Introduction

Claude and cloud goes together like peanut butter and jelly. As of July 2026, the easiest way to use Claude for DevOps work on Azure is the two official Microsoft Azure MCP servers. Microsoft separates its MCP Server into two implementations: the Azure Learn MCP Server for documentation and Azure Developer MCP Server for transactions.

Once you complete this setup, Claude will be your Azure subject matter expert on Azure Well-Architected best practices.

Setup: Learn MCP Server

1. Add Azure MCP plugin
   Start claude and enter the commands below to install the Azure Learn MCP server plugin

/plugin marketplace add microsoftdocs/mcp
/plugin install microsoft-docs@microsoft-docs-marketplace

1. Connect the plugin
   Type the command below to start using the Azure Learn MCP server in Claude

/reload-plugins

The Learn MCP server is free to the public and does not require authentication.

Alternatively, if you choose to manually configure the Claude JSON configuration file, below is the mcpServers block.

{
  "mcpServers": {
    "microsoft-learn": {
      "type": "http",
      "url": "https://learn.microsoft.com/api/mcp"
    }
  }
}

Setup: Developer MCP Server

1. Create Entra Accounts for AI
   For infrastructure safety, do not use your regular Azure login for your AI agents. Create separate read-only and read-write Azure Entra IDs for each of your subscriptions. For this example, I created 2 IDs: ai-readonly and ai-readwrite.

   For the read-only ID, I assign it the Reader built-in Azure role. For the read-write ID, I assign it the Owner role because for any realistic scenario, Claude will need to create and assign IAM. To prevent accidental infrastructure deletions, you can lock your resources or use Azure denyAction policies.

2. Install npx
   npx is the Node.js Package Executor. It runs Node.js packages without installing it locally. The best way to install npx is via nvm (Node.js Version Manager)

   curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.5/install.sh | bash
   source ~/.zshrc
   nvm install 24
   npx --version
   

3. Configure Claude to use the Azure Developer MCP Server
   Run the command below to add the Azure Developer MCP Server to Claude AI.

   claude mcp add azure-mcp --scope user -- npx -y @azure/mcp@2.0.3 server start
   

   Confirm the Azure MCP was successfully added

   claude mcp list
   

4. Sign into the Azure CLI
   The Azure Developer MCP Server uses the local Azure CLI (az), the Azure Developer CLI (azd), and the Azure Core Tools (func) to access and modify your Azure resources. Install or upgrade these CLI tools as needed.

   Sign in via az login to the correct Azure subscription with the proper Entra ID created on step one.

Behind the Scene

The Azure Model Context Protocol (MCP) Server acts as a translator between Claude and Azure. The Learn MCP Server searches the latest Microsoft Learn documentation for the most current answers. The Developer MCP Server configures the Azure CLI commands and executes it locally from your computer.

The Learn MCP server requires no authentication while the Developer MCP server uses the local az login Entra account.

Reduce Hallucinations

Claude's knowledge ends on the training date cutoff of the AI model. For example, Sonnet 4.6 training date cutoff was May 2025. If you ask Sonnet 4.6 about Azure HorizonDB](https://azure.microsoft.com/en-us/products/horizondb), it will think it is a fake product since it was first previewed in November 2025.

If you use the Azure Learn MCP server, Claude will use the most current Azure documentation and give you the correct answer about HorizonDB. (I do appreciate the little apology Claude gave me for the first wrong answer).

Claude for Observability

Claude can use your read-only Azure credentials to analyze your Azure infrastructure. As a simple example, I asked Claude to list all my storage accounts buckets. As other examples, you can ask Claude:

• "Search Application Insights for errors from the Azure Function my-message-broker"

• "Find all VMs using more than 90% CPU"

Claude as Azure Well-Architected Expert

Microsoft published an official set of AI Skills for Azure. The Azure MCP Servers automatically load these skills without you having to do any additional complicated setup.

Using Claude and the azure-functions skill, I was able to create and deploy an Azure Function coded with Node.js with full Azure Bicep infrastructure-as-code in about 8 minutes. If I did this by hand before AI, it would have taken me much longer than 8 minutes with equivalent results.

How expensive is this setup?

Good news, it's free (mostly).

The Azure MCP servers are free to use. Of course, you still pay for Claude token usage and any Azure resources created. You can estimate Azure cost via the official pricing calculator.

How secure is this setup?

This setup passed rigorous review by the Microsoft security team. In summary, the communication is end-to-end encrypted and uses your Entra ID permission setup. In addition, no information is permanently stored on Microsoft servers.

Monitoring your AI

Commands executed by the Azure MCP servers on your Azure subscription are auditable in Activity Monitor.

The Downsides

• As an official Microsoft service, this AI setup uses azd and Azure Bicep as the infrastructure-as-code language. Like 97% of the DevOps community, you most likely use Terraform/OpenTofu. Additional steps are required to convert the answer into Terraform HCL

• You may not like the answers if you disagree with the Azure Well-Architected framework.

• Claude and most AI systems still offer questionable advice about Day 2 infrastructure operations such as upgrades and maintenance of existing resources. It will sometimes advise to delete infrastructure like databases instead of attempting to modify it.

What about GCP and AWS?

Check out our DevOps AI section for information how to set up MCP servers for GCP and AWS.

Conclusion

By powering up Claude with the Azure MCP Servers, it feels like having an Azure DevOps expert sit next to you and offer knowledgeable answers. On top of that, Claude can do the mundane task of creating, deploying, and monitoring Azure infrastructure. This frees you to concentrate on the important stuff, like creative ideas and business strategies.

Introduction

Claude and cloud goes together like chocolate and peanut butter. As of June 2026, the easiest and cheapest way to use Claude for AWS DevOps is the official AWS MCP Server. This recommended setup bypasses all the hassle of AWS Bedrock or AWS Marketplace.

Once you complete this setup, Claude will be your AWS subject matter expert on AWS Well-Architected best practices.

Setup

1. Create IAM Roles for AI
   For infrastructure safety, do not use your regular AWS login for your AI agents. Create separate read-only and read-write AWS IAM roles for each of your environments. For this example, I created 4 roles: ai-dev-ro , ai-dev-rw, ai-prod-ro, and ai-prod-rw.

   For the read-only role, I assign it the ReadOnlyAccess policy. For the read-write role, I assign it the AdministratorAccess policy and attach a custom DenyDeleteForAwsMcp IAM policy to prevent accidental deletions.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Sid": "DenyDeleteForAwsMcp",
               "Effect": "Deny",
               "Action": [
                   "ec2:Terminate*",
                   "ec2:Delete*",
                   "s3:Delete*",
                   "rds:Delete*",
                   "dynamodb:Delete*",
                   "iam:Delete*"
               ],
               "Resource": "*",
               "Condition": {
                   "StringEquals": {
                       "aws:CalledViaAWSMCP": "aws-mcp.amazonaws.com"
                   }
               }
           }
       ]
   }
   

   Set up authentication configuration the same way as the AWS CLI.

2. Install uv
   uv is the modern Python package manager. We need it to download and manage the MCP Proxy for AWS.

   On macOS and Linux

   curl -LsSf https://astral.sh/uv/install.sh | sh
   

   On Windows

   powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
   

3. Configure Claude to use the AWS MCP Server
   Run the command below to add the AWS MCP Server to Claude AI. Replace AWS_MCP_PROXY_PROFILES with the IAM roles created in step 1 and AWS_REGION with the default AWS region.
   If you are not in the US, replace the URL with https://aws-mcp.eu-central-1.api.aws/mcp

   claude mcp add aws-mcp --scope user \
     --env AWS_MCP_PROXY_PROFILES="ai-dev-ro ai-dev-rw ai-prod-ro ai-prod-rw" \
     -- uvx mcp-proxy-for-aws==1.6.2 https://aws-mcp.us-east-1.api.aws/mcp \
     --metadata AWS_REGION=us-west-1
   

   Confirm the AWS MCP was successfully added

   claude mcp list
   

4. Edit CLAUDE.md
   Ensure Claude uses AWS best practices by adding the official AWS AI agent rules. Edit ~/.claude/CLAUDE.md and add the contents of aws-agent-rules.md.

Behind the Scene

The AWS Model Context Protocol (MCP) Server acts as a translator between Claude and AWS. It searches the latest AWS documentation for the most current answers and can execute AWS API calls on your behalf. In order to access your AWS infrastructure, Claude passes your configured AWS IAM authentication credentials to the AWS MCP Server via the MCP Proxy for AWS using the SigV4 protocol.

Reduce Hallucinations

Claude's knowledge ends on the training date cutoff of the AI model. For example, Sonnet 4.6 training date cutoff was May 2025. If you ask Sonnet 4.6 the maximum size of an S3 object, it will answer 5 TB, which was the correct answer on May 2025.

However in December 2025, AWS increased the maximum S3 object size to 50 TB. If you use the AWS MCP Server, Claude will use the most current official AWS documentation to give you the correct answer. (I do appreciate the little apology Claude gave me for the first wrong answer).

Claude for Observability

Claude can use your read-only AWS credentials to analyze your AWS infrastructure. As a simple example, I asked Claude to list all my Simple Storage Service (S3) buckets using the read-only AWS dev account. As other examples, you can ask Claude:

• "Search for CloudWatch log errors in the Lambda function my-message-broker"

• "Find all EC2 VMs using more than 90% CPU"

Claude as AWS Well-Architected Expert

Amazon publishes an official set of AI skills for AWS. The AWS MCP Server automatically loads these skills without you having to do any additional complicated setup.
Using Claude and the aws-serverless skill, I was able to create and deploy a Lambda function coded with Node.js with full AWS CDK infrastructure-as-code in about 6 minutes. If I did this by hand before AI, it would have taken me much longer than 6 minutes with equivalent results.

How expensive is this setup?

Good news, it's free (mostly).

The AWS MCP server is free to use. Of course, you still pay for Claude token usage and any AWS resources created. Sometimes, the MCP Server will need to create an S3 bucket to store objects in your account.

How secure is this setup?

This setup passed rigorous review by the AWS security team. You can read the full technical details. In summary, the communication is end-to-end encrypted and uses your IAM permission setup. In addition, no information is permanently stored on AWS servers.

Monitoring your AI

The AWS MCP Server stores its metrics under CloudWatch > AWS-MCP > ToolName .

All commands executed by the AWS MCP server on your AWS account are auditable in CloudTrail under Event Source aws-mcp.amazonaws.com

The Downsides

• As an official AWS service, this AI setup uses CloudFormation/SAM/CDK as the infrastructure-as-code language. Like 97% of the DevOps community, you most likely use Terraform/OpenTofu. Additional steps are required to convert the answer into Terraform HCL

• You may not like the answers if you disagree with the AWS Well-Architected framework.

• Claude and most AI systems still offer questionable advice about Day 2 infrastructure operations such as upgrades and maintenance of existing resources. It will sometimes advise to delete infrastructure like databases instead of attempting to modify it.

What about GCP and Azure?

Check out our DevOps AI section for information how to set up MCP servers for GCP and Azure.

Conclusion

By powering up Claude with the AWS MCP Server, it feels like having an AWS DevOps expert sit next to you and offer knowledgeable answers. On top of that, Claude can do the mundane task of creating, deploying, and monitoring AWS infrastructure. This frees you to concentrate on the important stuff, like creative ideas and business strategies.

I used to post at the DEPT® Engineering Blog. I still post there, but I used to too.

While you are there, check out some of the other great articles from my colleagues.

Problem

From Google Cloud Platform (GCP), your outgoing HTTPS connections to third-party REST APIs are slow or dropping.

Solution

Preamble

The cause of the issue is most likely GCP Cloud NAT port exhaustion.

If you are using private network Compute Engine, GKE, or any of the GCP serverless services like Cloud Run, your outgoing connections are going through Cloud NAT.

Cloud NAT needs a unique 5-tuple [source IP, source port, destination IP/port/protocol] to make an outgoing connection. If all the 5-tuples are used, the connections are slowed or dropped. This is known as NAT port exhaustion.

Turn off Endpoint-Independent Mapping

You can read the gnarly technical details about Endpoint-Independent Mapping conflicts, but bottom-line, EIM is more trouble that it is worth. Turn EIM off and increase the "Minimum ports per VM instances" setting (2048 is a good starting option).

Steps:

1. In the GCP console, go to Cloud NAT

2. Click your Cloud NAT Gateway link

3. Click the "Edit" button on top, then click "Advanced Configuration"

4. Uncheck "Enable Endpoint-Independent Mapping" and increase the "Minimum port per VM instance" value

5. Click the "Save" button at the bottom

   

Optional: Enable Dynamic Port Allocation

Dynamic Port Allocation will scale up the number of VM ports when it senses port exhaustion. The main issue is connections can drop during scaling. I usually prefer to turn it off and set the "Minimum ports per VM instance" to a high number.

If you prefer to turn on "Dynamic Port Allocation", set the minimum port high to reduce the chance of dropped connections.

Optional: Assign more IPs to Cloud NAT

If you are using static reserved IPs for Cloud NAT because of third-party API firewall allow-lists, you can manually add more reserved IPs to reduce port exhaustion.

Steps:

1. In GCP console, go to Cloud NATAT

2. Click your Cloud NAT Gateway link

3. Click the "Edit" button on top, then go to the "Cloud NAT mapping" section.

4. Click the "+ ADD IP ADDRESS" button to add more IPs to Cloud NAT

5. Click the "Save" button at the bottom

1. Assign a new hard disk in VMware vSphere

2. Configure the new hard disk in CentOS

This example assigns a new 5 GB hard disk as the /backup directory on CentOS 7

Assign hard disk in vSphere

1. In VMware vSphere, right click on the VM and select "Edit Settings..."

   

2. In the "New device:" section, select "SCSI Controller", and click the "OK" button. Note, there is a hard limit of 4 SCSI Controllers per VM.

   

3. Right click "Edit Settings..." again and select "New Hard Disk"

   

4. Input the byte size of the new hard disk (in this example, 5 GB). In the "Virtual Device Node" section, assign the new SCSI controller number. Click the "OK" button.

   

Configure new hard disk in CentOS

1. SSH into the CentOS VM and sudo to root
   sudo su -

2. List the block device to see the newly assigned vSphere hard disk.
   lsblk

   

   If you do not see the vSphere hard disk, force a rescan

   for host in $(ls -1d /sys/class/scsi_host/);
     do echo "- - -" > ${host}/scan
   done
   
   for device in $(ls -1d /sys/class/scsi_disk/);
     do echo "1" > ${device}/device/rescan
   done
   

3. Format the disk partition. Get the device name from the previous lsblk output
   fdisk /dev/sdb
   See the screenshot for the options you should pick
   n (new partition)
   p (primary)
   (Press ENTER) (Use default partition number)
   (Press ENTER) (Use default first sector)
   (Press ENTER) (Use default last sector)
   t (change the partition type)
   8e (Linux LVM)
   w (write)

   

4. List the block device again to display the new disk partition /dev/sdb1
   lsblk

   

5. Initialize the physical volume
   pvcreate /dev/sdb1
   To display the new physical volume
   pvs

   

6. Create the volume group
   Note: vgBackup is just an name for this example. The volume group name can be whatever you want
   vgcreate vgBackup /dev/sdb1
   To display the volume group
   vgs

7. Create the logical volume for the volume group
   Note: lvBackup is just an name for this example. The logical volume name can be whatever you want
   lvcreate -n lvBackup -l +100%FREE vgBackup
   To display the logical volume
   lvs

   

8. Construct an XFS filesystem on the new logical volume
   mkfs.xfs /dev/vgBackup/lvBackup

   

9. Edit the text file /etc/fstab and add the line below:

   /dev/vgBackup/lvBakup /backup xfs defaults 1 2
   

10. Mount a Unix directory to the logical volume
    mkdir -p /backup
mount /backup

11. You now have a new 5 GB hard disk assigned as the /backup directory

    

To learn more about Unix Logical Volumes, go to official RedHat LVM docs

Step 1: Find process listening on port 8888

The netstat command shows the network statistics on a Unix server, including which process is listening to what port

netstat -plan | grep 8888

The output is

tcp     0   0 :::8888   :::*    LISTEN      2700/java 

This shows that a java program with Process ID (PID) 2700 is listening on port 8888

Step 2: Find process info of PID 2700

The ps command shows the current process snapshot.

ps -fp 2700

The output is

oracle  2700   1  0 18:55 ?     0:00:02 
java -Dapex.port=8888 -jar /home/oracle/listener/apex.war

PID 2700 is a Java program executing apex.war as the Unix user oracle. A quick Google search reveals that Oracle publishes a product called Oracle Apex.

Step 3: Find the configuration and log files

The lsof command lists open files by PID. This can help us find configuration files and log directories.

lsof -p 2700

The output is

java    2700 oracle    2w   REG 3,1 1700 1796967 /tmp/apex_listener.log
java    2700 oracle    3r   REG. 3,65. 9828505  134585 /home/oracle/listener/apex.war
java    2700 oracle    4r   REG 3,1 51796975  361047 /usr/java/jdk1.6.0_20/jre/lib/rt.jar
java    2700 oracle    5r   REG. 3,65  186902  132940 /home/oracle/config/apex.xml

With a bit of deductive reasoning, we know the configuration file is at /home/oracle/config/apex.xml and the log file is located at /tmp/apex_listener.log

Step 4: Stop and start the server

After editing the apex.xml configuration file, most java programs require a restart to apply the new settings. If you scroll back up to Step 2 and look at the ps output, the number after PID 2700 in the third column is the parent PID 1.

The command

ps -fp 1

gives the output

root    1     0  0 18:54 ?    00:00:00 init [5]

The init command is the process that executes when Unix first boots up.  The startup scripts are in directory /etc/init.d

The find command to find which script stops and starts Oracle Apex

find /etc/init.d -type f -exec grep -Hi apex {} \;

The output is

/etc/init.d/oracle-apex:   su - oracle -c "/home/oracle/apex/listener.sh start"

/etc/init.d/oracle-apex:   su - oracle -c "/home/oracle/apex/listener.sh restart"

/etc/init.d/oracle-apex:   su - oracle -c "/home/oracle/apex/listener.sh stop"

Reading the oracle-apex Bash script, the command to restart Oracle Apex is

/etc/init.d/oracle-apex restart

Starting with version 4, Java performs both IPv6 and IPv4 DNS lookups. If the DNS server is not set up to properly respond to IPv6 queries, then Java will wait for the IPv6 query to time out. This can manifest in what looks like network slowdowns.

To bypass IPv6 DNS lookups, set the Java System property java.net.preferIPv4Stack to true.

You can set it on the command line

java -Djava.net.preferIPv4Stack=true ...

Or you can set the propery in the Java Code itself 

System.setProperty("java.net.preferIPv4Stack","true");

Increase cache time

When a Java 6 security manager is not set, the default DNS cache is 30 seconds.  To reduce network DNS queries, the number of seconds of DNS cache can be increased by setting the networkaddress.cache.ttl System property.  Set this property to -1 to never expire the DNS cache.

Command line:  

java -Dnetworkaddress.cache.ttl=-1 ...

Java code:

System.setProperty("networkaddress.cache.ttl","-1");

You need to bring up another Unix web server but port 443 is already in use. How do you find another unused Unix port?

Solution

Use the netstat command to discover which ports are already used

netstat -ln | grep LISTEN | awk '{print $4}' | grep ":" | sort | uniq

Breakdown of commands

netstal -ln : List all the numerical Unix ports that are listening for network traffic

grep LISTEN : Display the output lines that are in LISTEN status

awk '{print $4} : Print the fourth column of the output that has the port numbers that Unix processed are LISTENING

sort | uniq : Sort the output and only show unique values

You will get an output similar to

0.0.0.0:443

0.0.0.0:5353
0.0.0.0:68
0.0.0.0:80
10.0.2.15:123
::1:10089
::1:123

The number after the last colon is the port in use, e.g. 443, 80, 123, 5353.  Pick any Unix port not already in use and assigned.