AWS cli high security documentation change
Summary
Updated CLI reference documentation for create-agent-action-group command with reordered parameters, added new computer use action group signatures (ANTHROPIC.Computer, ANTHROPIC.Bash, ANTHROPIC.TextEditor), and security warnings about computer use capabilities
Security assessment
Added explicit security warnings about computer use capabilities being in beta and recommending security precautions like restricted data access environments. Documents new security-relevant parameters (parent-action-group-signature) that control privileged capabilities.
Diff
diff --git a/cli/latest/reference/bedrock-agent/create-agent-action-group.md b/cli/latest/reference/bedrock-agent/create-agent-action-group.md index c8037b54d..53197b9ad 100644 --- a//cli/latest/reference/bedrock-agent/create-agent-action-group.md +++ b//cli/latest/reference/bedrock-agent/create-agent-action-group.md @@ -15 +15 @@ - * [AWS CLI 2.28.8 Command Reference](../../index.html) » + * [AWS CLI 2.28.11 Command Reference](../../index.html) » @@ -73,3 +72,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc - [--action-group-executor <value>] - --action-group-name <value> - [--action-group-state <value>] @@ -78 +75 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc - [--api-schema <value>] + --action-group-name <value> @@ -81 +77,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc - [--function-schema <value>] @@ -83,0 +80,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc + [--action-group-executor <value>] + [--api-schema <value>] + [--action-group-state <value>] + [--function-schema <value>] @@ -108 +108 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc -`--action-group-executor` (tagged union structure) +`--agent-id` (string) @@ -110 +110,21 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc -> The Amazon Resource Name (ARN) of the Lambda function containing the business logic that is carried out upon invoking the action or the custom control method for handling the information elicited from the user. +> The unique identifier of the agent for which to create the action group. + +`--agent-version` (string) + +> The version of the agent for which to create the action group. + +`--action-group-name` (string) + +> The name to give the action group. + +`--client-token` (string) + +> A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If this token matches a previous request, Amazon Bedrock ignores the request, but does not return an error. For more information, see [Ensuring idempotency](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html) . + +`--description` (string) + +> A description of the action group. + +`--parent-action-group-signature` (string) + +> Specify a built-in or computer use action for this action group. If you specify a value, you must leave the `description` , `apiSchema` , and `actionGroupExecutor` fields empty for this action group. @@ -112 +132,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc -> ### Note +> * To allow your agent to request the user for additional information when trying to complete a task, set this field to `AMAZON.UserInput` . +> * To allow your agent to generate, run, and troubleshoot code when trying to complete a task, set this field to `AMAZON.CodeInterpreter` . +> * To allow your agent to use an Anthropic computer use tool, specify one of the following values. @@ -114 +136 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc -> This is a Tagged Union structure. Only one of the following top level keys can be set: `customControl`, `lambda`. + @@ -116 +138 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc -> customControl -> (string) +> ### Warning @@ -118 +140 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->> To return the action group invocation results directly in the `InvokeAgent` response, specify `RETURN_CONTROL` . +>> Computer use is a new Anthropic Claude model capability (in beta) available with Anthropic Claude 3.7 Sonnet and Claude 3.5 Sonnet v2 only. When operating computer use functionality, we recommend taking additional security precautions, such as executing computer actions in virtual environments with restricted data access and limited internet connectivity. For more information, see [Configure an Amazon Bedrock Agent to complete tasks with computer use tools](https://docs.aws.amazon.com/bedrock/latest/userguide/agents-computer-use.html) . @@ -120 +142,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc -> lambda -> (string) +> * `ANTHROPIC.Computer` \- Gives the agent permission to use the mouse and keyboard and take screenshots. +> * `ANTHROPIC.TextEditor` \- Gives the agent permission to view, create and edit files. +> * `ANTHROPIC.Bash` \- Gives the agent permission to run commands in a bash shell. @@ -122 +145,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->> The Amazon Resource Name (ARN) of the Lambda function containing the business logic that is carried out upon invoking the action. @@ -124 +147,9 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc -Shorthand Syntax: +> +> Possible values: +> +> * `AMAZON.UserInput` +> * `AMAZON.CodeInterpreter` +> * `ANTHROPIC.Computer` +> * `ANTHROPIC.Bash` +> * `ANTHROPIC.TextEditor` +> @@ -127 +158 @@ Shorthand Syntax: - customControl=string,lambda=string +`--parent-action-group-signature-params` (map) @@ -128,0 +160,9 @@ Shorthand Syntax: +> The configuration settings for a computer use action. +> +> ### Warning +> +> Computer use is a new Anthropic Claude model capability (in beta) available with Anthropic Claude 3.7 Sonnet and Claude 3.5 Sonnet v2 only. For more information, see [Configure an Amazon Bedrock Agent to complete tasks with computer use tools](https://docs.aws.amazon.com/bedrock/latest/userguide/agents-computer-use.html) . +> +> key -> (string) +> +> value -> (string) @@ -130 +170 @@ Shorthand Syntax: -JSON Syntax: +Shorthand Syntax: @@ -133,4 +173 @@ JSON Syntax: - { - "customControl": "RETURN_CONTROL", - "lambda": "string" - } + KeyName1=string,KeyName2=string @@ -139 +176 @@ JSON Syntax: -`--action-group-name` (string) +JSON Syntax: @@ -141 +177,0 @@ JSON Syntax: -> The name to give the action group. @@ -143 +179,2 @@ JSON Syntax: -`--action-group-state` (string) + {"string": "string" + ...} @@ -145 +182,4 @@ JSON Syntax: -> Specifies whether the action group is available for the agent to invoke or not when sending an [InvokeAgent](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_InvokeAgent.html) request. + +`--action-group-executor` (tagged union structure) + +> The Amazon Resource Name (ARN) of the Lambda function containing the business logic that is carried out upon invoking the action or the custom control method for handling the information elicited from the user. @@ -147 +187 @@ JSON Syntax: -> Possible values: +> ### Note @@ -149,2 +189 @@ JSON Syntax: -> * `ENABLED` -> * `DISABLED` +> This is a Tagged Union structure. Only one of the following top level keys can be set: `lambda`, `customControl`. @@ -151,0 +191,7 @@ JSON Syntax: +> lambda -> (string) +> +>> The Amazon Resource Name (ARN) of the Lambda function containing the business logic that is carried out upon invoking the action. +> +> customControl -> (string) +> +>> To return the action group invocation results directly in the `InvokeAgent` response, specify `RETURN_CONTROL` . @@ -152,0 +199 @@ JSON Syntax: +Shorthand Syntax: @@ -154 +200,0 @@ JSON Syntax: -`--agent-id` (string) @@ -156 +202 @@ JSON Syntax: -> The unique identifier of the agent for which to create the action group. + lambda=string,customControl=string @@ -158 +203,0 @@ JSON Syntax: -`--agent-version` (string) @@ -160 +205,8 @@ JSON Syntax: -> The version of the agent for which to create the action group. +JSON Syntax: + + + { + "lambda": "string", + "customControl": "RETURN_CONTROL" + } + @@ -168,5 +220 @@ JSON Syntax: -> This is a Tagged Union structure. Only one of the following top level keys can be set: `payload`, `s3`. -> -> payload -> (string) -> ->> The JSON or YAML-formatted payload defining the OpenAPI schema for the action group. For more information, see [Action group OpenAPI schemas](https://docs.aws.amazon.com/bedrock/latest/userguide/agents-api-schema.html) . +> This is a Tagged Union structure. Only one of the following top level keys can be set: `s3`, `payload`. @@ -184,0 +233,4 @@ JSON Syntax: +> +> payload -> (string) +> +>> The JSON or YAML-formatted payload defining the OpenAPI schema for the action group. For more information, see [Action group OpenAPI schemas](https://docs.aws.amazon.com/bedrock/latest/userguide/agents-api-schema.html) . @@ -189 +241 @@ Shorthand Syntax: - payload=string,s3={s3BucketName=string,s3ObjectKey=string} + s3={s3BucketName=string,s3ObjectKey=string},payload=string @@ -196 +247,0 @@ JSON Syntax: - "payload": "string", @@ -200 +251,2 @@ JSON Syntax: - } + }, + "payload": "string" @@ -204,3 +256 @@ JSON Syntax: -`--client-token` (string) - -> A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If this token matches a previous request, Amazon Bedrock ignores the request, but does not return an error. For more information, see [Ensuring idempotency](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html) . +`--action-group-state` (string) @@ -208 +258,7 @@ JSON Syntax: -`--description` (string) +> Specifies whether the action group is available for the agent to invoke or not when sending an [InvokeAgent](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_InvokeAgent.html) request. +> +> Possible values: +> +> * `ENABLED` +> * `DISABLED` +> @@ -210 +265,0 @@ JSON Syntax: -> A description of the action group. @@ -237,4 +291,0 @@ JSON Syntax: ->>> ->>> description -> (string) ->>> ->>>> A description of the function and its purpose. @@ -245,0 +297,4 @@ JSON Syntax: +>>> description -> (string) +>>> +>>>> A description of the function and its purpose. +>>> @@ -270,4 +324,0 @@ JSON Syntax: ->>>>> required -> (boolean) ->>>>>