AWS cli documentation change
Summary
Updated AWS CLI version reference from 2.34.34 to 2.34.37, modified gatewayArn pattern, and added extensive documentation for privateEndpoint and privateEndpointOverrides configuration in the authorizerConfiguration, enabling secure connectivity to private resources via VPC Lattice.
Security assessment
The change primarily adds documentation for new private endpoint configuration options (selfManagedLatticeResource and managedVpcResource) that enable secure connectivity to private resources through VPC Lattice. This includes security-related configurations like securityGroupIds, subnet restrictions, and domain overrides for JWT authorizers. While this enhances security documentation for private connectivity features, there is no evidence in the diff that this addresses a specific security vulnerability or incident.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore-control/get-gateway.md b/cli/latest/reference/bedrock-agentcore-control/get-gateway.md index bdfbf5878..4a0c7054c 100644 --- a//cli/latest/reference/bedrock-agentcore-control/get-gateway.md +++ b//cli/latest/reference/bedrock-agentcore-control/get-gateway.md @@ -15 +15 @@ - * [AWS CLI 2.34.34 Command Reference](../../index.html) » + * [AWS CLI 2.34.37 Command Reference](../../index.html) » @@ -222 +222 @@ gatewayArn -> (string) -> * pattern: `arn:aws(|-cn|-us-gov):bedrock-agentcore:[a-z0-9-]{1,20}:[0-9]{12}:gateway/[0-9a-zA-Z]{10}` +> * pattern: `arn:aws(|-cn|-us-gov):bedrock-agentcore:[a-z0-9-]{1,20}:[0-9]{12}:gateway/([0-9a-z][-]?){1,48}-[a-z0-9]{10}` @@ -546,0 +547,278 @@ authorizerConfiguration -> (tagged union structure) +>> +>> privateEndpoint -> (tagged union structure) +>> +>>> The private endpoint configuration for a gateway target. Defines how the gateway connects to private resources in your VPC. +>>> +>>> ### Note +>>> +>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `selfManagedLatticeResource`, `managedVpcResource`. +>>> +>>> selfManagedLatticeResource -> (tagged union structure) +>>> +>>>> Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration. +>>>> +>>>> ### Note +>>>> +>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `resourceConfigurationIdentifier`. +>>>> +>>>> resourceConfigurationIdentifier -> (string) +>>>> +>>>>> The ARN or ID of the VPC Lattice resource configuration. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `20` +>>>>> * max: `2048` +>>>>> * pattern: `((rcfg-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:resourceconfiguration/rcfg-[0-9a-z]{17}))` +>>>>> + +>>> +>>> managedVpcResource -> (structure) +>>> +>>>> Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf. +>>>> +>>>> vpcIdentifier -> (string) [required] +>>>> +>>>>> The ID of the VPC that contains your private resource. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * pattern: `vpc-(([0-9a-z]{8})|([0-9a-z]{17}))` +>>>>> + +>>>> +>>>> subnetIds -> (list) [required] +>>>> +>>>>> The subnet IDs within the VPC where the VPC Lattice resource gateway is placed. +>>>>> +>>>>> (string) +>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * pattern: `subnet-[0-9a-zA-Z]{8,17}` +>>>>>> + +>>>> +>>>> endpointIpAddressType -> (string) [required] +>>>> +>>>>> The IP address type for the resource configuration endpoint. +>>>>> +>>>>> Possible values: +>>>>> +>>>>> * `IPV4` +>>>>> * `IPV6` +>>>>> + +>>>> +>>>> securityGroupIds -> (list) +>>>> +>>>>> The security group IDs to associate with the VPC Lattice resource gateway. If not specified, the default security group for the VPC is used. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `0` +>>>>> * max: `5` +>>>>> + +>>>>> +>>>>> (string) +>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * pattern: `sg-(([0-9a-z]{8})|([0-9a-z]{17}))` +>>>>>> + +>>>> +>>>> tags -> (map) +>>>> +>>>>> Tags to apply to the managed VPC Lattice resource gateway. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `0` +>>>>> * max: `50` +>>>>> + +>>>>> +>>>>> key -> (string) +>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `1` +>>>>>> * max: `128` +>>>>>> * pattern: `[a-zA-Z0-9\s._:/=+@-]*` +>>>>>> + +>>>>> +>>>>> value -> (string) +>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `0` +>>>>>> * max: `256` +>>>>>> * pattern: `[a-zA-Z0-9\s._:/=+@-]*` +>>>>>> + +>>>> +>>>> routingDomain -> (string) +>>>> +>>>>> An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint. Required when your private endpoint uses a domain that is not publicly resolvable. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `3` +>>>>> * max: `255` +>>>>> + +>> +>> privateEndpointOverrides -> (list) +>> +>>> A list of private endpoint overrides for the JWT authorizer. Each override maps a specific domain to a private endpoint, enabling secure connectivity through VPC Lattice resource configurations. +>>> +>>> Constraints: +>>> +>>> * min: `0` +>>> * max: `5` +>>> + +>>> +>>> (structure) +>>> +>>>> A mapping of a specific domain to a private endpoint for secure connectivity through a VPC Lattice resource configuration. +>>>> +>>>> domain -> (string) [required] +>>>> +>>>>> The domain to override with a private endpoint. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `253` +>>>>> + +>>>> +>>>> privateEndpoint -> (tagged union structure) [required] +>>>> +>>>>> The private endpoint configuration for the specified domain. +>>>>> +>>>>> ### Note +>>>>> +>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `selfManagedLatticeResource`, `managedVpcResource`. +>>>>> +>>>>> selfManagedLatticeResource -> (tagged union structure) +>>>>> +>>>>>> Configuration for connecting to a private resource using a self-managed VPC Lattice resource configuration. +>>>>>> +>>>>>> ### Note +>>>>>> +>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `resourceConfigurationIdentifier`. +>>>>>> +>>>>>> resourceConfigurationIdentifier -> (string) +>>>>>> +>>>>>>> The ARN or ID of the VPC Lattice resource configuration. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `20` +>>>>>>> * max: `2048` +>>>>>>> * pattern: `((rcfg-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:resourceconfiguration/rcfg-[0-9a-z]{17}))` +>>>>>>> + +>>>>> +>>>>> managedVpcResource -> (structure) +>>>>> +>>>>>> Configuration for connecting to a private resource using a managed VPC Lattice resource. The gateway creates and manages the VPC Lattice resources on your behalf. +>>>>>> +>>>>>> vpcIdentifier -> (string) [required] +>>>>>> +>>>>>>> The ID of the VPC that contains your private resource. +>>>>>>>