AWS cli medium security documentation change

Service: cli · 2025-09-28 · Security-related medium

File: cli/latest/reference/bedrock-agent-runtime/get-session.md

Summary

Updated CLI version reference, modified regex patterns for session identifiers, restructured field documentation, and moved encryptionKeyArn details while changing its validation constraints

Security assessment

The change removes regex anchors (^ and $) from encryptionKeyArn pattern validation (previously enforcing strict KMS ARN format), which could allow invalid encryption key ARNs if validation relies solely on this pattern. This weakens input validation for a security-sensitive parameter related to data encryption. However, there's no explicit mention of a vulnerability being fixed.

Diff

diff --git a/cli/latest/reference/bedrock-agent-runtime/get-session.md b/cli/latest/reference/bedrock-agent-runtime/get-session.md
index 5832b4a8e..8e345868b 100644
--- a//cli/latest/reference/bedrock-agent-runtime/get-session.md
+++ b//cli/latest/reference/bedrock-agent-runtime/get-session.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.1 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.3 Command Reference](../../index.html) »
@@ -98 +98 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
->   * pattern: `^(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]+:[0-9]{12}:session/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})|([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$`
+>   * pattern: `(arn:aws(-[^:]+)?:bedrock:[a-z0-9-]+:[0-9]{12}:session/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})|([a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})`
@@ -201,5 +201 @@ Disable automatically prompt for CLI input parameters.
-createdAt -> (timestamp)
-
-> The timestamp for when the session was created.
-
-encryptionKeyArn -> (string)
+sessionId -> (string)
@@ -207 +203 @@ encryptionKeyArn -> (string)
-> The Amazon Resource Name (ARN) of the Key Management Service key used to encrypt the session data. For more information, see [Amazon Bedrock session encryption](https://docs.aws.amazon.com/bedrock/latest/userguide/session-encryption.html) .
+> The unique identifier for the session in UUID format.
@@ -211,3 +207 @@ encryptionKeyArn -> (string)
->   * min: `1`
->   * max: `2048`
->   * pattern: `^arn:aws(|-cn|-us-gov):kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}$`
+>   * pattern: `[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`
@@ -217,4 +210,0 @@ encryptionKeyArn -> (string)
-lastUpdatedAt -> (timestamp)
-
-> The timestamp for when the session was last modified.
-
@@ -227 +217 @@ sessionArn -> (string)
->   * pattern: `^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]+:[0-9]{12}:session/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$`
+>   * pattern: `arn:aws(-[^:]+)?:bedrock:[a-z0-9-]+:[0-9]{12}:session/[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`
@@ -231 +221 @@ sessionArn -> (string)
-sessionId -> (string)
+sessionStatus -> (string)
@@ -233 +223 @@ sessionId -> (string)
-> The unique identifier for the session in UUID format.
+> The current status of the session.
@@ -235 +225 @@ sessionId -> (string)
-> Constraints:
+> Possible values:
@@ -237 +227,3 @@ sessionId -> (string)
->   * pattern: `^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$`
+>   * `ACTIVE`
+>   * `EXPIRED`
+>   * `ENDED`
@@ -240,0 +233,8 @@ sessionId -> (string)
+createdAt -> (timestamp)
+
+> The timestamp for when the session was created.
+
+lastUpdatedAt -> (timestamp)
+
+> The timestamp for when the session was last modified.
+
@@ -270 +270 @@ sessionMetadata -> (map)
-sessionStatus -> (string)
+encryptionKeyArn -> (string)
@@ -272 +272 @@ sessionStatus -> (string)
-> The current status of the session.
+> The Amazon Resource Name (ARN) of the Key Management Service key used to encrypt the session data. For more information, see [Amazon Bedrock session encryption](https://docs.aws.amazon.com/bedrock/latest/userguide/session-encryption.html) .
@@ -274 +274 @@ sessionStatus -> (string)
-> Possible values:
+> Constraints:
@@ -276,3 +276,3 @@ sessionStatus -> (string)
->   * `ACTIVE`
->   * `EXPIRED`
->   * `ENDED`
+>   * min: `1`
+>   * max: `2048`
+>   * pattern: `arn:aws(|-cn|-us-gov):kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}`
@@ -292 +292 @@ sessionStatus -> (string)
-  * [AWS CLI 2.31.1 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.3 Command Reference](../../index.html) »