AWS cli documentation change

Service: cli · 2026-05-31 · Documentation low

File: cli/latest/reference/bedrock-agentcore-control/update-api-key-credential-provider.md

Summary

Added new options --api-key-secret-config and --api-key-secret-source, made --api-key optional, modified its constraints, added output fields apiKeySecretJsonKey and apiKeySecretSource. Updated CLI version reference.

Security assessment

The changes document new AWS Secrets Manager integration for API key storage, including secret source types (MANAGED/EXTERNAL) and JSON key references. This enhances security documentation by describing secure credential management options, but shows no evidence of patching a specific vulnerability.

Diff

diff --git a/cli/latest/reference/bedrock-agentcore-control/update-api-key-credential-provider.md b/cli/latest/reference/bedrock-agentcore-control/update-api-key-credential-provider.md
index 37f63b553..d820140ba 100644
--- a//cli/latest/reference/bedrock-agentcore-control/update-api-key-credential-provider.md
+++ b//cli/latest/reference/bedrock-agentcore-control/update-api-key-credential-provider.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.55 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.57 Command Reference](../../index.html) »
@@ -68 +68,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
-    --api-key <value>
+    [--api-key <value>]
+    [--api-key-secret-config <value>]
+    [--api-key-secret-source <value>]
@@ -106 +108 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
-`--api-key` (string) [required]
+`--api-key` (string)
@@ -112 +114 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
->   * min: `1`
+>   * min: `0`
@@ -116,0 +119,52 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
+`--api-key-secret-config` (structure)
+
+> A reference to the AWS Secrets Manager secret that stores the API key. This includes the secret ID and the JSON key used to extract the API key value from the secret. Required when `apiKeySecretSource` is set to `EXTERNAL` .
+> 
+> secretId -> (string) [required]
+>
+>> The ID of the AWS Secrets Manager secret that stores the secret value.
+>> 
+>> Constraints:
+>> 
+>>   * min: `1`
+>>   * max: `2048`
+>> 
+
+> 
+> jsonKey -> (string) [required]
+>
+>> The JSON key used to extract the secret value from the AWS Secrets Manager secret.
+>> 
+>> Constraints:
+>> 
+>>   * min: `1`
+>>   * max: `128`
+>> 
+
+
+Shorthand Syntax:
+    
+    
+    secretId=string,jsonKey=string
+    
+
+JSON Syntax:
+    
+    
+    {
+      "secretId": "string",
+      "jsonKey": "string"
+    }
+    
+
+`--api-key-secret-source` (string)
+
+> The source type of the API key secret. Use `MANAGED` if the secret is managed by the service, or `EXTERNAL` if you manage the secret yourself in AWS Secrets Manager.
+> 
+> Possible values:
+> 
+>   * `MANAGED`
+>   * `EXTERNAL`
+> 
+
+
@@ -243,0 +298,22 @@ apiKeySecretArn -> (structure)
+apiKeySecretJsonKey -> (string)
+
+> The JSON key used to extract the API key value from the AWS Secrets Manager secret.
+> 
+> Constraints:
+> 
+>   * min: `1`
+>   * max: `128`
+> 
+
+
+apiKeySecretSource -> (string)
+
+> The source type of the API key secret. Either `MANAGED` if the secret is managed by the service, or `EXTERNAL` if managed by the user in AWS Secrets Manager.
+> 
+> Possible values:
+> 
+>   * `MANAGED`
+>   * `EXTERNAL`
+> 
+
+
@@ -284 +360 @@ lastUpdatedTime -> (timestamp)
-  * [AWS CLI 2.34.55 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.57 Command Reference](../../index.html) »