AWS cli documentation change
Summary
Added new '--agent-access-config' option with settings for agent permissions, screenshot storage, and screen capture configuration
Security assessment
Adds documentation for granular agent permission controls (COMPUTER_VISION/COMPUTER_INPUT), screenshot storage configuration, and screen capture settings. This enhances security by enabling explicit control over agent capabilities and data handling, but doesn't address any specific vulnerability.
Diff
diff --git a/cli/latest/reference/appstream/create-stack.md b/cli/latest/reference/appstream/create-stack.md index bd659a687..1a0380fcc 100644 --- a//cli/latest/reference/appstream/create-stack.md +++ b//cli/latest/reference/appstream/create-stack.md @@ -15 +15 @@ - * [AWS CLI 2.34.40 Command Reference](../../index.html) » + * [AWS CLI 2.34.41 Command Reference](../../index.html) » @@ -79,0 +80 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/appstr + [--agent-access-config <value>] @@ -589,0 +591,99 @@ JSON Syntax: +`--agent-access-config` (structure) + +> The configuration for agent access on the stack. If specified, agent access is enabled for the stack. +> +> Settings -> (list) [required] +> +>> The list of agent access settings that define permissions for each agent action. You must specify at least one setting. +>> +>> Constraints: +>> +>> * min: `1` +>> + +>> +>> (structure) +>> +>>> A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled. +>>> +>>> AgentAction -> (string) [required] +>>> +>>>> The agent action to configure. Valid values are COMPUTER_VISION and COMPUTER_INPUT. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION. +>>>> +>>>> Possible values: +>>>> +>>>> * `COMPUTER_VISION` +>>>> * `COMPUTER_INPUT` +>>>> + +>>> +>>> Permission -> (string) [required] +>>> +>>>> Whether the agent action is enabled or disabled. +>>>> +>>>> Possible values: +>>>> +>>>> * `ENABLED` +>>>> * `DISABLED` +>>>> + +> +> S3BucketArn -> (string) +> +>> The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. Required when ScreenshotsUploadEnabled is true. +>> +>> Constraints: +>> +>> * pattern: `^arn:aws(?:\-cn|\-iso\-b|\-iso|\-us\-gov)?:s3:::[a-z0-9][a-z0-9.\-]{1,61}[a-z0-9]$` +>> + +> +> ScreenshotsUploadEnabled -> (boolean) +> +>> Indicates whether screenshot uploads to Amazon S3 are enabled for agent sessions. +> +> ScreenResolution -> (string) [required] +> +>> The screen resolution for the agent streaming environment. +>> +>> Possible values: +>> +>> * `W_1280xH_720` +>> + +> +> ScreenImageFormat -> (string) [required] +> +>> The image format for agent screen captures. +>> +>> Possible values: +>> +>> * `PNG` +>> * `JPEG` +>> + + +Shorthand Syntax: + + + Settings=[{AgentAction=string,Permission=string},{AgentAction=string,Permission=string}],S3BucketArn=string,ScreenshotsUploadEnabled=boolean,ScreenResolution=string,ScreenImageFormat=string + + +JSON Syntax: + + + { + "Settings": [ + { + "AgentAction": "COMPUTER_VISION"|"COMPUTER_INPUT", + "Permission": "ENABLED"|"DISABLED" + } + ... + ], + "S3BucketArn": "string", + "ScreenshotsUploadEnabled": true|false, + "ScreenResolution": "W_1280xH_720", + "ScreenImageFormat": "PNG"|"JPEG" + } + + @@ -1081,0 +1182,75 @@ Stack -> (structure) +> +> AgentAccessConfig -> (structure) +> +>> The agent access configuration of the stack, if agent access is enabled. +>> +>> Settings -> (list) [required] +>> +>>> The list of agent access settings that define permissions for each agent action. You must specify at least one setting. +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> + +>>> +>>> (structure) +>>> +>>>> A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled. +>>>> +>>>> AgentAction -> (string) [required] +>>>> +>>>>> The agent action to configure. Valid values are COMPUTER_VISION and COMPUTER_INPUT. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION. +>>>>> +>>>>> Possible values: +>>>>> +>>>>> * `COMPUTER_VISION` +>>>>> * `COMPUTER_INPUT` +>>>>> + +>>>> +>>>> Permission -> (string) [required] +>>>> +>>>>> Whether the agent action is enabled or disabled. +>>>>> +>>>>> Possible values: +>>>>> +>>>>> * `ENABLED` +>>>>> * `DISABLED` +>>>>> + +>> +>> S3BucketArn -> (string) +>> +>>> The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. Required when ScreenshotsUploadEnabled is true. +>>> +>>> Constraints: +>>> +>>> * pattern: `^arn:aws(?:\-cn|\-iso\-b|\-iso|\-us\-gov)?:s3:::[a-z0-9][a-z0-9.\-]{1,61}[a-z0-9]$` +>>> + +>> +>> ScreenshotsUploadEnabled -> (boolean) +>> +>>> Indicates whether screenshot uploads to Amazon S3 are enabled for agent sessions. +>> +>> ScreenResolution -> (string) [required] +>> +>>> The screen resolution for the agent streaming environment. +>>> +>>> Possible values: +>>> +>>> * `W_1280xH_720` +>>> + +>> +>> ScreenImageFormat -> (string) [required] +>> +>>> The image format for agent screen captures. +>>> +>>> Possible values: +>>> +>>> * `PNG` +>>> * `JPEG` +>>> + @@ -1093 +1268 @@ Stack -> (structure) - * [AWS CLI 2.34.40 Command Reference](../../index.html) » + * [AWS CLI 2.34.41 Command Reference](../../index.html) »