AWS cli high security documentation change
Summary
Added documentation for the new '--agent-access-config' parameter and 'AgentAccessConfig' stack attribute to configure agent permissions and session settings
Security assessment
This change introduces security controls for agent actions including COMPUTER_VISION and COMPUTER_INPUT, with explicit permission settings (ENABLED/DISABLED). It adds security-sensitive configurations for screenshot storage in S3, screen capture formats, and session resolution. The documentation explicitly states security implications: 'If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION' and includes IAM pattern constraints.
Diff
diff --git a/cli/latest/reference/appstream/update-stack.md b/cli/latest/reference/appstream/update-stack.md index 0ad2b1503..f4da6d206 100644 --- a//cli/latest/reference/appstream/update-stack.md +++ b//cli/latest/reference/appstream/update-stack.md @@ -15 +15 @@ - * [AWS CLI 2.34.40 Command Reference](../../index.html) » + * [AWS CLI 2.34.41 Command Reference](../../index.html) » @@ -80,0 +81 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/appstr + [--agent-access-config <value>] @@ -258,0 +260,18 @@ JSON Syntax: +>> The stack attributes to delete. +>> +>> * STORAGE_CONNECTORS +>> * STORAGE_CONNECTOR_HOMEFOLDERS +>> * STORAGE_CONNECTOR_GOOGLE_DRIVE +>> * STORAGE_CONNECTOR_ONE_DRIVE +>> * REDIRECT_URL +>> * FEEDBACK_URL +>> * THEME_NAME +>> * USER_SETTINGS +>> * EMBED_HOST_DOMAINS +>> * IAM_ROLE_ARN +>> * ACCESS_ENDPOINTS +>> * STREAMING_EXPERIENCE_SETTINGS +>> * AGENT_ACCESS_CONFIG +>> + +>> @@ -273,0 +293 @@ JSON Syntax: +>> * `AGENT_ACCESS_CONFIG` @@ -572,0 +593,99 @@ JSON Syntax: +`--agent-access-config` (structure) + +> The configuration for agent access on the stack. Specify this to update agent access settings. To remove agent access, use AttributesToDelete with the AGENT_ACCESS_CONFIG value. +> +> Settings -> (list) +> +>> The list of agent access settings that define permissions for each agent action. +>> +>> Constraints: +>> +>> * min: `1` +>> + +>> +>> (structure) +>> +>>> A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled. +>>> +>>> AgentAction -> (string) [required] +>>> +>>>> The agent action to configure. Valid values are COMPUTER_VISION and COMPUTER_INPUT. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION. +>>>> +>>>> Possible values: +>>>> +>>>> * `COMPUTER_VISION` +>>>> * `COMPUTER_INPUT` +>>>> + +>>> +>>> Permission -> (string) [required] +>>> +>>>> Whether the agent action is enabled or disabled. +>>>> +>>>> Possible values: +>>>> +>>>> * `ENABLED` +>>>> * `DISABLED` +>>>> + +> +> S3BucketArn -> (string) +> +>> The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. +>> +>> Constraints: +>> +>> * pattern: `^arn:aws(?:\-cn|\-iso\-b|\-iso|\-us\-gov)?:s3:::[a-z0-9][a-z0-9.\-]{1,61}[a-z0-9]$` +>> + +> +> ScreenshotsUploadEnabled -> (boolean) +> +>> Indicates whether screenshot uploads to Amazon S3 are enabled for agent sessions. +> +> ScreenResolution -> (string) +> +>> The screen resolution for the agent streaming environment. +>> +>> Possible values: +>> +>> * `W_1280xH_720` +>> + +> +> ScreenImageFormat -> (string) +> +>> The image format for agent screen captures. +>> +>> Possible values: +>> +>> * `PNG` +>> * `JPEG` +>> + + +Shorthand Syntax: + + + Settings=[{AgentAction=string,Permission=string},{AgentAction=string,Permission=string}],S3BucketArn=string,ScreenshotsUploadEnabled=boolean,ScreenResolution=string,ScreenImageFormat=string + + +JSON Syntax: + + + { + "Settings": [ + { + "AgentAction": "COMPUTER_VISION"|"COMPUTER_INPUT", + "Permission": "ENABLED"|"DISABLED" + } + ... + ], + "S3BucketArn": "string", + "ScreenshotsUploadEnabled": true|false, + "ScreenResolution": "W_1280xH_720", + "ScreenImageFormat": "PNG"|"JPEG" + } + + @@ -1064,0 +1184,75 @@ Stack -> (structure) +> +> AgentAccessConfig -> (structure) +> +>> The agent access configuration of the stack, if agent access is enabled. +>> +>> Settings -> (list) [required] +>> +>>> The list of agent access settings that define permissions for each agent action. You must specify at least one setting. +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> + +>>> +>>> (structure) +>>> +>>>> A permission setting for an agent action. Each setting specifies an agent action and whether it is enabled or disabled. +>>>> +>>>> AgentAction -> (string) [required] +>>>> +>>>>> The agent action to configure. Valid values are COMPUTER_VISION and COMPUTER_INPUT. If you enable COMPUTER_INPUT, you must also enable COMPUTER_VISION. +>>>>> +>>>>> Possible values: +>>>>> +>>>>> * `COMPUTER_VISION` +>>>>> * `COMPUTER_INPUT` +>>>>> + +>>>> +>>>> Permission -> (string) [required] +>>>> +>>>>> Whether the agent action is enabled or disabled. +>>>>> +>>>>> Possible values: +>>>>> +>>>>> * `ENABLED` +>>>>> * `DISABLED` +>>>>> + +>> +>> S3BucketArn -> (string) +>> +>>> The Amazon Resource Name (ARN) of the Amazon S3 bucket where agent screenshots are stored. Required when ScreenshotsUploadEnabled is true. +>>> +>>> Constraints: +>>> +>>> * pattern: `^arn:aws(?:\-cn|\-iso\-b|\-iso|\-us\-gov)?:s3:::[a-z0-9][a-z0-9.\-]{1,61}[a-z0-9]$` +>>> + +>> +>> ScreenshotsUploadEnabled -> (boolean) +>> +>>> Indicates whether screenshot uploads to Amazon S3 are enabled for agent sessions. +>> +>> ScreenResolution -> (string) [required] +>> +>>> The screen resolution for the agent streaming environment. +>>> +>>> Possible values: +>>> +>>> * `W_1280xH_720` +>>> + +>> +>> ScreenImageFormat -> (string) [required] +>> +>>> The image format for agent screen captures. +>>>