AWS cli medium security documentation change

Service: cli · 2025-10-10 · Security-related medium

File: cli/latest/reference/bedrock-agentcore-control/get-agent-runtime.md

Summary

Restructured documentation with added lifecycle configuration details, moved workload identity/artifact sections, and updated CLI version reference

Security assessment

Added lifecycleConfiguration with idle session timeout (15m default) and max instance lifetime (8h default) helps prevent long-running insecure sessions. The workloadIdentityDetails and container URI pattern enforcement (ECR format validation) improve identity management and artifact security. These changes directly implement security controls for session duration and resource validation.

Diff

diff --git a/cli/latest/reference/bedrock-agentcore-control/get-agent-runtime.md b/cli/latest/reference/bedrock-agentcore-control/get-agent-runtime.md
index d0c09d3cf..55b4052cd 100644
--- a//cli/latest/reference/bedrock-agentcore-control/get-agent-runtime.md
+++ b//cli/latest/reference/bedrock-agentcore-control/get-agent-runtime.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.8 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.10 Command Reference](../../index.html) »
@@ -224,15 +223,0 @@ agentRuntimeArn -> (string)
-workloadIdentityDetails -> (structure)
-
-> The workload identity details for the AgentCore Runtime.
-> 
-> workloadIdentityArn -> (string) [required]
->
->> The ARN associated with the workload identity.
->> 
->> Constraints:
->> 
->>   * min: `1`
->>   * max: `1024`
->> 
-
-
@@ -249,11 +233,0 @@ agentRuntimeName -> (string)
-description -> (string)
-
-> The description of the AgentCore Runtime.
-> 
-> Constraints:
-> 
->   * min: `1`
->   * max: `4096`
-> 
-
-
@@ -302,24 +275,0 @@ roleArn -> (string)
-agentRuntimeArtifact -> (tagged union structure)
-
-> The artifact of the AgentCore Runtime.
-> 
-> ### Note
-> 
-> This is a Tagged Union structure. Only one of the following top level keys can be set: `containerConfiguration`.
-> 
-> containerConfiguration -> (structure)
->
->> The container configuration for the agent artifact.
->> 
->> containerUri -> (string) [required]
->>
->>> The ECR URI of the container.
->>> 
->>> Constraints:
->>> 
->>>   * min: `1`
->>>   * max: `1024`
->>>   * pattern: `([0-9]{12})\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com/((?:[a-z0-9]+(?:[._-][a-z0-9]+)*/)*[a-z0-9]+(?:[._-][a-z0-9]+)*)(?::([^:@]{1,300}))?(?:@(.+))?`
->>> 
-
-
@@ -382,0 +333,91 @@ networkConfiguration -> (structure)
+status -> (string)
+
+> The current status of the AgentCore Runtime.
+> 
+> Possible values:
+> 
+>   * `CREATING`
+>   * `CREATE_FAILED`
+>   * `UPDATING`
+>   * `UPDATE_FAILED`
+>   * `READY`
+>   * `DELETING`
+> 
+
+
+lifecycleConfiguration -> (structure)
+
+> The life cycle configuration for the AgentCore Runtime.
+> 
+> idleRuntimeSessionTimeout -> (integer)
+>
+>> Timeout in seconds for idle runtime sessions. When a session remains idle for this duration, it will be automatically terminated. Default: 900 seconds (15 minutes).
+>> 
+>> Constraints:
+>> 
+>>   * min: `60`
+>>   * max: `28800`
+>> 
+
+> 
+> maxLifetime -> (integer)
+>
+>> Maximum lifetime for the instance in seconds. Once reached, instances will be automatically terminated and replaced. Default: 28800 seconds (8 hours).
+>> 
+>> Constraints:
+>> 
+>>   * min: `60`
+>>   * max: `28800`
+>> 
+
+
+description -> (string)
+
+> The description of the AgentCore Runtime.
+> 
+> Constraints:
+> 
+>   * min: `1`
+>   * max: `4096`
+> 
+
+
+workloadIdentityDetails -> (structure)
+
+> The workload identity details for the AgentCore Runtime.
+> 
+> workloadIdentityArn -> (string) [required]
+>
+>> The ARN associated with the workload identity.
+>> 
+>> Constraints:
+>> 
+>>   * min: `1`
+>>   * max: `1024`
+>> 
+
+
+agentRuntimeArtifact -> (tagged union structure)
+
+> The artifact of the AgentCore Runtime.
+> 
+> ### Note
+> 
+> This is a Tagged Union structure. Only one of the following top level keys can be set: `containerConfiguration`.
+> 
+> containerConfiguration -> (structure)
+>
+>> The container configuration for the agent artifact.
+>> 
+>> containerUri -> (string) [required]
+>>
+>>> The ECR URI of the container.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `1`
+>>>   * max: `1024`
+>>>   * pattern: `([0-9]{12})\.dkr\.ecr\.([a-z0-9-]+)\.amazonaws\.com/((?:[a-z0-9]+(?:[._-][a-z0-9]+)*/)*[a-z0-9]+(?:[._-][a-z0-9]+)*)(?::([^:@]{1,300}))?(?:@(.+))?`
+>>> 
+
+
@@ -394,0 +436 @@ protocolConfiguration -> (structure)
+>>   * `A2A`
@@ -502,15 +543,0 @@ requestHeaderConfiguration -> (tagged union structure)
-status -> (string)
-
-> The current status of the AgentCore Runtime.
-> 
-> Possible values:
-> 
->   * `CREATING`
->   * `CREATE_FAILED`
->   * `UPDATING`
->   * `UPDATE_FAILED`
->   * `READY`
->   * `DELETING`
-> 
-
-
@@ -527 +554 @@ status -> (string)
-  * [AWS CLI 2.31.8 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.10 Command Reference](../../index.html) »