AWS cli medium security documentation change

Service: cli · 2026-06-10 · Security-related medium

File: cli/latest/reference/devops-agent/register-service.md

Summary

Added new parameters (--target-url-private-connection-name, --exchange-url-private-connection-name), constraints for existing parameters, deprecated roleArn in favor of mcpRoleArn with enhanced credential resolution, and added input validation constraints.

Security assessment

The change introduces input validation constraints (min/max lengths, regex patterns) for parameters including OAuth scopes, which prevents injection attacks and enforces secure input formats. The deprecation of roleArn in favor of mcpRoleArn with runtime credential resolution improves secure access management.

Diff

diff --git a/cli/latest/reference/devops-agent/register-service.md b/cli/latest/reference/devops-agent/register-service.md
index b84456245..4d879df01 100644
--- a//cli/latest/reference/devops-agent/register-service.md
+++ b//cli/latest/reference/devops-agent/register-service.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.63 Command Reference](../../index.html) »
+  * [AWS CLI 2.35.1 Command Reference](../../index.html) »
@@ -70,0 +71,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+    [--target-url-private-connection-name <value>]
+    [--exchange-url-private-connection-name <value>]
@@ -284,0 +287,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>   * min: `1`
+>>>   * max: `128`
@@ -294,0 +299,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>   * min: `1`
+>>>   * max: `2048`
@@ -342,0 +349,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>   * min: `1`
+>>>   * max: `128`
@@ -352,0 +361,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>   * min: `1`
+>>>   * max: `2048`
@@ -439,0 +450,7 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `0`
+>>>>>   * max: `100`
+>>>>> 
+
@@ -441,0 +459,10 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>>
+>>>>>> OAuth scope parameter
+>>>>>> 
+>>>>>> Constraints:
+>>>>>> 
+>>>>>>   * min: `1`
+>>>>>>   * max: `128`
+>>>>>>   * pattern: `[!#-\[\]-~]+`
+>>>>>> 
+
@@ -529,0 +557,7 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `0`
+>>>>>   * max: `100`
+>>>>> 
+
@@ -531,0 +566,10 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>>
+>>>>>> OAuth scope parameter
+>>>>>> 
+>>>>>> Constraints:
+>>>>>> 
+>>>>>>   * min: `1`
+>>>>>>   * max: `128`
+>>>>>>   * pattern: `[!#-\[\]-~]+`
+>>>>>> 
+
@@ -664,0 +709,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>   * min: `1`
+>>>   * max: `128`
@@ -674,0 +721,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>   * min: `1`
+>>>   * max: `2048`
@@ -761,0 +810,7 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `0`
+>>>>>   * max: `100`
+>>>>> 
+
@@ -763,0 +819,10 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>>
+>>>>>> OAuth scope parameter
+>>>>>> 
+>>>>>> Constraints:
+>>>>>> 
+>>>>>>   * min: `1`
+>>>>>>   * max: `128`
+>>>>>>   * pattern: `[!#-\[\]-~]+`
+>>>>>> 
+
@@ -851,0 +917,7 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `0`
+>>>>>   * max: `100`
+>>>>> 
+
@@ -853,0 +926,10 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>>
+>>>>>> OAuth scope parameter
+>>>>>> 
+>>>>>> Constraints:
+>>>>>> 
+>>>>>>   * min: `1`
+>>>>>>   * max: `128`
+>>>>>>   * pattern: `[!#-\[\]-~]+`
+>>>>>> 
+
@@ -1047,0 +1130,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>   * min: `1`
+>>>   * max: `128`
@@ -1057,0 +1142,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>   * min: `1`
+>>>   * max: `2048`
@@ -1144,0 +1231,7 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `0`
+>>>>>   * max: `100`
+>>>>> 
+
@@ -1146,0 +1240,10 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>>
+>>>>>> OAuth scope parameter
+>>>>>> 
+>>>>>> Constraints:
+>>>>>> 
+>>>>>>   * min: `1`
+>>>>>>   * max: `128`
+>>>>>>   * pattern: `[!#-\[\]-~]+`
+>>>>>> 
+
@@ -1234,0 +1338,7 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>> 
+>>>>> Constraints:
+>>>>> 
+>>>>>   * min: `0`
+>>>>>   * max: `100`
+>>>>> 
+
@@ -1236,0 +1347,10 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>>>
+>>>>>> OAuth scope parameter
+>>>>>> 
+>>>>>> Constraints:
+>>>>>> 
+>>>>>>   * min: `1`
+>>>>>>   * max: `128`
+>>>>>>   * pattern: `[!#-\[\]-~]+`
+>>>>>> 
+
@@ -1444,0 +1565,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>   * min: `1`
+>>>   * max: `128`
@@ -1454,0 +1577,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>>>   * min: `1`
+>>>   * max: `2048`
@@ -1498 +1622 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
->>> roleArn -> (string) [required]
+>>> roleArn -> (string)
@@ -1500 +1624,12 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
->>>> IAM role ARN to assume for SigV4 signing.
+>>>> Deprecated — use mcpRoleArn instead. IAM role ARN to assume for SigV4 signing.
+>>>> 
+>>>> Constraints:
+>>>> 
+>>>>   * min: `0`
+>>>>   * max: `255`
+>>>> 
+
+>>> 
+>>> mcpRoleArn -> (string)
+>>>
+>>>> IAM role ARN to assume for SigV4 signing. Optional — when omitted, credentials are resolved at runtime via a monitor account association.
@@ -1752,0 +1888 @@ JSON Syntax:
+          "mcpRoleArn": "string",
@@ -1782,0 +1919,24 @@ JSON Syntax:
+`--target-url-private-connection-name` (string)
+
+> The name of the private connection to use for API calls (target URL) only. Cannot be specified when privateConnectionName is provided.
+> 
+> Constraints:
+> 
+>   * min: `3`
+>   * max: `30`
+>   * pattern: `[a-z0-9]([a-z0-9-]*[a-z0-9])?`
+> 
+
+
+`--exchange-url-private-connection-name` (string)
+
+> The name of the private connection to use for OAuth token exchange requests only. Cannot be specified when privateConnectionName is provided.
+> 
+> Constraints:
+> 
+>   * min: `3`
+>   * max: `30`
+>   * pattern: `[a-z0-9]([a-z0-9-]*[a-z0-9])?`
+> 
+
+
@@ -2026 +2186 @@ tags -> (map)
-  * [AWS CLI 2.34.63 Command Reference](../../index.html) »