AWS marketplace documentation change
Summary
Updated documentation for creating SaaS AI agents/tools with restructured steps, added AI tool categories (MCP Server, Knowledge base, Guardrail), clarified authorization methods (API Keys/OAuth), and integration details with Amazon Bedrock AgentCore.
Security assessment
Changes primarily restructure workflow steps and add descriptive details about AI tool types. While authorization methods (OAuth/API keys) and guardrail concepts are mentioned, these are standard security practices being documented rather than addressing a specific vulnerability. No evidence of patching a security issue or introducing new security controls.
Diff
diff --git a/marketplace/latest/userguide/listing-saas-ai-agents.md b/marketplace/latest/userguide/listing-saas-ai-agents.md index 131e51e03..3ffcdd41b 100644 --- a//marketplace/latest/userguide/listing-saas-ai-agents.md +++ b//marketplace/latest/userguide/listing-saas-ai-agents.md @@ -57 +57 @@ Before beginning, ensure that you have the following: - 2. Choose **Create SaaS product** , and then choose **API-Based Agents & Tools**. + 2. In the navigation bar, select **Products** , then choose **AI agents and tools**. @@ -59 +59 @@ Before beginning, ensure that you have the following: - 3. Generate a SaaS product ID and code. You can also add optional tags to support tag-based authorization. + 3. From the **Create AI Agents & Tools product** menu, choose **API-based AI agents & tools**. @@ -63 +63,5 @@ Before beginning, ensure that you have the following: - 5. Choose **Generate product ID and code** , and then choose **Continue to wizard**. + 5. Choose **Generate product ID and product code**. + + 6. (Optional) Add tags to support tag-based authorization. + + 7. Choose **Continue to wizard**. @@ -113 +117 @@ The information you provide in this step communicates the value proposition of y - * **Redirect to your website** \- Customers will be redirected to your website to obtain API keys or OAuth token. + * **Redirect to your website** \- Customers will be redirected to your website to obtain API keys or OAuth tokens. @@ -119 +123 @@ You cannot change the fulfillment method after you publish the product. - 2. Enter the fulfillment URL - This is the URL where users sign in or create an account. + 2. Enter the fulfillment URL. This is the URL where users sign in or create an account. @@ -121 +125 @@ You cannot change the fulfillment method after you publish the product. - 3. Enter the endpoint URL - This is the URL where your API receives requests. + 3. Choose your AI agent or tool details: @@ -123 +127 @@ You cannot change the fulfillment method after you publish the product. - 4. Choose an authorization method: + * **AI Agent** \- Software that uses AI to process requests and completes tasks through reasoning and decision-making. @@ -125 +129 @@ You cannot change the fulfillment method after you publish the product. - * **API Keys** – Customers authenticate using API keys that you provide. + * **AI tools** : @@ -127 +131 @@ You cannot change the fulfillment method after you publish the product. - * **OAuth** – Customers authenticate using OAuth 2.0 authorization flow. If you choose OAuth, provide clear usage instructions for customers, including: + * **MCP Server** \- A server that manages communication and context exchange between AI models and applications. @@ -129 +133 @@ You cannot change the fulfillment method after you publish the product. - * OAuth authorization URL and token endpoint + * **Knowledge base** \- A structured collection of information that AI agents use to inform decision and responses. @@ -131 +135 @@ You cannot change the fulfillment method after you publish the product. - * Required scopes and permissions + * **Guardrail** \- Rules and controls that define boundaries for AI agent behavior and operations. @@ -133 +137 @@ You cannot change the fulfillment method after you publish the product. - * Step-by-step authentication flow instructions + * **Other** \- Additional tools that enhance AI agent capabilities. @@ -135 +139 @@ You cannot change the fulfillment method after you publish the product. - * Example API calls with proper authentication headers + 4. Enter the endpoint URL. This is the URL where your API receives requests. For MCP servers, list the MCP endpoint. @@ -137 +141 @@ You cannot change the fulfillment method after you publish the product. - * Troubleshooting common authentication issues + 5. Add usage instructions: @@ -139 +143 @@ You cannot change the fulfillment method after you publish the product. - 5. Choose your AI agent or tool details: + * Provide detailed instructions for buyers to use your API such as API schema, rate limits, and usage examples. @@ -141 +145 @@ You cannot change the fulfillment method after you publish the product. - * **AI Agent** \- Software that uses AI to process requests and completes tasks through reasoning and decision-making. + * You can also provide additional links to your documentation. @@ -143 +147 @@ You cannot change the fulfillment method after you publish the product. - * **AI tools** : + 6. Choose an authorization method: @@ -145 +149 @@ You cannot change the fulfillment method after you publish the product. - * **MCP Server** \- A server that manages communication and context exchange between AI models and applications. + * **API Keys** – Customers authenticate using API keys that you provide. @@ -147 +151 @@ You cannot change the fulfillment method after you publish the product. - * **Knowledge base** \- A structured collection of information that AI agents use to inform decision and responses. + * **OAuth** – Customers authenticate using OAuth 2.0 authorization flow. If you choose OAuth, provide clear usage instructions for customers, including: @@ -149 +153 @@ You cannot change the fulfillment method after you publish the product. - * **Guardrail** \- Rules and controls that define boundaries for AI agent behavior and operations. + * OAuth authorization URL and token endpoint @@ -151 +155 @@ You cannot change the fulfillment method after you publish the product. - * **Other** \- Additional tools that enhance AI agent capabilities. + * Required scopes and permissions @@ -153 +157 @@ You cannot change the fulfillment method after you publish the product. - 6. Add usage instructions: + * Step-by-step authentication flow instructions @@ -155 +159 @@ You cannot change the fulfillment method after you publish the product. - * Provide detailed instructions for buyers to use your API such as API schema, rate limits, and usage examples. + * Example API calls with proper authentication headers @@ -157 +161 @@ You cannot change the fulfillment method after you publish the product. - * You can also provide additional links to your documentation. + * Troubleshooting common authentication issues @@ -161 +165,3 @@ You cannot change the fulfillment method after you publish the product. - * You can enable integration with Amazon Bedrock AgentCore by providing OpenAPI spec. + * If you list an MCP server with OAuth authentication, you can enable integration with Amazon Bedrock AgentCore Gateway using your MCP server endpoint as the target. For more information, see [MCP servers targets](https://docs.aws.amazon.com/ bedrock-agentcore/latest/devguide/gateway-target-MCPservers.html). In this case, OpenAPI spec is not required. + + * If you list any other API-based product or MCP servers with API Key authentication, you can enable integration with Amazon Bedrock AgentCore by providing OpenAPI spec.