AWS cli medium security documentation change

Service: cli · 2026-06-07 · Security-related medium

File: cli/latest/reference/emr-serverless/create-application.md

Summary

Added 'applicationLevelDigestResolution' parameter to control image digest resolution timing (application vs workload level) in imageConfiguration

Security assessment

Introduces explicit control over when container image digests are resolved, preventing potential supply chain attacks by ensuring image integrity verification happens at designated times (application start or workload submission). The change addresses image trust consistency which is a security concern.

Diff

diff --git a/cli/latest/reference/emr-serverless/create-application.md b/cli/latest/reference/emr-serverless/create-application.md
index 12f1d20a0..e6b80bcdb 100644
--- a//cli/latest/reference/emr-serverless/create-application.md
+++ b//cli/latest/reference/emr-serverless/create-application.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.61 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.63 Command Reference](../../index.html) »
@@ -510,0 +511,4 @@ JSON Syntax:
+> 
+> applicationLevelDigestResolution -> (boolean)
+>
+>> Boolean value indicating if the digest resolution is application level or workload level. If true, a custom image URI is resolved at application start time and all workloads submitted will use that image digest. If false, the custom image URI is resolved at the workload submission time.
@@ -515 +519 @@ Shorthand Syntax:
-    imageUri=string
+    imageUri=string,applicationLevelDigestResolution=boolean
@@ -522 +526,2 @@ JSON Syntax:
-      "imageUri": "string"
+      "imageUri": "string",
+      "applicationLevelDigestResolution": true|false
@@ -560,0 +566,4 @@ JSON Syntax:
+>>> 
+>>> applicationLevelDigestResolution -> (boolean)
+>>>
+>>>> Boolean value indicating if the digest resolution is application level or workload level. If true, a custom image URI is resolved at application start time and all workloads submitted will use that image digest. If false, the custom image URI is resolved at the workload submission time.
@@ -565 +574 @@ Shorthand Syntax:
-    KeyName1={imageConfiguration={imageUri=string}},KeyName2={imageConfiguration={imageUri=string}}
+    KeyName1={imageConfiguration={imageUri=string,applicationLevelDigestResolution=boolean}},KeyName2={imageConfiguration={imageUri=string,applicationLevelDigestResolution=boolean}}
@@ -573 +582,2 @@ JSON Syntax:
-            "imageUri": "string"
+            "imageUri": "string",
+            "applicationLevelDigestResolution": true|false
@@ -1240 +1250 @@ arn -> (string)
-  * [AWS CLI 2.34.61 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.63 Command Reference](../../index.html) »