AWS cli medium security documentation change

Service: cli · 2026-01-22 · Security-related medium

File: cli/latest/reference/bedrock-agentcore/start-browser-session.md

Summary

Added --extensions parameter with security constraints for browser extension configuration

Security assessment

Introduces security controls for loading browser extensions via S3 with explicit constraints (bucket naming patterns, versionId validation). The documented constraints prevent arbitrary code execution by enforcing secure extension sourcing. This directly addresses potential supply chain security risks for browser extensions.

Diff

diff --git a/cli/latest/reference/bedrock-agentcore/start-browser-session.md b/cli/latest/reference/bedrock-agentcore/start-browser-session.md
index c9a0bf309..6a4d9b830 100644
--- a//cli/latest/reference/bedrock-agentcore/start-browser-session.md
+++ b//cli/latest/reference/bedrock-agentcore/start-browser-session.md
@@ -15 +15 @@
-  * [AWS CLI 2.33.2 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.4 Command Reference](../../index.html) »
@@ -82,0 +83 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
+    [--extensions <value>]
@@ -196,0 +198,84 @@ JSON Syntax:
+`--extensions` (list)
+
+> A list of browser extensions to load into the browser session.
+> 
+> Constraints:
+> 
+>   * min: `1`
+>   * max: `10`
+> 
+
+> 
+> (structure)
+>
+>> Browser extension configuration.
+>> 
+>> location -> (tagged union structure) [required]
+>>
+>>> The location where the browser extension files are stored. This specifies the source from which the extension will be loaded and installed.
+>>> 
+>>> ### Note
+>>> 
+>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `s3`.
+>>> 
+>>> s3 -> (structure)
+>>>
+>>>> The Amazon S3 location of the resource. Use this when the resource is stored in an Amazon S3 bucket.
+>>>> 
+>>>> bucket -> (string) [required]
+>>>>
+>>>>> The name of the Amazon S3 bucket where the resource is stored.
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `3`
+>>>>>   * max: `63`
+>>>>>   * pattern: `[a-z0-9][a-z0-9.-]*[a-z0-9]`
+>>>>> 
+
+>>>> 
+>>>> prefix -> (string) [required]
+>>>>
+>>>>> The name of the Amazon S3 prefix/key where the resource is stored.
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `1`
+>>>>>   * max: `1024`
+>>>>> 
+
+>>>> 
+>>>> versionId -> (string)
+>>>>
+>>>>> The name of the Amazon S3 version ID where the resource is stored (Optional).
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `1`
+>>>>>   * max: `1024`
+>>>>> 
+
+
+Shorthand Syntax:
+    
+    
+    location={s3={bucket=string,prefix=string,versionId=string}} ...
+    
+
+JSON Syntax:
+    
+    
+    [
+      {
+        "location": {
+          "s3": {
+            "bucket": "string",
+            "prefix": "string",
+            "versionId": "string"
+          }
+        }
+      }
+      ...
+    ]
+    
+
@@ -381 +466 @@ streams -> (structure)
-  * [AWS CLI 2.33.2 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.4 Command Reference](../../index.html) »