AWS cli documentation change
Summary
Added HTTP target configuration support including AgentCore Runtime integration, reordered MCP configuration fields, expanded credential provider types, and updated navigation links/version references.
Security assessment
The changes introduce new authentication methods (CALLER_IAM_CREDENTIALS, JWT_PASSTHROUGH) and grant types (TOKEN_EXCHANGE) which enhance security capabilities. However, there's no evidence of these changes addressing a specific vulnerability or security incident. The added documentation for credential providers qualifies as security feature documentation.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore-control/create-gateway-target.md b/cli/latest/reference/bedrock-agentcore-control/create-gateway-target.md index 80a04ef71..3e4597643 100644 --- a//cli/latest/reference/bedrock-agentcore-control/create-gateway-target.md +++ b//cli/latest/reference/bedrock-agentcore-control/create-gateway-target.md @@ -14,2 +14,2 @@ - * [previous](create-gateway.html "create-gateway") | - * [AWS CLI 2.34.38 Command Reference](../../index.html) » + * [previous](create-gateway-rule.html "create-gateway-rule") | + * [AWS CLI 2.34.40 Command Reference](../../index.html) » @@ -22 +22 @@ - * [← create-gateway](create-gateway.html "previous chapter \(use the left arrow\)") / + * [← create-gateway-rule](create-gateway-rule.html "previous chapter \(use the left arrow\)") / @@ -149 +149 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc -> This is a Tagged Union structure. Only one of the following top level keys can be set: `mcp`. +> This is a Tagged Union structure. Only one of the following top level keys can be set: `mcp`, `http`. @@ -563 +563 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> resourcePriority -> (integer) +>>> listingMode -> (string) @@ -565 +565 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>>> Priority for resolving MCP server targets with shared resource URIs. Lower values take precedence. Defaults to 1000 when not set. +>>>> The listing mode for the MCP server target configuration. MCP resources for default targets are cached at the control plane for faster access. MCP resources for dynamic targets will be dynamically retrieved when listing tools. @@ -567 +567 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>>> Constraints: +>>>> Possible values: @@ -569,2 +569,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>>> * min: `0` ->>>> * max: `1000` +>>>> * `DEFAULT` +>>>> * `DYNAMIC` @@ -574 +574 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> listingMode -> (string) +>>> resourcePriority -> (integer) @@ -576 +576 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>>> The listing mode for the MCP server target configuration. MCP resources for default targets are cached at the control plane for faster access. MCP resources for dynamic targets will be dynamically retrieved when listing tools. +>>>> Priority for resolving MCP server targets with shared resource URIs. Lower values take precedence. Defaults to 1000 when not set. @@ -578 +578 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>>> Possible values: +>>>> Constraints: @@ -580,2 +580,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>>> * `DEFAULT` ->>>> * `DYNAMIC` +>>>> * min: `0` +>>>> * max: `1000` @@ -665,0 +666,32 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +> +> http -> (tagged union structure) +> +>> The HTTP target configuration. Use this to route gateway requests to an HTTP-based endpoint such as an AgentCore Runtime. +>> +>> ### Note +>> +>> This is a Tagged Union structure. Only one of the following top level keys can be set: `agentcoreRuntime`. +>> +>> agentcoreRuntime -> (structure) +>> +>>> The AgentCore Runtime target configuration for HTTP-based communication with an agent runtime. +>>> +>>> arn -> (string) [required] +>>> +>>>> The Amazon Resource Name (ARN) of the AgentCore Runtime to route requests to. +>>>> +>>>> Constraints: +>>>> +>>>> * pattern: `arn:aws(-[^:]+)?:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:runtime/[a-zA-Z][a-zA-Z0-9_]{0,47}-[a-zA-Z0-9]{10}` +>>>> + +>>> +>>> qualifier -> (string) +>>> +>>>> The qualifier for the agent runtime, used to target a specific endpoint version. If not specified, the default endpoint is used. +>>>> +>>>> Constraints: +>>>> +>>>> * pattern: `.*([1-9][0-9]{0,4})|([a-zA-Z][a-zA-Z0-9_]{0,47}).*` +>>>> + @@ -755,2 +787,2 @@ JSON Syntax: - "resourcePriority": integer, - "listingMode": "DEFAULT"|"DYNAMIC" + "listingMode": "DEFAULT"|"DYNAMIC", + "resourcePriority": integer @@ -779,0 +812,6 @@ JSON Syntax: + }, + "http": { + "agentcoreRuntime": { + "arn": "string", + "qualifier": "string" + } @@ -807,0 +846,2 @@ JSON Syntax: +>>> * `CALLER_IAM_CREDENTIALS` +>>> * `JWT_PASSTHROUGH` @@ -894,0 +935 @@ JSON Syntax: +>>>>> * `TOKEN_EXCHANGE` @@ -990 +1031 @@ JSON Syntax: - "credentialProviderType": "GATEWAY_IAM_ROLE"|"OAUTH"|"API_KEY", + "credentialProviderType": "GATEWAY_IAM_ROLE"|"OAUTH"|"API_KEY"|"CALLER_IAM_CREDENTIALS"|"JWT_PASSTHROUGH", @@ -997 +1038 @@ JSON Syntax: - "grantType": "CLIENT_CREDENTIALS"|"AUTHORIZATION_CODE", + "grantType": "CLIENT_CREDENTIALS"|"AUTHORIZATION_CODE"|"TOKEN_EXCHANGE", @@ -1455 +1496 @@ targetConfiguration -> (tagged union structure) -> This is a Tagged Union structure. Only one of the following top level keys can be set: `mcp`. +> This is a Tagged Union structure. Only one of the following top level keys can be set: `mcp`, `http`. @@ -1869 +1910 @@ targetConfiguration -> (tagged union structure) ->>> resourcePriority -> (integer) +>>> listingMode -> (string) @@ -1871 +1912 @@ targetConfiguration -> (tagged union structure) ->>>> Priority for resolving MCP server targets with shared resource URIs. Lower values take precedence. Defaults to 1000 when not set. +>>>> The listing mode for the MCP server target configuration. MCP resources for default targets are cached at the control plane for faster access. MCP resources for dynamic targets will be dynamically retrieved when listing tools. @@ -1873 +1914 @@ targetConfiguration -> (tagged union structure) ->>>> Constraints: +>>>> Possible values: @@ -1875,2 +1916,2 @@ targetConfiguration -> (tagged union structure) ->>>> * min: `0` ->>>> * max: `1000` +>>>> * `DEFAULT` +>>>> * `DYNAMIC` @@ -1880 +1921 @@ targetConfiguration -> (tagged union structure) ->>> listingMode -> (string) +>>> resourcePriority -> (integer) @@ -1882 +1923 @@ targetConfiguration -> (tagged union structure) ->>>> The listing mode for the MCP server target configuration. MCP resources for default targets are cached at the control plane for faster access. MCP resources for dynamic targets will be dynamically retrieved when listing tools. +>>>> Priority for resolving MCP server targets with shared resource URIs. Lower values take precedence. Defaults to 1000 when not set. @@ -1884 +1925 @@ targetConfiguration -> (tagged union structure) ->>>> Possible values: +>>>> Constraints: @@ -1886,2 +1927,2 @@ targetConfiguration -> (tagged union structure) ->>>> * `DEFAULT` ->>>> * `DYNAMIC` +>>>> * min: `0` +>>>> * max: `1000` @@ -1971,0 +2013,32 @@ targetConfiguration -> (tagged union structure) +> +> http -> (tagged union structure) +> +>> The HTTP target configuration. Use this to route gateway requests to an HTTP-based endpoint such as an AgentCore Runtime. +>> +>> ### Note +>> +>> This is a Tagged Union structure. Only one of the following top level keys can be set: `agentcoreRuntime`. +>> +>> agentcoreRuntime -> (structure) +>> +>>> The AgentCore Runtime target configuration for HTTP-based communication with an agent runtime. +>>> +>>> arn -> (string) [required] +>>> +>>>> The Amazon Resource Name (ARN) of the AgentCore Runtime to route requests to. +>>>> +>>>> Constraints: +>>>> +>>>> * pattern: `arn:aws(-[^:]+)?:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:runtime/[a-zA-Z][a-zA-Z0-9_]{0,47}-[a-zA-Z0-9]{10}` +>>>> + +>>> +>>> qualifier -> (string) +>>> +>>>> The qualifier for the agent runtime, used to target a specific endpoint version. If not specified, the default endpoint is used. +>>>> +>>>> Constraints: +>>>> +>>>> * pattern: `.*([1-9][0-9]{0,4})|([a-zA-Z][a-zA-Z0-9_]{0,47}).*` +>>>> + @@ -1996,0 +2070,2 @@ credentialProviderConfigurations -> (list) +>>> * `CALLER_IAM_CREDENTIALS` +>>> * `JWT_PASSTHROUGH` @@ -2083,0 +2159 @@ credentialProviderConfigurations -> (list) +>>>>> * `TOKEN_EXCHANGE` @@ -2433 +2509,12 @@ authorizationData -> (tagged union structure) - * [← create-gateway](create-gateway.html "previous chapter \(use the left arrow\)") / +protocolType -> (string) + +> The protocol type of the created gateway target. +> +> Possible values: +> +> * `MCP` +> * `HTTP` +> + + + * [← create-gateway-rule](create-gateway-rule.html "previous chapter \(use the left arrow\)") / @@ -2442,2 +2529,2 @@ authorizationData -> (tagged union structure) - * [previous](create-gateway.html "create-gateway") | - * [AWS CLI 2.34.38 Command Reference](../../index.html) » + * [previous](create-gateway-rule.html "create-gateway-rule") | + * [AWS CLI 2.34.40 Command Reference](../../index.html) »