AWS cli high security documentation change
Summary
Updated payment credential provider configuration to support AWS Secrets Manager integration. Added parameters for secret source (MANAGED/EXTERNAL) and Secrets Manager references. Removed required constraints from direct secret fields and updated validation patterns.
Security assessment
The changes introduce explicit support for storing secrets in AWS Secrets Manager rather than passing them directly. This mitigates risks of credential exposure in logs/configs by allowing external secret management. Security evidence includes: 1) Added 'source' parameters to specify secret storage location, 2) New configuration structures for Secrets Manager references, 3) Relaxed direct secret constraints (min length 0, pattern allows empty strings) to discourage direct secret usage.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore-control/create-payment-credential-provider.md b/cli/latest/reference/bedrock-agentcore-control/create-payment-credential-provider.md index 793d8453c..fb642697a 100644 --- a//cli/latest/reference/bedrock-agentcore-control/create-payment-credential-provider.md +++ b//cli/latest/reference/bedrock-agentcore-control/create-payment-credential-provider.md @@ -15 +15 @@ - * [AWS CLI 2.34.55 Command Reference](../../index.html) » + * [AWS CLI 2.34.57 Command Reference](../../index.html) » @@ -143 +143 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->> apiKeySecret -> (string) [required] +>> apiKeySecret -> (string) @@ -149 +149 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> * min: `1` +>>> * min: `0` @@ -151 +151,31 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> * pattern: `[a-zA-Z0-9+/=\-_\s]+` +>>> * pattern: `[a-zA-Z0-9+/=\-_\s]*` +>>> + +>> +>> apiKeySecretSource -> (string) +>> +>>> The source type of the API key secret for the Coinbase Developer Platform. Use `MANAGED` if the secret is managed by the service, or `EXTERNAL` if you manage the secret yourself in AWS Secrets Manager. +>>> +>>> Possible values: +>>> +>>> * `MANAGED` +>>> * `EXTERNAL` +>>> + +>> +>> apiKeySecretConfig -> (structure) +>> +>>> A reference to the AWS Secrets Manager secret that stores the API key secret. This includes the secret ID and the JSON key used to extract the API key secret value from the secret. Required when `apiKeySecretSource` is set to `EXTERNAL` . +>>> +>>> secretId -> (string) [required] +>>> +>>>> The ID of the AWS Secrets Manager secret that stores the secret value. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `2048` +>>>> + +>>> +>>> jsonKey -> (string) [required] @@ -152,0 +183,7 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>>>> The JSON key used to extract the secret value from the AWS Secrets Manager secret. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `128` +>>>> @@ -155 +192 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->> walletSecret -> (string) [required] +>> walletSecret -> (string) @@ -161 +198 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> * min: `1` +>>> * min: `0` @@ -163 +200,29 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> * pattern: `[a-zA-Z0-9+/=\-_\s]+` +>>> * pattern: `[a-zA-Z0-9+/=\-_\s]*` +>>> + +>> +>> walletSecretSource -> (string) +>> +>>> The source type of the wallet secret for the Coinbase Developer Platform. Use `MANAGED` if the secret is managed by the service, or `EXTERNAL` if you manage the secret yourself in AWS Secrets Manager. +>>> +>>> Possible values: +>>> +>>> * `MANAGED` +>>> * `EXTERNAL` +>>> + +>> +>> walletSecretConfig -> (structure) +>> +>>> A reference to the AWS Secrets Manager secret that stores the wallet secret. This includes the secret ID and the JSON key used to extract the wallet secret value from the secret. Required when `walletSecretSource` is set to `EXTERNAL` . +>>> +>>> secretId -> (string) [required] +>>> +>>>> The ID of the AWS Secrets Manager secret that stores the secret value. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `2048` +>>>> + @@ -164,0 +230,9 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>>> jsonKey -> (string) [required] +>>> +>>>> The JSON key used to extract the secret value from the AWS Secrets Manager secret. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `128` +>>>> @@ -183 +257 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->> appSecret -> (string) [required] +>> appSecret -> (string) @@ -189 +263 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> * min: `1` +>>> * min: `0` @@ -191 +265,18 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> * pattern: `[a-zA-Z0-9+/=\-_\s]+` +>>> * pattern: `[a-zA-Z0-9+/=\-_\s]*` +>>> + +>> +>> appSecretSource -> (string) +>> +>>> The source type of the app secret. Use `MANAGED` if the secret is managed by the service, or `EXTERNAL` if you manage the secret yourself in AWS Secrets Manager. +>>> +>>> Possible values: +>>> +>>> * `MANAGED` +>>> * `EXTERNAL` +>>> + +>> +>> appSecretConfig -> (structure) +>> +>>> A reference to the AWS Secrets Manager secret that stores the app secret. This includes the secret ID and the JSON key used to extract the app secret value from the secret. Required when `appSecretSource` is set to `EXTERNAL` . @@ -192,0 +284,20 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>>> secretId -> (string) [required] +>>> +>>>> The ID of the AWS Secrets Manager secret that stores the secret value. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `2048` +>>>> + +>>> +>>> jsonKey -> (string) [required] +>>> +>>>> The JSON key used to extract the secret value from the AWS Secrets Manager secret. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `128` +>>>> @@ -195 +306 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->> authorizationPrivateKey -> (string) [required] +>> authorizationPrivateKey -> (string) @@ -201 +312 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> * min: `1` +>>> * min: `0` @@ -203 +314,12 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> * pattern: `[a-zA-Z0-9+/=\-_\s]+` +>>> * pattern: `[a-zA-Z0-9+/=\-_\s]*` +>>> + +>> +>> authorizationPrivateKeySource -> (string) +>> +>>> The source type of the authorization private key. Use `MANAGED` if the secret is managed by the service, or `EXTERNAL` if you manage the secret yourself in AWS Secrets Manager. +>>> +>>> Possible values: +>>> +>>> * `MANAGED` +>>> * `EXTERNAL` @@ -205,0 +328,26 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>> +>> authorizationPrivateKeyConfig -> (structure) +>> +>>> A reference to the AWS Secrets Manager secret that stores the authorization private key. This includes the secret ID and the JSON key used to extract the authorization private key value from the secret. Required when `authorizationPrivateKeySource` is set to `EXTERNAL` . +>>> +>>> secretId -> (string) [required] +>>> +>>>> The ID of the AWS Secrets Manager secret that stores the secret value. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `2048` +>>>> + +>>> +>>> jsonKey -> (string) [required] +>>> +>>>> The JSON key used to extract the secret value from the AWS Secrets Manager secret. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `128` +>>>> + @@ -222 +370 @@ Shorthand Syntax: - coinbaseCdpConfiguration={apiKeyId=string,apiKeySecret=string,walletSecret=string},stripePrivyConfiguration={appId=string,appSecret=string,authorizationPrivateKey=string,authorizationId=string} + coinbaseCdpConfiguration={apiKeyId=string,apiKeySecret=string,apiKeySecretSource=string,apiKeySecretConfig={secretId=string,jsonKey=string},walletSecret=string,walletSecretSource=string,walletSecretConfig={secretId=string,jsonKey=string}},stripePrivyConfiguration={appId=string,appSecret=string,appSecretSource=string,appSecretConfig={secretId=string,jsonKey=string},authorizationPrivateKey=string,authorizationPrivateKeySource=string,authorizationPrivateKeyConfig={secretId=string,jsonKey=string},authorizationId=string} @@ -232 +380,11 @@ JSON Syntax: - "walletSecret": "string"