AWS cli documentation change

Service: cli · 2026-03-13 · Documentation low

File: cli/latest/reference/s3api/create-session.md

Summary

Updated documentation for session mode behavior to clarify privilege escalation attempts and access denial conditions

Security assessment

The change clarifies session creation behavior when permissions are insufficient, but does not indicate a vulnerability fix. It improves documentation of security controls by explaining permission fallback logic.

Diff

diff --git a/cli/latest/reference/s3api/create-session.md b/cli/latest/reference/s3api/create-session.md
index 6a53c40d5..f91138605 100644
--- a//cli/latest/reference/s3api/create-session.md
+++ b//cli/latest/reference/s3api/create-session.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.8 Command Reference](../../index.html) »
@@ -144 +144 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/s3-200
-> Specifies the mode of the session that will be created, either `ReadWrite` or `ReadOnly` . By default, a `ReadWrite` session is created. A `ReadWrite` session is capable of executing all the Zonal endpoint API operations on a directory bucket. A `ReadOnly` session is constrained to execute the following Zonal endpoint API operations: `GetObject` , `HeadObject` , `ListObjectsV2` , `GetObjectAttributes` , `ListParts` , and `ListMultipartUploads` .
+> Specifies the mode of the session that will be created, either `ReadWrite` or `ReadOnly` . If no session mode is specified, the default behavior attempts to create a session with the maximum allowable privilege. It will first attempt to create a `ReadWrite` session, and if that is not allowed by permissions, it will attempt to create a `ReadOnly` session. If neither session type is allowed, the request will return an Access Denied error. A `ReadWrite` session is capable of executing all the Zonal endpoint API operations on a directory bucket. A `ReadOnly` session is constrained to execute the following Zonal endpoint API operations: `GetObject` , `HeadObject` , `ListObjectsV2` , `GetObjectAttributes` , `ListParts` , and `ListMultipartUploads` .
@@ -366 +366 @@ Credentials -> (structure)
-  * [AWS CLI 2.34.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.8 Command Reference](../../index.html) »