AWS cli documentation change
Summary
Added new configuration parameter 'requireServiceS3Endpoint' for VPC network isolation control and new authorization method 'TOKEN_EXCHANGE'. Updated CLI version references.
Security assessment
The change introduces documentation for a new security feature ('requireServiceS3Endpoint') that controls VPC network isolation by allowing removal of service-managed S3 gateways. It explicitly warns about ensuring proper VPC configuration before disabling the gateway. The 'TOKEN_EXCHANGE' authorization method also enhances security through token-based access control. However, there's no evidence this addresses a specific existing vulnerability.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore-control/update-harness.md b/cli/latest/reference/bedrock-agentcore-control/update-harness.md index 93ca2d021..3fe1811cf 100644 --- a//cli/latest/reference/bedrock-agentcore-control/update-harness.md +++ b//cli/latest/reference/bedrock-agentcore-control/update-harness.md @@ -15 +15 @@ - * [AWS CLI 2.34.45 Command Reference](../../index.html) » + * [AWS CLI 2.34.48 Command Reference](../../index.html) » @@ -238,0 +239,14 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>>>> +>>>> requireServiceS3Endpoint -> (boolean) +>>>> +>>>>> ### Note +>>>>> +>>>>> This field applies only to Agent Runtimes. It is not applicable to Browsers or Code Interpreters. +>>>>> +>>>>> Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup. +>>>>> +>>>>> Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an `UpdateAgentRuntime` request for these agent runtimes returns a `ValidationException` . +>>>>> +>>>>> Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to `false` via the `UpdateAgentRuntime` API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to `true` , the service-managed Amazon S3 gateway remains provisioned. +>>>>> +>>>>> This field is only supported in the `UpdateAgentRuntime` API for pre-rollout agent runtimes. Passing this field in a `CreateAgentRuntime` request returns a `ValidationException` . @@ -344 +358,2 @@ JSON Syntax: - "subnets": ["string", ...] + "subnets": ["string", ...], + "requireServiceS3Endpoint": true|false @@ -1391,0 +1407 @@ JSON Syntax: +>>>>>>> * `TOKEN_EXCHANGE` \- Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience. @@ -2274,0 +2291 @@ harness -> (structure) +>>>>>>>> * `TOKEN_EXCHANGE` \- Authorization using on-behalf-of token exchange. An inbound user token is exchanged for a downstream access token scoped to the target audience. @@ -2527,0 +2545,14 @@ harness -> (structure) +>>>>> +>>>>> requireServiceS3Endpoint -> (boolean) +>>>>> +>>>>>> ### Note +>>>>>> +>>>>>> This field applies only to Agent Runtimes. It is not applicable to Browsers or Code Interpreters. +>>>>>> +>>>>>> Controls whether a service-managed Amazon S3 gateway endpoint is provisioned in the VPC network topology for the agent runtime. This gateway is used by Amazon Bedrock AgentCore Runtime to download code and container images during agent startup. +>>>>>> +>>>>>> Starting May 5, 2026, Amazon Bedrock AgentCore Runtime is gradually rolling out a change to how network isolation is configured for VPC mode agents. Agent runtimes created on or after this rollout will no longer include the service-managed Amazon S3 gateway. Instead, all network access, including to Amazon S3, is governed exclusively by your VPC configuration. This field cannot be set on agent runtimes created after the rollout. Passing this field in an `UpdateAgentRuntime` request for these agent runtimes returns a `ValidationException` . +>>>>>> +>>>>>> Agent runtimes created before the rollout are not affected and continue to operate with the service-managed Amazon S3 gateway. To enforce full VPC network isolation on these existing agent runtimes, set this field to `false` via the `UpdateAgentRuntime` API. Before opting out, ensure your VPC provides the Amazon S3 access required for agent startup. If this field is not specified or is set to `true` , the service-managed Amazon S3 gateway remains provisioned. +>>>>>> +>>>>>> This field is only supported in the `UpdateAgentRuntime` API for pre-rollout agent runtimes. Passing this field in a `CreateAgentRuntime` request returns a `ValidationException` . @@ -3193 +3224 @@ harness -> (structure) - * [AWS CLI 2.34.45 Command Reference](../../index.html) » + * [AWS CLI 2.34.48 Command Reference](../../index.html) »