AWS cli documentation change
Summary
Added new --included-data parameter to control response data visibility and kmsKeyArn output field for encryption details. Updated navigation links and CLI version references.
Security assessment
The change adds documentation for a new parameter (--included-data) that controls sensitive data exposure in API responses, requiring explicit KMS permissions for full data access. It also documents encryption key ARN output. While this enhances security awareness, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore-control/get-evaluator.md b/cli/latest/reference/bedrock-agentcore-control/get-evaluator.md index 17d994263..592ffe94d 100644 --- a//cli/latest/reference/bedrock-agentcore-control/get-evaluator.md +++ b//cli/latest/reference/bedrock-agentcore-control/get-evaluator.md @@ -14,2 +14,2 @@ - * [previous](get-code-interpreter.html "get-code-interpreter") | - * [AWS CLI 2.34.38 Command Reference](../../index.html) » + * [previous](get-configuration-bundle-version.html "get-configuration-bundle-version") | + * [AWS CLI 2.34.40 Command Reference](../../index.html) » @@ -22 +22 @@ - * [← get-code-interpreter](get-code-interpreter.html "previous chapter \(use the left arrow\)") / + * [← get-configuration-bundle-version](get-configuration-bundle-version.html "previous chapter \(use the left arrow\)") / @@ -69,0 +70 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc + [--included-data <value>] @@ -104,0 +106,11 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +`--included-data` (string) + +> Controls which data is returned in the response. `ALL_DATA` (default) returns the full evaluator including decrypted instructions and rating scale. For evaluators encrypted with a customer managed KMS key, this requires `kms:Decrypt` permission on the key. `METADATA_ONLY` returns evaluator metadata and model configuration without instructions or rating scale, and does not require any KMS permissions. +> +> Possible values: +> +> * `ALL_DATA` +> * `METADATA_ONLY` +> + + @@ -486 +498,13 @@ lockedForModification -> (boolean) - * [← get-code-interpreter](get-code-interpreter.html "previous chapter \(use the left arrow\)") / +kmsKeyArn -> (string) + +> The Amazon Resource Name (ARN) of the customer managed KMS key used to encrypt the evaluator’s sensitive data. This field is only present for evaluators encrypted with a customer managed key. +> +> Constraints: +> +> * min: `1` +> * max: `2048` +> * pattern: `arn:aws(|-cn|-us-gov):kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}` +> + + + * [← get-configuration-bundle-version](get-configuration-bundle-version.html "previous chapter \(use the left arrow\)") / @@ -495,2 +519,2 @@ lockedForModification -> (boolean) - * [previous](get-code-interpreter.html "get-code-interpreter") | - * [AWS CLI 2.34.38 Command Reference](../../index.html) » + * [previous](get-configuration-bundle-version.html "get-configuration-bundle-version") | + * [AWS CLI 2.34.40 Command Reference](../../index.html) »