AWS cli high security documentation change
Summary
Updated MeterUsage documentation to clarify authentication requirements for different deployment types (EC2, EKS, ECS, Bedrock) and added detailed idempotency rules. Added specific credential requirements and differentiated handling between Bedrock and non-Bedrock environments.
Security assessment
The change explicitly prohibits insecure practices (long-term access keys, node roles) and mandates IAM roles for authentication. This addresses potential credential exposure risks by enforcing least-privilege access. Specific evidence includes warnings against long-term keys and node roles in EKS/ECS deployments.
Diff
diff --git a/cli/latest/reference/meteringmarketplace/meter-usage.md b/cli/latest/reference/meteringmarketplace/meter-usage.md index 2a1a79c47..faaaed6d2 100644 --- a//cli/latest/reference/meteringmarketplace/meter-usage.md +++ b//cli/latest/reference/meteringmarketplace/meter-usage.md @@ -15 +15 @@ - * [AWS CLI 2.33.4 Command Reference](../../index.html) » + * [AWS CLI 2.33.6 Command Reference](../../index.html) » @@ -59 +59 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -API to emit metering records. For identical requests, the API is idempotent and returns the metering record ID. This is used for metering flexible consumption pricing (FCP) Amazon Machine Images (AMI) and container products. +As a seller, your software hosted in the buyer’s Amazon Web Services account uses this API action to emit metering records directly to Amazon Web Services Marketplace. You must use the following buyer Amazon Web Services account credentials to sign the API request. @@ -61,3 +61,15 @@ API to emit metering records. For identical requests, the API is idempotent and -> `MeterUsage` is authenticated on the buyer’s Amazon Web Services account using credentials from the Amazon EC2 instance, Amazon ECS task, or Amazon EKS pod. -> -> `MeterUsage` can optionally include multiple usage allocations, to provide customers with usage data split into buckets by tags that you define (or allow the customer to define). + * For **Amazon EC2** deployments, your software must use the [IAM role for Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) to sign the API call for `MeterUsage` API operation. + * For **Amazon EKS** deployments, your software must use [IAM roles for service accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) to sign the API call for the `MeterUsage` API operation. Using [EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) , the node role, or long-term access keys is not supported. + * For **Amazon ECS** deployments, your software must use [Amazon ECS task IAM](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html) role to sign the API call for the `MeterUsage` API operation. Using the node role or long-term access keys are not supported. + * For **Amazon Bedrock AgentCore Runtime** deployments, your software must use the [AgentCore Runtime execution role](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/runtime-permissions.html#runtime-permissions-execution) to sign the API call for the `MeterUsage` API operation. Long-term access keys are not supported. + + + +The handling of `MeterUsage` requests varies between Amazon Bedrock AgentCore Runtime and non-Amazon Bedrock AgentCore deployments. + + * For **non-Amazon Bedrock AgentCore Runtime** deployments, you can only report usage once per hour for each dimension. For AMI-based products, this is per dimension and per EC2 instance. For container products, this is per dimension and per ECS task or EKS pod. You can’t modify values after they’re recorded. If you report usage before a current hour ends, you will be unable to report additional usage until the next hour begins. The `Timestamp` request parameter is rounded down to the hour and used to enforce this once-per-hour rule for idempotency. For requests that are identical after the `Timestamp` is rounded down, the API is idempotent and returns the metering record ID. + * For **Amazon Bedrock AgentCore Runtime** deployments, you can report usage multiple times per hour for the same dimension. You do not need to aggregate metering records by the hour. You must include an idempotency token in the `ClientToken` request parameter. If using an Amazon SDK or the Amazon Web Services CLI, you must use the latest version which automatically includes an idempotency token in the `ClientToken` request parameter so that the request is processed successfully. The `Timestamp` request parameter is not rounded down to the hour and is not used for duplicate validation. Requests with duplicate `Timestamps` are aggregated as long as the `ClientToken` is unique. + + + +If you submit records more than six hours after events occur, the records won’t be accepted. The timestamp in your request determines when an event is recorded. @@ -65 +77 @@ API to emit metering records. For identical requests, the API is idempotent and -Submit usage records to report events from the previous hour. If you submit records that are greater than six hours after events occur, the records won’t be accepted. The timestamp in your request determines when an event is recorded. You can only report usage once per hour for each dimension. For AMI-based products, this is per dimension and per EC2 instance. For container products, this is per dimension and per ECS task or EKS pod. You can’t modify values after they’re recorded. If you report usage before the current hour ends, you will be unable to report additional usage until the next hour begins. +You can optionally include multiple usage allocations, to provide customers with usage data split into buckets by tags that you define or allow the customer to define. @@ -370 +382 @@ MeteringRecordId -> (string) - * [AWS CLI 2.33.4 Command Reference](../../index.html) » + * [AWS CLI 2.33.6 Command Reference](../../index.html) »