AWS cli medium security documentation change

Service: cli · 2026-05-01 · Security-related medium

File: cli/latest/reference/bedrock-agentcore-control/create-memory.md

Summary

Added documentation for the new '--indexed-keys' parameter and 'memoryRecordSchema' structure with metadata field definitions, validation rules, and extraction configurations.

Security assessment

The change introduces strict validation rules (allowedValues, pattern constraints, min/max lengths) for metadata fields used in filtering, which helps prevent injection attacks and ensures data integrity. The pattern constraints specifically block special characters that could be used in injection payloads.

Diff

diff --git a/cli/latest/reference/bedrock-agentcore-control/create-memory.md b/cli/latest/reference/bedrock-agentcore-control/create-memory.md
index eaf9ee53c..74fec8a2b 100644
--- a//cli/latest/reference/bedrock-agentcore-control/create-memory.md
+++ b//cli/latest/reference/bedrock-agentcore-control/create-memory.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.38 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.40 Command Reference](../../index.html) »
@@ -73,0 +74 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
+    [--indexed-keys <value>]
@@ -241,0 +243,158 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
+>>> 
+>>> memoryRecordSchema -> (structure)
+>>>
+>>>> Schema for metadata on memory records generated by a strategy.
+>>>> 
+>>>> metadataSchema -> (list)
+>>>>
+>>>>> The metadata field definitions for this strategy.
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `1`
+>>>>>   * max: `20`
+>>>>> 
+
+>>>>> 
+>>>>> (structure)
+>>>>>
+>>>>>> A metadata field definition within a strategy’s schema.
+>>>>>> 
+>>>>>> key -> (string) [required]
+>>>>>>
+>>>>>>> The metadata field name. Must match an indexed key to be queryable via metadata filters.
+>>>>>>> 
+>>>>>>> Constraints:
+>>>>>>> 
+>>>>>>>   * min: `1`
+>>>>>>>   * max: `128`
+>>>>>>>   * pattern: `[a-zA-Z0-9\s._:/=+@-]*`
+>>>>>>> 
+
+>>>>>> 
+>>>>>> type -> (string)
+>>>>>>
+>>>>>>> The MetadataValueType.
+>>>>>>> 
+>>>>>>> Possible values:
+>>>>>>> 
+>>>>>>>   * `STRING`
+>>>>>>>   * `STRINGLIST`
+>>>>>>>   * `NUMBER`
+>>>>>>> 
+
+>>>>>> 
+>>>>>> extractionConfig -> (tagged union structure)
+>>>>>>
+>>>>>>> Configuration for extracting this metadata value from conversational content.
+>>>>>>> 
+>>>>>>> ### Note
+>>>>>>> 
+>>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `llmExtractionConfig`.
+>>>>>>> 
+>>>>>>> llmExtractionConfig -> (structure)
+>>>>>>>
+>>>>>>>> Model-based extraction using a definition and instructions.
+>>>>>>>> 
+>>>>>>>> llmExtractionInstruction -> (string)
+>>>>>>>>
+>>>>>>>>> Instructions for extraction. Supports built-in operators like LATEST_VALUE or custom natural-language instructions.
+>>>>>>>>> 
+>>>>>>>>> Constraints:
+>>>>>>>>> 
+>>>>>>>>>   * min: `1`
+>>>>>>>>>   * max: `1000`
+>>>>>>>>> 
+
+>>>>>>>> 
+>>>>>>>> definition -> (string) [required]
+>>>>>>>>
+>>>>>>>>> Description of what this metadata field represents.
+>>>>>>>>> 
+>>>>>>>>> Constraints:
+>>>>>>>>> 
+>>>>>>>>>   * min: `1`
+>>>>>>>>>   * max: `1000`
+>>>>>>>>> 
+
+>>>>>>>> 
+>>>>>>>> validation -> (tagged union structure)
+>>>>>>>>
+>>>>>>>>> Validation rules to constrain extracted values.
+>>>>>>>>> 
+>>>>>>>>> ### Note
+>>>>>>>>> 
+>>>>>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `stringValidation`, `stringListValidation`, `numberValidation`.
+>>>>>>>>> 
+>>>>>>>>> stringValidation -> (structure)
+>>>>>>>>>
+>>>>>>>>>> Validation for STRING fields.
+>>>>>>>>>> 
+>>>>>>>>>> allowedValues -> (list) [required]
+>>>>>>>>>>
+>>>>>>>>>>> Allowed values for this STRING field.
+>>>>>>>>>>> 
+>>>>>>>>>>> Constraints:
+>>>>>>>>>>> 
+>>>>>>>>>>>   * min: `1`
+>>>>>>>>>>>   * max: `10`
+>>>>>>>>>>> 
+
+>>>>>>>>>>> 
+>>>>>>>>>>> (string)
+>>>>>>>>>>>
+>>>>>>>>>>>> Constraints:
+>>>>>>>>>>>> 
+>>>>>>>>>>>>   * min: `1`
+>>>>>>>>>>>>   * max: `256`
+>>>>>>>>>>>>   * pattern: `[a-zA-Z0-9\s._:/=+@-]*`
+>>>>>>>>>>>> 
+
+>>>>>>>>> 
+>>>>>>>>> stringListValidation -> (structure)
+>>>>>>>>>
+>>>>>>>>>> Validation for STRINGLIST fields.
+>>>>>>>>>> 
+>>>>>>>>>> allowedValues -> (list)
+>>>>>>>>>>
+>>>>>>>>>>> Allowed values for items in this STRINGLIST field.
+>>>>>>>>>>> 
+>>>>>>>>>>> Constraints:
+>>>>>>>>>>> 
+>>>>>>>>>>>   * min: `1`
+>>>>>>>>>>>   * max: `10`
+>>>>>>>>>>> 
+
+>>>>>>>>>>> 
+>>>>>>>>>>> (string)
+>>>>>>>>>>>
+>>>>>>>>>>>> Constraints:
+>>>>>>>>>>>> 
+>>>>>>>>>>>>   * min: `1`
+>>>>>>>>>>>>   * max: `64`
+>>>>>>>>>>>>   * pattern: `[a-zA-Z0-9\s._:/=+@-]*`
+>>>>>>>>>>>> 
+
+>>>>>>>>>> 
+>>>>>>>>>> maxItems -> (integer)
+>>>>>>>>>>
+>>>>>>>>>>> Maximum number of items in the string list.
+>>>>>>>>>>> 
+>>>>>>>>>>> Constraints:
+>>>>>>>>>>> 
+>>>>>>>>>>>   * min: `1`
+>>>>>>>>>>>   * max: `5`
+>>>>>>>>>>> 
+
+>>>>>>>>> 
+>>>>>>>>> numberValidation -> (structure)
+>>>>>>>>>
+>>>>>>>>>> Validation for NUMBER fields.
+>>>>>>>>>> 
+>>>>>>>>>> minValue -> (double)
+>>>>>>>>>>
+>>>>>>>>>>> Minimum allowed value.
+>>>>>>>>>> 
+>>>>>>>>>> maxValue -> (double)
+>>>>>>>>>>
+>>>>>>>>>>> Maximum allowed value.
@@ -308,0 +468,158 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
+>>> 
+>>> memoryRecordSchema -> (structure)
+>>>
+>>>> Schema for metadata fields on records generated by this strategy.
+>>>> 
+>>>> metadataSchema -> (list)
+>>>>
+>>>>> The metadata field definitions for this strategy.
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `1`
+>>>>>   * max: `20`
+>>>>> 
+
+>>>>> 
+>>>>> (structure)
+>>>>>
+>>>>>> A metadata field definition within a strategy’s schema.
+>>>>>> 
+>>>>>> key -> (string) [required]
+>>>>>>
+>>>>>>> The metadata field name. Must match an indexed key to be queryable via metadata filters.
+>>>>>>> 
+>>>>>>> Constraints:
+>>>>>>> 
+>>>>>>>   * min: `1`
+>>>>>>>   * max: `128`
+>>>>>>>   * pattern: `[a-zA-Z0-9\s._:/=+@-]*`
+>>>>>>> 
+