AWS cli high security documentation change

Service: cli · 2026-06-07 · Security-related high

File: cli/latest/reference/emr-serverless/get-job-run.md

Summary

Added imageConfiguration details with digest verification fields and workerTypeSpecifications with image resolution controls

Security assessment

Exposes resolvedImageDigest and applicationLevelDigestResolution at job level, providing critical visibility into container image provenance and verification timing. This enables detection of image tampering and validates security controls during workload execution.

Diff

diff --git a/cli/latest/reference/emr-serverless/get-job-run.md b/cli/latest/reference/emr-serverless/get-job-run.md
index dabd00014..a82326923 100644
--- a//cli/latest/reference/emr-serverless/get-job-run.md
+++ b//cli/latest/reference/emr-serverless/get-job-run.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.61 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.63 Command Reference](../../index.html) »
@@ -772,2 +772 @@ jobRun -> (structure)
->>>>>   * min: `1`
->>>>>   * pattern: `.*\S.*`
+>>>>>   * min: `0`
@@ -1016,0 +1016,80 @@ jobRun -> (structure)
+> 
+> imageConfiguration -> (structure)
+>
+>> The applied image configuration.
+>> 
+>> imageUri -> (string) [required]
+>>
+>>> The image URI.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `1`
+>>>   * max: `1024`
+>>>   * pattern: `([0-9]{12})\.dkr\.ecr\.([a-z0-9-]+).([a-z0-9._-]+)\/((?:[a-z0-9]+(?:[-._][a-z0-9]+)*/)*[a-z0-9]+(?:[-._][a-z0-9]+)*)(?::([a-zA-Z0-9_]+[a-zA-Z0-9-._]*)|@(sha256:[0-9a-f]{64}))`
+>>> 
+
+>> 
+>> resolvedImageDigest -> (string)
+>>
+>>> The SHA256 digest of the image URI. This indicates which specific image the application is configured for. The image digest doesn’t exist until an application has started.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * pattern: `sha256:[0-9a-f]{64}`
+>>> 
+
+>> 
+>> applicationLevelDigestResolution -> (boolean)
+>>
+>>> Boolean value indicating if the digest resolution is application level or workload level. If true, a custom image URI is resolved at application start time and all workloads submitted will use that image digest. If false, the custom image URI is resolved at the workload submission time.
+> 
+> workerTypeSpecifications -> (map)
+>
+>> The specification applied to each worker type. Includes the JobRun-level ImageConfiguration when the applicationLevelDigestResolution is false for the application.
+>> 
+>> key -> (string)
+>>
+>>> Worker type for an analytics framework.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `1`
+>>>   * max: `50`
+>>>   * pattern: `[a-zA-Z]+[-_]*[a-zA-Z]+`
+>>> 
+
+>> 
+>> value -> (structure)
+>>
+>>> The specifications for a worker type.
+>>> 
+>>> imageConfiguration -> (structure)
+>>>
+>>>> The image configuration for a worker type.
+>>>> 
+>>>> imageUri -> (string) [required]
+>>>>
+>>>>> The image URI.
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `1`
+>>>>>   * max: `1024`
+>>>>>   * pattern: `([0-9]{12})\.dkr\.ecr\.([a-z0-9-]+).([a-z0-9._-]+)\/((?:[a-z0-9]+(?:[-._][a-z0-9]+)*/)*[a-z0-9]+(?:[-._][a-z0-9]+)*)(?::([a-zA-Z0-9_]+[a-zA-Z0-9-._]*)|@(sha256:[0-9a-f]{64}))`
+>>>>> 
+
+>>>> 
+>>>> resolvedImageDigest -> (string)
+>>>>
+>>>>> The SHA256 digest of the image URI. This indicates which specific image the application is configured for. The image digest doesn’t exist until an application has started.
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * pattern: `sha256:[0-9a-f]{64}`
+>>>>> 
+
+>>>> 
+>>>> applicationLevelDigestResolution -> (boolean)
+>>>>
+>>>>> Boolean value indicating if the digest resolution is application level or workload level. If true, a custom image URI is resolved at application start time and all workloads submitted will use that image digest. If false, the custom image URI is resolved at the workload submission time.
@@ -1028 +1107 @@ jobRun -> (structure)
-  * [AWS CLI 2.34.61 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.63 Command Reference](../../index.html) »