AWS cli documentation change

Service: cli · 2026-05-31 · Documentation low

File: cli/latest/reference/bedrock-agentcore-control/create-api-key-credential-provider.md

Summary

Added Secrets Manager integration for API key storage, introducing new parameters for secret configuration and source management.

Security assessment

Documents secure credential management through AWS Secrets Manager integration, enabling encrypted storage and access control for API keys. Changes promote security best practices but don't address a specific vulnerability.

Diff

diff --git a/cli/latest/reference/bedrock-agentcore-control/create-api-key-credential-provider.md b/cli/latest/reference/bedrock-agentcore-control/create-api-key-credential-provider.md
index 66c8c5f63..15683d8fd 100644
--- a//cli/latest/reference/bedrock-agentcore-control/create-api-key-credential-provider.md
+++ b//cli/latest/reference/bedrock-agentcore-control/create-api-key-credential-provider.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.55 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.57 Command Reference](../../index.html) »
@@ -68 +68,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
-    --api-key <value>
+    [--api-key <value>]
+    [--api-key-secret-config <value>]
+    [--api-key-secret-source <value>]
@@ -107 +109 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
-`--api-key` (string) [required]
+`--api-key` (string)
@@ -113 +115 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
->   * min: `1`
+>   * min: `0`
@@ -117,0 +120,52 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
+`--api-key-secret-config` (structure)
+
+> A reference to the AWS Secrets Manager secret that stores the API key. This includes the secret ID and the JSON key used to extract the API key value from the secret. Required when `apiKeySecretSource` is set to `EXTERNAL` .
+> 
+> secretId -> (string) [required]
+>
+>> The ID of the AWS Secrets Manager secret that stores the secret value.
+>> 
+>> Constraints:
+>> 
+>>   * min: `1`
+>>   * max: `2048`
+>> 
+
+> 
+> jsonKey -> (string) [required]
+>
+>> The JSON key used to extract the secret value from the AWS Secrets Manager secret.
+>> 
+>> Constraints:
+>> 
+>>   * min: `1`
+>>   * max: `128`
+>> 
+
+
+Shorthand Syntax:
+    
+    
+    secretId=string,jsonKey=string
+    
+
+JSON Syntax:
+    
+    
+    {
+      "secretId": "string",
+      "jsonKey": "string"
+    }
+    
+
+`--api-key-secret-source` (string)
+
+> The source type of the API key secret. Use `MANAGED` if the secret is managed by the service, or `EXTERNAL` if you manage the secret yourself in AWS Secrets Manager.
+> 
+> Possible values:
+> 
+>   * `MANAGED`
+>   * `EXTERNAL`
+> 
+
+
@@ -288,0 +343,22 @@ apiKeySecretArn -> (structure)
+apiKeySecretJsonKey -> (string)
+
+> The JSON key used to extract the API key value from the AWS Secrets Manager secret.
+> 
+> Constraints:
+> 
+>   * min: `1`
+>   * max: `128`
+> 
+
+
+apiKeySecretSource -> (string)
+
+> The source type of the API key secret. Either `MANAGED` if the secret is managed by the service, or `EXTERNAL` if managed by the user in AWS Secrets Manager.
+> 
+> Possible values:
+> 
+>   * `MANAGED`
+>   * `EXTERNAL`
+> 
+
+
@@ -321 +397 @@ credentialProviderArn -> (string)
-  * [AWS CLI 2.34.55 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.57 Command Reference](../../index.html) »