`, channel ARN, Viewer-only `client_id`, zero to 256 credential-free SDP/ICE JSON messages, and finite output bounds. Each outbound message requires a unique `correlation_id`; Master messages also require `recipient_client_id`, while Viewer messages forbid it. Example: `aws_api_mutate(auth_scheme="kinesisvideo-signaling-ws", service="kinesisvideo", operation="ConnectAsViewer", region="us-west-2", method="GET", url="wss://.kinesisvideo.us-west-2.amazonaws.com/", body={"role":"VIEWER","channel_arn":"arn:aws:kinesisvideo:us-west-2:123456789012:channel/demo/1700000000000","client_id":"viewer-1","messages":[{"action":"SDP_OFFER","payload":{"type":"offer","sdp":"v=0..."},"correlation_id":"offer-1"}],"max_messages":32,"timeout_seconds":30}, response_file="/kvs-signaling.ndjson", force=true)`. The gateway implements the official 299-second query presign, including the Channel ARN, Viewer Client ID, and STS token in the canonical query; no signed URL or credential reaches MCP output. It accepts only SDP offer/answer and ICE-candidate actions, Base64-encodes bounded JSON internally, paces at the stricter 5 TPS signaling quota, validates/correlates all documented server event shapes, decodes received Base64 JSON, and atomically publishes mode-0600 NDJSON. This covers the AWS signaling API, not peer-to-peer WebRTC RTP/media transport. Kinesis Video Streams RTMP/HLS media ingest and playback remain a documented non-resource media plane outside the MCP surface. AWS AppSync Events subscriptions use `auth_scheme="appsync-event-ws"`, `service="appsync"`, operation `EventSubscribe`, method `GET`, and `wss://.appsync-realtime-api..amazonaws.com/event/realtime` (or an operator-approved custom domain). `body` contains only `channel`, `max_messages` from 1 to 256, and `timeout_seconds` from 1 to 300; `response_file` receives atomic sanitized NDJSON. Example: `aws_api_read(auth_scheme="appsync-event-ws", service="appsync", operation="EventSubscribe", region="us-east-1", method="GET", url="wss://.appsync-realtime-api.us-east-1.amazonaws.com/event/realtime", body={"channel":"/news/latest","max_messages":10,"timeout_seconds":30}, response_file="/appsync-events.ndjson")`. The adapter separately SigV4-signs the documented connection `{}` and channel bodies against the AppSync HTTP `/event` endpoint, keeps the resulting Authorization and STS token inside the dynamic WebSocket subprotocol and subscribe message, generates the subscription ID, validates acknowledgements/data/keep-alives, and explicitly unsubscribes. API keys, JWTs, caller Authorization, arbitrary handshake fields, WebSocket publishing, and unbounded sessions are rejected. AppSync Events publishing remains available through the ordinary SigV4 HTTPS `/event` write path. Legacy AppSync GraphQL subscriptions use `auth_scheme="appsync-graphql-ws"`, `service="appsync"`, operation `GraphQLSubscribe`, method `GET`, and `wss://.appsync-realtime-api..amazonaws.com/graphql`. An operator-approved custom domain instead uses `/graphql/realtime`. `body.query` must contain exactly one `subscription` operation; optional `variables` must contain no credential-like fields. `max_messages` is 1 to 256, `timeout_seconds` is 1 to 300, and `response_file` is mandatory. Example: `aws_api_read(auth_scheme="appsync-graphql-ws", service="appsync", operation="GraphQLSubscribe", region="us-east-1", method="GET", url="wss://.appsync-realtime-api.us-east-1.amazonaws.com/graphql", body={"query":"subscription OnMessage($room: ID!) { onMessage(room: $room) { id text } }","variables":{"room":"room-1"},"max_messages":10,"timeout_seconds":30}, response_file="/appsync-graphql.ndjson")`. The adapter signs the documented HTTPS `/graphql/connect` body `{}` and the exact HTTPS `/graphql` GraphQL request separately, keeps IAM Authorization and the STS token only in the dynamic `header-` subprotocol and `start.extensions.authorization`, validates `connection_ack`, `start_ack`, keep-alives, data IDs, payload objects, and completion, then sends `stop`. Query/mutation documents, multiple operations, caller headers/query parameters, API keys, JWTs, arbitrary IDs, and unbounded sessions are rejected. Amazon IVS Chat messaging uses `auth_scheme="ivs-chat-ws"`, `service="ivschat"`, method `GET`, and an exact current `wss://edge.ivschat..amazonaws.com` endpoint. Read-only `SubscribeChat` creates a view-only one-time token internally and atomically collects bounded `MESSAGE`/`EVENT` frames. `ClientChat` mutation-gates up to 64 `SEND_MESSAGE` actions; `ModerateChat` is additionally sensitive-gated and accepts only `DELETE_MESSAGE` or `DISCONNECT_USER`. Example: `aws_api_mutate(auth_scheme="ivs-chat-ws", service="ivschat", operation="ClientChat", region="us-west-2", method="GET", url="wss://edge.ivschat.us-west-2.amazonaws.com", body={"room_identifier":"arn:aws:ivschat:us-west-2:123456789012:room/demo","user_id":"agent","messages":[{"action":"SEND_MESSAGE","content":"hello","request_id":"message-1"}],"max_messages":1,"timeout_seconds":30}, response_file="/ivs-chat.ndjson", force=true)`. The server signs the fixed HTTPS `CreateChatToken` request with the AWS SDK credential chain, infers only the capabilities required by the selected operation, and passes the single-use token only as the internal WebSocket subprotocol. It enforces the official room/user/session/attribute/message limits, seven-region endpoint table and 10 requests/second connection quota. Caller tokens, capabilities, arbitrary actions, credential-bearing provider data, binary frames, and unbounded sessions fail closed; the token and SigV4 authorization never enter MCP output. Amazon Lex V2 streaming conversations use `auth_scheme="lex-v2-conversation"`, `service="lex"`, operation `StartConversation`, method `POST`, and the exact official `https://runtime-v2-lex..amazonaws.com` origin. The server validates the bot/alias/locale/session URI identifiers and a bounded credential-free plan, then signs the request and every `STREAMING-AWS4-HMAC-SHA256-EVENTS` frame internally. It always sends the official `ConfigurationEvent` first, then supports `conversation_mode="TEXT"` with one to 64 `TextInputEvent` frames or `conversation_mode="AUDIO"` with bounded official 8 kHz lpcm `audio_base64`, single-character `dtmf` input, and optional text frames, and atomically publishes sanitized `TextResponseEvent`/`TranscriptEvent`/`HeartbeatEvent`/`IntentResultEvent` and, in AUDIO mode, `AudioResponseEvent`/`PlaybackInterruptionEvent` NDJSON. Example: `aws_api_mutate(auth_scheme="lex-v2-conversation", service="lex", operation="StartConversation", region="us-west-2", method="POST", url="https://runtime-v2-lex.us-west-2.amazonaws.com", body={"bot_id":"ABCDEFGHIJ","bot_alias_id":"alias-1","locale_id":"en_US","session_id":"session-1","conversation_mode":"AUDIO","audio_base64":"","dtmf":"12#","texts":[{"text":"hello","event_id":"lex-evt-1"}],"max_events":64,"timeout_seconds":60}, response_file="/lex.ndjson", force=true)`. The server rejects caller-supplied signatures, tokens, query/headers, body files, unknown response event types, credential-bearing frames, mode-inconsistent audio events, and unbounded plans; EOF and the documented timeout publish only what arrived, and nothing is published on failure. Amazon Chime SDK Messaging event streaming uses `auth_scheme="chime-messaging-ws"`, `service="chime-messaging"`, operation `SubscribeMessages`, method `GET`, and the exact official `wss://data-messaging.chime.aws/connect` URL. The server signs the fixed `GET https://messaging-chime..amazonaws.com/endpoints/messaging-session` request with the AWS SDK credential chain, validates the returned official endpoint, then SigV4-presigns `/connect` internally with the caller's bounded `user_arn` (one official `arn:aws:chime:...:app-instance/.../user/...` AppInstanceUser ARN), unique `session_id`, optional `prefetch_on_connect`, and bounded `connect_expires_seconds` (10–3600, default 60). The identity needs `chime:GetMessagingSessionEndpoint` on `*` and `chime:Connect` on the AppInstanceUser ARN. Read-only sessions collect bounded sanitized events (`SESSION_ESTABLISHED`, `CHANNEL_DETAILS`, channel message/membership/channel lifecycle events with `STANDARD|CONTROL|SYSTEM` message types), decode each `Payload` JSON string, and atomically publish NDJSON. Unknown event types, malformed envelopes, invalid payloads, caller query/headers, and unbounded plans fail closed; the signed URL, STS token, and SigV4 material never enter MCP output. Example: `aws_api_read(auth_scheme="chime-messaging-ws", service="chime-messaging", operation="SubscribeMessages", region="us-east-1", method="GET", url="wss://data-messaging.chime.aws/connect", body={"user_arn":"arn:aws:chime:us-east-1:123456789012:app-instance/694d2099-cb1e-463e-9d64-697ff5b8950e/user/johndoe","session_id":"session-1","prefetch_on_connect":true,"connect_expires_seconds":60,"max_messages":32,"timeout_seconds":30}, response_file="/chime-messaging.ndjson")`. Amazon Connect chat participant streaming uses `auth_scheme="connect-chat-ws"`, `service="connect"`, operation `ObserveChat`, method `POST`, region, and the exact official `wss://participant.connect..amazonaws.com/participant/connect` URL (query-free). This is mutation-only: the server signs `PUT https://connect..amazonaws.com/contact/chat` (`connect:StartChatContact`) with the AWS SDK credential chain, calls `POST https://participant.connect..amazonaws.com/participant/connection` (`connectparticipant:CreateParticipantConnection`) with the participant token only in the internal `X-Amz-Bearer` header, validates the returned `wss://participant.connect..amazonaws.com/participant/connect` endpoint, and dials it directly. The finite body plan carries `instance_id` (UUID), `contact_flow_id` (ARN or UUID), `display_name`, optional `initial_message`, up to 16 bounded `attributes`, optional 1–16 bounded `messages` (`content` plus optional `content_type` of `text/plain` or `text/markdown`), plus `max_events` (1–256) and `timeout_seconds` (1–300). After the subscription succeeds, the gateway sends each `message` through `POST https://participant.connect..amazonaws.com/participant/message` with the connection token only in the internal `X-Amz-Bearer` header and a generated idempotent `ClientToken`, and reports the count in `sent_messages` metadata. The gateway publishes the official `{"topic":"aws/subscribe","content":{"topics":["aws/chat"]}}` frame, waits for subscription success, ignores `aws/heartbeat`/`aws/ping`, validates every `aws/chat` content object against the documented `Type`/`ParticipantRole` tables, and atomically publishes sanitized bounded NDJSON. The participant token, connection token, and dial URL never enter MCP output; unknown topics, malformed frames, subscribe failure, credential-bearing content, and unbounded plans fail closed. Example: `aws_api_mutate(auth_scheme="connect-chat-ws", service="connect", operation="ObserveChat", region="us-east-1", method="POST", url="wss://participant.connect.us-east-1.amazonaws.com/participant/connect", body={"instance_id":"12345678-1234-1234-1234-123456789012","contact_flow_id":"arn:aws:connect:us-east-1:123456789012:contact-flow/87654321-4321-4321-4321-210987654321","display_name":"Observer","max_events":32,"timeout_seconds":30}, response_file="/connect-chat.ndjson", force=true)`. ## Credentials Use the AWS SDK credential chain: profiles/SSO, web identity, IAM roles, or `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / optional `AWS_SESSION_TOKEN`. Keep credentials in the server environment or official AWS config, never in MCP arguments. Read [references/official-docs.md](references/official-docs.md) when authentication, ECR Registry, Cloud Control, Connect Health, Transcribe, IoT, AppSync, IVS Chat, Chime SDK Messaging, or operation naming needs verification.