AWS cli documentation change
Summary
Added support for LiteLLM model configuration, expanded model configs with apiFormat and additionalParams, added S3 and Git sources with authentication, and updated AWS CLI version reference.
Security assessment
The changes introduce secure credential handling through ARNs (apiKeyArn in liteLlmModelConfig and credentialArn in Git authentication) that reference secrets in AgentCore Identity. This documents secure practices for managing third-party API keys and repository credentials without exposing secrets. However, there's no evidence this addresses a specific security vulnerability.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore-control/create-harness.md b/cli/latest/reference/bedrock-agentcore-control/create-harness.md index cb8df3f4f..4f7a98bfd 100644 --- a//cli/latest/reference/bedrock-agentcore-control/create-harness.md +++ b//cli/latest/reference/bedrock-agentcore-control/create-harness.md @@ -15 +15 @@ - * [AWS CLI 2.34.55 Command Reference](../../index.html) » + * [AWS CLI 2.34.57 Command Reference](../../index.html) » @@ -974 +974 @@ JSON Syntax: -> This is a Tagged Union structure. Only one of the following top level keys can be set: `bedrockModelConfig`, `openAiModelConfig`, `geminiModelConfig`. +> This is a Tagged Union structure. Only one of the following top level keys can be set: `bedrockModelConfig`, `openAiModelConfig`, `geminiModelConfig`, `liteLlmModelConfig`. @@ -1014,0 +1015,16 @@ JSON Syntax: +>> +>> apiFormat -> (string) +>> +>>> The API format to use when calling the Bedrock provider. +>>> +>>> Possible values: +>>> +>>> * `converse_stream` +>>> * `responses` +>>> * `chat_completions` +>>> + +>> +>> additionalParams -> (document) +>> +>>> Provider-specific parameters passed through to the model provider unchanged. @@ -1064,0 +1081,15 @@ JSON Syntax: +>> +>> apiFormat -> (string) +>> +>>> The API format to use when calling the OpenAI provider. +>>> +>>> Possible values: +>>> +>>> * `chat_completions` +>>> * `responses` +>>> + +>> +>> additionalParams -> (document) +>> +>>> Provider-specific parameters passed through to the model provider unchanged. @@ -1125,0 +1157,65 @@ JSON Syntax: +> +> liteLlmModelConfig -> (structure) +> +>> The LiteLLM model configuration for connecting to third-party model providers. +>> +>> modelId -> (string) [required] +>> +>>> The LiteLLM model identifier (e.g., “anthropic/claude-3-sonnet”). +>> +>> apiKeyArn -> (string) +>> +>>> The ARN of the API key in AgentCore Identity for authenticating with the model provider. +>>> +>>> Constraints: +>>> +>>> * pattern: `arn:aws:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:token-vault/[a-zA-Z0-9-.]+/apikeycredentialprovider/[a-zA-Z0-9-.]+` +>>> + +>> +>> apiBase -> (string) +>> +>>> The base URL for the model provider’s API endpoint. +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `16383` +>>> + +>> +>> maxTokens -> (integer) +>> +>>> The maximum number of tokens to allow in the generated response per iteration. +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> + +>> +>> temperature -> (float) +>> +>>> The temperature to set when calling the model. +>>> +>>> Constraints: +>>> +>>> * min: `0.0` +>>> * max: `2.0` +>>> + +>> +>> topP -> (float) +>> +>>> The topP set when calling the model. +>>> +>>> Constraints: +>>> +>>> * min: `0.0` +>>> * max: `1.0` +>>> + +>> +>> additionalParams -> (document) +>> +>>> Provider-specific parameters passed through to the model provider unchanged. @@ -1130 +1226 @@ Shorthand Syntax: - bedrockModelConfig={modelId=string,maxTokens=integer,temperature=float,topP=float},openAiModelConfig={modelId=string,apiKeyArn=string,maxTokens=integer,temperature=float,topP=float},geminiModelConfig={modelId=string,apiKeyArn=string,maxTokens=integer,temperature=float,topP=float,topK=integer} + bedrockModelConfig={modelId=string,maxTokens=integer,temperature=float,topP=float,apiFormat=string},openAiModelConfig={modelId=string,apiKeyArn=string,maxTokens=integer,temperature=float,topP=float,apiFormat=string},geminiModelConfig={modelId=string,apiKeyArn=string,maxTokens=integer,temperature=float,topP=float,topK=integer},liteLlmModelConfig={modelId=string,apiKeyArn=string,apiBase=string,maxTokens=integer,temperature=float,topP=float} @@ -1141 +1237,3 @@ JSON Syntax: - "topP": float + "topP": float, + "apiFormat": "converse_stream"|"responses"|"chat_completions", + "additionalParams": {...} @@ -1148 +1246,3 @@ JSON Syntax: - "topP": float + "topP": float, + "apiFormat": "chat_completions"|"responses", + "additionalParams": {...} @@ -1156,0 +1257,9 @@ JSON Syntax: + }, + "liteLlmModelConfig": { + "modelId": "string", + "apiKeyArn": "string", + "apiBase": "string", + "maxTokens": integer, + "temperature": float, + "topP": float, + "additionalParams": {...} @@ -1329 +1438 @@ JSON Syntax: ->>>>>> An OAuth credential provider for gateway authentication. This structure contains the configuration for authenticating with the target endpoint using OAuth. +>>>>>> Use OAuth credentials for outbound authentication to the gateway. @@ -1511 +1620 @@ JSON Syntax: ->> This is a Tagged Union structure. Only one of the following top level keys can be set: `path`. +>> This is a Tagged Union structure. Only one of the following top level keys can be set: `path`, `s3`, `git`. @@ -1521,0 +1631,52 @@ JSON Syntax: +>> +>> s3 -> (structure) +>> +>>> An S3 source containing the skill. +>>> +>>> uri -> (string) [required] +>>> +>>>> The S3 URI pointing to the skill directory (e.g., s3://bucket/skills/my-skill/). +>>>> +>>>> Constraints: +>>>> +>>>> * min: `5` +>>>> * pattern: `s3://.*` +>>>> + +>> +>> git -> (structure) +>> +>>> A git repository containing the skill. +>>> +>>> url -> (string) [required] +>>> +>>>> The HTTPS URL of the git repository. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `8` +>>>> * pattern: `https://.*` +>>>> + +>>> +>>> path -> (string) +>>> +>>>> Subdirectory within the repository containing the skill. +>>> +>>> auth -> (structure) +>>> +>>>> Authentication configuration for private repositories. +>>>> +>>>> credentialArn -> (string) [required] +>>>> +>>>>> The ARN of the credential in AgentCore Identity containing the password or personal access token. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * pattern: `arn:aws:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:token-vault/[a-zA-Z0-9-.]+/apikeycredentialprovider/[a-zA-Z0-9-.]+` +>>>>> + +>>>> +>>>> username -> (string) +>>>> +>>>>> Username for authentication. Defaults to ‘oauth2’ if not specified. @@ -1526 +1687 @@ Shorthand Syntax: - path=string ... + path=string,s3={uri=string},git={url=string,path=string,auth={credentialArn=string,username=string}} ... @@ -1534 +1695,12 @@ JSON Syntax: - "path": "string" + "path": "string", + "s3": { + "uri": "string" + },