AWS Security ChangesHomeSearch

AWS cli documentation change

Service: cli · 2025-07-01 · Documentation medium

File: cli/latest/reference/iam/create-service-specific-credential.md

Summary

Added support for Amazon Bedrock credentials, introduced credential expiration days parameter, and expanded documentation for new credential fields

Security assessment

Added credential expiration capability (--credential-age-days) and secret handling documentation. While this improves security practices by allowing credential expiration, there's no evidence it addresses a specific existing vulnerability.

Diff

diff --git a/cli/latest/reference/iam/create-service-specific-credential.md b/cli/latest/reference/iam/create-service-specific-credential.md
index adbe3b8d4..c2c123ca6 100644
--- a//cli/latest/reference/iam/create-service-specific-credential.md
+++ b//cli/latest/reference/iam/create-service-specific-credential.md
@@ -15 +15 @@
-  * [AWS CLI 2.27.45 Command Reference](../../index.html) »
+  * [AWS CLI 2.27.46 Command Reference](../../index.html) »
@@ -64 +64 @@ You can have a maximum of two sets of service-specific credentials for each supp
-You can create service-specific credentials for CodeCommit and Amazon Keyspaces (for Apache Cassandra).
+You can create service-specific credentials for Amazon Bedrock, CodeCommit and Amazon Keyspaces (for Apache Cassandra).
@@ -66 +66 @@ You can create service-specific credentials for CodeCommit and Amazon Keyspaces
-You can reset the password to a new service-generated value by calling ResetServiceSpecificCredential .
+You can reset the password to a new service-generated value by calling [ResetServiceSpecificCredential](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ResetServiceSpecificCredential.html) .
@@ -68 +68 @@ You can reset the password to a new service-generated value by calling ResetServ
-For more information about service-specific credentials, see [Using IAM with CodeCommit: Git credentials, SSH keys, and Amazon Web Services access keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_ssh-keys.html) in the _IAM User Guide_ .
+For more information about service-specific credentials, see [Service-specific credentials for IAM users](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_bedrock.html) in the _IAM User Guide_ .
@@ -77,0 +78 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/iam-20
+    [--credential-age-days <value>]
@@ -111,0 +113,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/iam-20
+`--credential-age-days` (integer)
+
+> The number of days until the service specific credential expires. This field is only valid for Bedrock API keys and must be a positive integer. When not specified, the credential will not expire.
+
@@ -253 +258 @@ ServiceSpecificCredential -> (structure)
-> This is the only time that the password for this credential set is available. It cannot be recovered later. Instead, you must reset the password with ResetServiceSpecificCredential .
+> This is the only time that the password for this credential set is available. It cannot be recovered later. Instead, you must reset the password with [ResetServiceSpecificCredential](https://docs.aws.amazon.com/IAM/latest/APIReference/API_ResetServiceSpecificCredential.html) .
@@ -258,0 +264,4 @@ ServiceSpecificCredential -> (structure)
+> ExpirationDate -> (timestamp)
+>
+>> The date and time when the service specific credential expires. This field is only present for Bedrock API keys that were created with an expiration period.
+> 
@@ -270,0 +280,8 @@ ServiceSpecificCredential -> (structure)
+> ServiceCredentialAlias -> (string)
+>
+>> For Bedrock API keys, this is the public portion of the credential that includes the IAM user name and a suffix containing version and creation information.
+> 
+> ServiceCredentialSecret -> (string)
+>
+>> For Bedrock API keys, this is the secret portion of the credential that should be used to authenticate API calls. This value is returned only when the credential is created.
+> 
@@ -293 +310 @@ ServiceSpecificCredential -> (structure)
-  * [AWS CLI 2.27.45 Command Reference](../../index.html) »
+  * [AWS CLI 2.27.46 Command Reference](../../index.html) »