AWS cli documentation change
Summary
Updated CLI version references, increased session storage maximum limit from 1 to 5, added support for S3 Files and EFS access points in AgentCore Runtime, and updated VPC Lattice routing documentation with clearer explanations and references.
Security assessment
The changes primarily introduce new storage mounting capabilities (S3/EFS access points) with strict ARN/mount path constraints, which improves security by enforcing configuration boundaries. The VPC Lattice routing clarification helps prevent misconfigurations, but there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore-control/update-harness.md b/cli/latest/reference/bedrock-agentcore-control/update-harness.md index 0fbaad530..9e5fe0b7c 100644 --- a//cli/latest/reference/bedrock-agentcore-control/update-harness.md +++ b//cli/latest/reference/bedrock-agentcore-control/update-harness.md @@ -15 +15 @@ - * [AWS CLI 2.34.41 Command Reference](../../index.html) » + * [AWS CLI 2.34.44 Command Reference](../../index.html) » @@ -247 +247 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> * max: `1` +>>> * max: `5` @@ -257 +257 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionStorage`. +>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionStorage`, `s3FilesAccessPoint`, `efsAccessPoint`. @@ -273,0 +274,56 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>>>> +>>>> s3FilesAccessPoint -> (structure) +>>>> +>>>>> Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime. +>>>>> +>>>>> accessPointArn -> (string) [required] +>>>>> +>>>>>> The ARN of the S3 Files access point to mount into the AgentCore Runtime. +>>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `0` +>>>>>> * max: `256` +>>>>>> * pattern: `arn:aws[-a-z]*:s3files:[0-9a-z-:]+:file-system/fs-[0-9a-f]{17,40}/access-point/fsap-[0-9a-f]{17,40}` +>>>>>> + +>>>>> +>>>>> mountPath -> (string) [required] +>>>>> +>>>>>> The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under `/mnt` with exactly one subdirectory level (for example, `/mnt/data` ). +>>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `6` +>>>>>> * max: `200` +>>>>>> * pattern: `/mnt/[a-zA-Z0-9._-]+/?` +>>>>>> + +>>>> +>>>> efsAccessPoint -> (structure) +>>>> +>>>>> Configuration for an Amazon EFS access point to mount into the AgentCore Runtime. +>>>>> +>>>>> accessPointArn -> (string) [required] +>>>>> +>>>>>> The ARN of the EFS access point to mount into the AgentCore Runtime. +>>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `0` +>>>>>> * max: `128` +>>>>>> * pattern: `arn:aws[-a-z]*:elasticfilesystem:[0-9a-z-:]+:access-point/fsap-[0-9a-f]{8,40}` +>>>>>> + +>>>>> +>>>>> mountPath -> (string) [required] +>>>>> +>>>>>> The mount path for the EFS access point inside the AgentCore Runtime. The path must be under `/mnt` with exactly one subdirectory level (for example, `/mnt/data` ). +>>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `6` +>>>>>> * max: `200` +>>>>>> * pattern: `/mnt/[a-zA-Z0-9._-]+/?` +>>>>>> + @@ -294,0 +351,8 @@ JSON Syntax: + }, + "s3FilesAccessPoint": { + "accessPointArn": "string", + "mountPath": "string" + }, + "efsAccessPoint": { + "accessPointArn": "string", + "mountPath": "string" @@ -676 +740 @@ JSON Syntax: ->>>>>> An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint. Required when your private endpoint uses a domain that is not publicly resolvable. +>>>>>> An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain]. @@ -828 +892 @@ JSON Syntax: ->>>>>>>> An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint. Required when your private endpoint uses a domain that is not publicly resolvable. +>>>>>>>> An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain]. @@ -2472 +2536 @@ harness -> (structure) ->>>> * max: `1` +>>>> * max: `5` @@ -2482 +2546 @@ harness -> (structure) ->>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionStorage`. +>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionStorage`, `s3FilesAccessPoint`, `efsAccessPoint`. @@ -2498,0 +2563,56 @@ harness -> (structure) +>>>>> +>>>>> s3FilesAccessPoint -> (structure) +>>>>> +>>>>>> Configuration for an Amazon S3 Files access point to mount into the AgentCore Runtime. +>>>>>> +>>>>>> accessPointArn -> (string) [required] +>>>>>> +>>>>>>> The ARN of the S3 Files access point to mount into the AgentCore Runtime. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `0` +>>>>>>> * max: `256` +>>>>>>> * pattern: `arn:aws[-a-z]*:s3files:[0-9a-z-:]+:file-system/fs-[0-9a-f]{17,40}/access-point/fsap-[0-9a-f]{17,40}` +>>>>>>> + +>>>>>> +>>>>>> mountPath -> (string) [required] +>>>>>> +>>>>>>> The mount path for the S3 Files access point inside the AgentCore Runtime. The path must be under `/mnt` with exactly one subdirectory level (for example, `/mnt/data` ). +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `6` +>>>>>>> * max: `200` +>>>>>>> * pattern: `/mnt/[a-zA-Z0-9._-]+/?` +>>>>>>> + +>>>>> +>>>>> efsAccessPoint -> (structure) +>>>>> +>>>>>> Configuration for an Amazon EFS access point to mount into the AgentCore Runtime. +>>>>>> +>>>>>> accessPointArn -> (string) [required] +>>>>>> +>>>>>>> The ARN of the EFS access point to mount into the AgentCore Runtime. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `0` +>>>>>>> * max: `128` +>>>>>>> * pattern: `arn:aws[-a-z]*:elasticfilesystem:[0-9a-z-:]+:access-point/fsap-[0-9a-f]{8,40}` +>>>>>>> + +>>>>>> +>>>>>> mountPath -> (string) [required] +>>>>>> +>>>>>>> The mount path for the EFS access point inside the AgentCore Runtime. The path must be under `/mnt` with exactly one subdirectory level (for example, `/mnt/data` ). +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `6` +>>>>>>> * max: `200` +>>>>>>> * pattern: `/mnt/[a-zA-Z0-9._-]+/?` +>>>>>>> + @@ -2834 +2954 @@ harness -> (structure) ->>>>>> An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint. Required when your private endpoint uses a domain that is not publicly resolvable. +>>>>>> An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain]. @@ -2986 +3106 @@ harness -> (structure) ->>>>>>>> An intermediate publicly resolvable domain used as the VPC Lattice resource configuration endpoint. Required when your private endpoint uses a domain that is not publicly resolvable. +>>>>>>>> An intermediate domain to use as the resource configuration endpoint instead of the actual target domain. Use this when you want to route traffic through an intermediate component such as a VPC endpoint or internal load balancer. For more information, see xref:lattice-vpc-egress-routing-domain[Route traffic through an intermediate domain]. @@ -3073 +3193 @@ harness -> (structure) - * [AWS CLI 2.34.41 Command Reference](../../index.html) » + * [AWS CLI 2.34.44 Command Reference](../../index.html) »