AWS cli medium security documentation change
Summary
Added session timeout and response streaming configurations for MCP gateways, updated intermediate domain descriptions for VPC routing, and incremented CLI version reference.
Security assessment
The change introduces a mandatory session timeout configuration (900-28800 seconds) that terminates inactive sessions, preventing persistent unauthorized access. It also adds guidance for routing traffic through intermediate security components like VPC endpoints, which enforces network isolation. These directly mitigate session hijacking and network exposure risks.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore-control/create-gateway.md b/cli/latest/reference/bedrock-agentcore-control/create-gateway.md index 0b4b524f4..53afe334a 100644 --- a//cli/latest/reference/bedrock-agentcore-control/create-gateway.md +++ b//cli/latest/reference/bedrock-agentcore-control/create-gateway.md @@ -15 +15 @@ - * [AWS CLI 2.34.41 Command Reference](../../index.html) » + * [AWS CLI 2.34.44 Command Reference](../../index.html) » @@ -199,0 +200,23 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>> +>> sessionConfiguration -> (structure) +>> +>>> The session configuration for the MCP gateway. This configuration controls session behavior, including session timeout settings. +>>> +>>> sessionTimeoutInSeconds -> (integer) +>>> +>>>> The session timeout in seconds. After this timeout, the session expires and subsequent requests to this session will receive an error. The minimum value is 900 seconds (15 minutes), the maximum value is 28800 seconds (8 hours), and the default value is 3600 seconds (1 hour). +>>>> +>>>> Constraints: +>>>> +>>>> * min: `900` +>>>> * max: `28800` +>>>> + +>> +>> streamingConfiguration -> (structure) +>> +>>> The streaming configuration for the MCP gateway. This configuration controls whether response streaming is enabled for the gateway. +>>> +>>> enableResponseStreaming -> (boolean) +>>> +>>>> Indicates whether response streaming is enabled for the gateway. When set to `true` , the gateway streams responses from targets back to the client. @@ -204 +227 @@ Shorthand Syntax: - mcp={supportedVersions=[string,string],instructions=string,searchType=string} + mcp={supportedVersions=[string,string],instructions=string,searchType=string,sessionConfiguration={sessionTimeoutInSeconds=integer},streamingConfiguration={enableResponseStreaming=boolean}} @@ -214 +237,7 @@ JSON Syntax: - "searchType": "SEMANTIC" + "searchType": "SEMANTIC", + "sessionConfiguration": { + "sessionTimeoutInSeconds": integer + }, + "streamingConfiguration": { + "enableResponseStreaming": true|false + } @@ -519 +548 @@ JSON Syntax: ->>>>> An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint. Required when your private endpoint uses a domain that is not publicly resolvable. +>>>>> An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain]. @@ -671 +700 @@ JSON Syntax: ->>>>>>> An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint. Required when your private endpoint uses a domain that is not publicly resolvable. +>>>>>>> An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain]. @@ -1218,0 +1248,23 @@ protocolConfiguration -> (tagged union structure) +>> +>> sessionConfiguration -> (structure) +>> +>>> The session configuration for the MCP gateway. This configuration controls session behavior, including session timeout settings. +>>> +>>> sessionTimeoutInSeconds -> (integer) +>>> +>>>> The session timeout in seconds. After this timeout, the session expires and subsequent requests to this session will receive an error. The minimum value is 900 seconds (15 minutes), the maximum value is 28800 seconds (8 hours), and the default value is 3600 seconds (1 hour). +>>>> +>>>> Constraints: +>>>> +>>>> * min: `900` +>>>> * max: `28800` +>>>> + +>> +>> streamingConfiguration -> (structure) +>> +>>> The streaming configuration for the MCP gateway. This configuration controls whether response streaming is enabled for the gateway. +>>> +>>> enableResponseStreaming -> (boolean) +>>> +>>>> Indicates whether response streaming is enabled for the gateway. When set to `true` , the gateway streams responses from targets back to the client. @@ -1514 +1566 @@ authorizerConfiguration -> (tagged union structure) ->>>>> An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint. Required when your private endpoint uses a domain that is not publicly resolvable. +>>>>> An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain]. @@ -1666 +1718 @@ authorizerConfiguration -> (tagged union structure) ->>>>>>> An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint. Required when your private endpoint uses a domain that is not publicly resolvable. +>>>>>>> An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain]. @@ -1826 +1878 @@ exceptionLevel -> (string) - * [AWS CLI 2.34.41 Command Reference](../../index.html) » + * [AWS CLI 2.34.44 Command Reference](../../index.html) »