AWS cli low security documentation change
Summary
Updated AWS CLI version reference, restructured agent configuration parameters, added new fields (agentVersion, clientToken, instruction), reorganized security-related fields (encryption, IAM roles), and enhanced prompt configuration documentation
Security assessment
The change moves customerEncryptionKeyArn (KMS encryption key for agent data) and agentResourceRoleArn (IAM permissions) to different positions while maintaining their security relevance. Adds idempotency token documentation for API safety. However, there's no explicit mention of addressing a specific vulnerability.
Diff
diff --git a/cli/latest/reference/bedrock-agent/get-agent.md b/cli/latest/reference/bedrock-agent/get-agent.md index 2b9ef0860..aad2dfc57 100644 --- a//cli/latest/reference/bedrock-agent/get-agent.md +++ b//cli/latest/reference/bedrock-agent/get-agent.md @@ -15 +15 @@ - * [AWS CLI 2.28.8 Command Reference](../../index.html) » + * [AWS CLI 2.28.11 Command Reference](../../index.html) » @@ -201,8 +200,0 @@ agent -> (structure) -> agentArn -> (string) -> ->> The Amazon Resource Name (ARN) of the agent. -> -> agentCollaboration -> (string) -> ->> The agent’s collaboration settings. -> @@ -217 +209 @@ agent -> (structure) -> agentResourceRoleArn -> (string) +> agentArn -> (string) @@ -219 +211,13 @@ agent -> (structure) ->> The Amazon Resource Name (ARN) of the IAM role with permissions to invoke API operations on the agent. +>> The Amazon Resource Name (ARN) of the agent. +> +> agentVersion -> (string) +> +>> The version of the agent. +> +> clientToken -> (string) +> +>> A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If this token matches a previous request, Amazon Bedrock ignores the request, but does not return an error. For more information, see [Ensuring idempotency](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html) . +> +> instruction -> (string) +> +>> Instructions that tell the agent what it should do and how it should interact with users. @@ -235 +239 @@ agent -> (structure) -> agentVersion -> (string) +> foundationModel -> (string) @@ -237 +241 @@ agent -> (structure) ->> The version of the agent. +>> The foundation model used for orchestration by the agent. @@ -239 +243 @@ agent -> (structure) -> clientToken -> (string) +> description -> (string) @@ -241 +245 @@ agent -> (structure) ->> A unique, case-sensitive identifier to ensure that the API request completes no more than one time. If this token matches a previous request, Amazon Bedrock ignores the request, but does not return an error. For more information, see [Ensuring idempotency](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/Run_Instance_Idempotency.html) . +>> The description of the agent. @@ -243 +247 @@ agent -> (structure) -> createdAt -> (timestamp) +> orchestrationType -> (string) @@ -245 +249 @@ agent -> (structure) ->> The time at which the agent was created. +>> Specifies the orchestration strategy for the agent. @@ -263,9 +267 @@ agent -> (structure) -> customerEncryptionKeyArn -> (string) -> ->> The Amazon Resource Name (ARN) of the KMS key that encrypts the agent. -> -> description -> (string) -> ->> The description of the agent. -> -> failureReasons -> (list) +> idleSessionTTLInSeconds -> (integer) @@ -273 +269 @@ agent -> (structure) ->> Contains reasons that the agent-related API that you invoked failed. +>> The number of seconds for which Amazon Bedrock keeps information about a user’s conversation with the agent. @@ -275 +271 @@ agent -> (structure) ->> (string) +>> A user interaction remains active for the amount of time specified. If no conversation occurs during this time, the session expires and Amazon Bedrock deletes any data provided before the timeout. @@ -277 +273 @@ agent -> (structure) -> foundationModel -> (string) +> agentResourceRoleArn -> (string) @@ -279 +275 @@ agent -> (structure) ->> The foundation model used for orchestration by the agent. +>> The Amazon Resource Name (ARN) of the IAM role with permissions to invoke API operations on the agent. @@ -281 +277 @@ agent -> (structure) -> guardrailConfiguration -> (structure) +> customerEncryptionKeyArn -> (string) @@ -283,9 +279 @@ agent -> (structure) ->> Details about the guardrail associated with the agent. ->> ->> guardrailIdentifier -> (string) ->> ->>> The unique identifier of the guardrail. ->> ->> guardrailVersion -> (string) ->> ->>> The version of the guardrail. +>> The Amazon Resource Name (ARN) of the KMS key that encrypts the agent. @@ -293 +281 @@ agent -> (structure) -> idleSessionTTLInSeconds -> (integer) +> createdAt -> (timestamp) @@ -295,3 +283 @@ agent -> (structure) ->> The number of seconds for which Amazon Bedrock keeps information about a user’s conversation with the agent. ->> ->> A user interaction remains active for the amount of time specified. If no conversation occurs during this time, the session expires and Amazon Bedrock deletes any data provided before the timeout. +>> The time at which the agent was created. @@ -299 +285 @@ agent -> (structure) -> instruction -> (string) +> updatedAt -> (timestamp) @@ -301 +287 @@ agent -> (structure) ->> Instructions that tell the agent what it should do and how it should interact with users. +>> The time at which the agent was last updated. @@ -303 +289 @@ agent -> (structure) -> memoryConfiguration -> (structure) +> preparedAt -> (timestamp) @@ -305,19 +291 @@ agent -> (structure) ->> Contains memory configuration for the agent. ->> ->> enabledMemoryTypes -> (list) ->> ->>> The type of memory that is stored. ->>> ->>> (string) ->> ->> sessionSummaryConfiguration -> (structure) ->> ->>> Contains the configuration for SESSION_SUMMARY memory type enabled for the agent. ->>> ->>> maxRecentSessions -> (integer) ->>> ->>>> Maximum number of recent session summaries to include in the agent’s prompt context. ->> ->> storageDays -> (integer) ->> ->>> The number of days the agent is configured to retain the conversational context. +>> The time at which the agent was last prepared. @@ -325 +293 @@ agent -> (structure) -> orchestrationType -> (string) +> failureReasons -> (list) @@ -327 +295,3 @@ agent -> (structure) ->> Specifies the orchestration strategy for the agent. +>> Contains reasons that the agent-related API that you invoked failed. +>> +>> (string) @@ -329 +299 @@ agent -> (structure) -> preparedAt -> (timestamp) +> recommendedActions -> (list) @@ -331 +301,3 @@ agent -> (structure) ->> The time at which the agent was last prepared. +>> Contains recommended actions to take for the agent-related API that you invoked to succeed. +>> +>> (string) @@ -337,4 +308,0 @@ agent -> (structure) ->> overrideLambda -> (string) ->> ->>> The ARN of the Lambda function to use when parsing the raw foundation model output in parts of the agent sequence. If you specify this field, at least one of the `promptConfigurations` must contain a `parserMode` value that is set to `OVERRIDDEN` . For more information, see [Parser Lambda function in Amazon Bedrock Agents](https://docs.aws.amazon.com/bedrock/latest/userguide/lambda-parser.html) . ->> @@ -349 +317 @@ agent -> (structure) ->>>> additionalModelRequestFields -> (document) +>>>> promptType -> (string) @@ -351 +319,9 @@ agent -> (structure) ->>>>> If the Converse or ConverseStream operations support the model, `additionalModelRequestFields` contains additional inference parameters, beyond the base set of inference parameters in the `inferenceConfiguration` field. +>>>>> The step in the agent sequence that this prompt configuration applies to. +>>>> +>>>> promptCreationMode -> (string) +>>>> +>>>>> Specifies whether to override the default prompt template for this `promptType` . Set this value to `OVERRIDDEN` to use the prompt that you provide in the `basePromptTemplate` . If you leave it as `DEFAULT` , the agent uses a default prompt template. +>>>> +>>>> promptState -> (string) +>>>> +>>>>> Specifies whether to allow the agent to carry out the step specified in the `promptType` . If you set this value to `DISABLED` , the agent skips that step. The default state for each `promptType` is as follows. @@ -353 +329,6 @@ agent -> (structure) ->>>>> For more information, see _Inference request parameters and response fields for foundation models_ in the Amazon Bedrock user guide. +>>>>> * `PRE_PROCESSING` – `DISABLED` +>>>>> * `ORCHESTRATION` – `ENABLED` +>>>>> * `KNOWLEDGE_BASE_RESPONSE_GENERATION` – `ENABLED` +>>>>> * `POST_PROCESSING` – `DISABLED` +>>>>> + @@ -359,4 +339,0 @@ agent -> (structure) ->>>> foundationModel -> (string) ->>>> ->>>>> The agent’s foundation model. ->>>> @@ -367,10 +343,0 @@ agent -> (structure) ->>>>> maximumLength -> (integer) ->>>>> ->>>>>> The maximum number of tokens to allow in the generated response. ->>>>> ->>>>> stopSequences -> (list) ->>>>> ->>>>>> A list of stop sequences. A stop sequence is a sequence of characters that causes the model to stop generating the response. ->>>>>> ->>>>>> (string) ->>>>> @@ -380,0 +348,4 @@ agent -> (structure) +>>>>> topP -> (float) +>>>>> +>>>>>> While generating a response, the model determines the probability of the following token at each point of generation. The value that you set for `Top P` determines the number of most-likely candidates from which the model chooses the next token in the sequence. For example, if you set `topP` to 0.8, the model only selects the next token from the top 80% of the probability distribution of next tokens. +>>>>> @@ -385 +356 @@ agent -> (structure) ->>>>> topP -> (float) +>>>>> maximumLength -> (integer) @@ -387 +358,7 @@ agent -> (structure) ->>>>>> While generating a response, the model determines the probability of the following token at each point of generation. The value that you set for `Top P` determines the number of most-likely candidates from which the model chooses the next token in the sequence. For example, if you set `topP` to 0.8, the model only selects the next token from the top 80% of the probability distribution of next tokens. +>>>>>> The maximum number of tokens to allow in the generated response. +>>>>> +>>>>> stopSequences -> (list) +>>>>>