Service: AWS MCP Server (part of Agent Toolkit for AWS), GA May 6 2026. No charge for the server, you pay only for resources you touch.
Why it fits you specifically: your agent is Claude Code, which you already have on subscription. No Bedrock inference, no ANTHROPIC_API_KEY, no Agent SDK. The AI half of the demo is free. The AWS half is CloudTrail management events and IAM policy, also free. This is a near zero cost blog post.
The thesis: AWS shipped a provenance primitive in IAM. Two global condition keys, confirmed in the Agent Toolkit IAM docs:
So the same IAM role can be read-write when you use it and read-only when your agent uses it. Same credentials, different authorization, decided by who initiated the call. That is the demo, and it photographs well.