AWS cli documentation change

Service: cli · 2026-06-16 · Documentation medium

File: cli/latest/reference/bedrock-agentcore/start-batch-evaluation.md

Summary

Added support for insights analysis, tags, KMS encryption, and online evaluation configuration in batch evaluations. Updated AWS CLI version reference.

Security assessment

The change introduces a new '--kms-key-arn' option for encrypting evaluation data at rest using customer-managed keys. This is a security feature enhancement rather than a response to a specific vulnerability. No evidence of security incidents being addressed exists in the diff.

Diff

diff --git a/cli/latest/reference/bedrock-agentcore/start-batch-evaluation.md b/cli/latest/reference/bedrock-agentcore/start-batch-evaluation.md
index 9ab892110..ccc18d4b5 100644
--- a//cli/latest/reference/bedrock-agentcore/start-batch-evaluation.md
+++ b//cli/latest/reference/bedrock-agentcore/start-batch-evaluation.md
@@ -15 +15 @@
-  * [AWS CLI 2.35.3 Command Reference](../../index.html) »
+  * [AWS CLI 2.35.5 Command Reference](../../index.html) »
@@ -68,0 +69 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
+    [--insights <value>]
@@ -71,0 +73,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
+    [--tags <value>]
+    [--kms-key-arn <value>]
@@ -121 +124 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc
->> An evaluator to run against sessions.
+>> An evaluator to run against sessions
@@ -149,0 +153,42 @@ JSON Syntax:
+`--insights` (list)
+
+> The list of insight analyses to run against sessions during the batch evaluation. Maximum of 10 insights.
+> 
+> Constraints:
+> 
+>   * min: `0`
+>   * max: `10`
+> 
+
+> 
+> (structure)
+>
+>> A reference to an insight analysis to run against sessions.
+>> 
+>> insightId -> (string) [required]
+>>
+>>> Canonical insight identifiers using the Builtin.Insight.* naming convention. Used by BatchEvaluate, InternalEvaluate, and ServiceEngineEvaluate flows.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * pattern: `(Builtin\.[a-zA-Z0-9._-]+|[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10})`
+>>> 
+
+
+Shorthand Syntax:
+    
+    
+    insightId=string ...
+    
+
+JSON Syntax:
+    
+    
+    [
+      {
+        "insightId": "string"
+      }
+      ...
+    ]
+    
+
@@ -156 +201 @@ JSON Syntax:
-> This is a Tagged Union structure. Only one of the following top level keys can be set: `cloudWatchLogs`.
+> This is a Tagged Union structure. Only one of the following top level keys can be set: `cloudWatchLogs`, `onlineEvaluationConfigSource`.
@@ -215,0 +261,26 @@ JSON Syntax:
+> 
+> onlineEvaluationConfigSource -> (structure)
+>
+>> Reference an existing OnlineEvaluationConfig as session source
+>> 
+>> onlineEvaluationConfigArn -> (string) [required]
+>>
+>>> The Amazon Resource Name (ARN) of the online evaluation configuration to use as the session source.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * pattern: `arn:aws[a-zA-Z-]*:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:online-evaluation-config\/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}`
+>>> 
+
+>> 
+>> sessionFilterConfig -> (structure)
+>>
+>>> Optional session filter configuration to narrow down which sessions from the online evaluation configuration to include.
+>>> 
+>>> startTime -> (timestamp)
+>>>
+>>>> The start time of the time range. Only sessions with activity at or after this timestamp are included.
+>>> 
+>>> endTime -> (timestamp)
+>>>
+>>>> The end time of the time range. Only sessions with activity before this timestamp are included.
@@ -230,0 +302,7 @@ JSON Syntax:
+      },
+      "onlineEvaluationConfigSource": {
+        "onlineEvaluationConfigArn": "string",
+        "sessionFilterConfig": {
+          "startTime": timestamp,
+          "endTime": timestamp
+        }
@@ -443,0 +522,56 @@ JSON Syntax:
+`--tags` (map)
+
+> A map of tag keys and values to associate with the batch evaluation.
+> 
+> Constraints:
+> 
+>   * min: `0`
+>   * max: `50`
+> 
+
+> 
+> key -> (string)
+>
+>> Constraints:
+>> 
+>>   * min: `1`
+>>   * max: `128`
+>>   * pattern: `[a-zA-Z0-9\s._:/=+@-]*`
+>> 
+
+> 
+> value -> (string)
+>
+>> Constraints:
+>> 
+>>   * min: `0`
+>>   * max: `256`
+>>   * pattern: `[a-zA-Z0-9\s._:/=+@-]*`
+>> 
+
+
+Shorthand Syntax:
+    
+    
+    KeyName1=string,KeyName2=string
+    
+
+JSON Syntax:
+    
+    
+    {"string": "string"
+      ...}
+    
+
+`--kms-key-arn` (string)
+
+> The ARN of the KMS key used to encrypt evaluation data. If provided, customer data is encrypted at rest with the specified key.
+> 
+> Constraints:
+> 
+>   * min: `1`
+>   * max: `2048`
+>   * pattern: `arn:aws(|-cn|-us-gov):kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}`
+> 
+
+
@@ -598 +732 @@ evaluators -> (list)
->> An evaluator to run against sessions.
+>> An evaluator to run against sessions
@@ -609,0 +744,25 @@ evaluators -> (list)
+insights -> (list)
+
+> The list of insight analyses applied during the batch evaluation.
+> 
+> Constraints:
+> 
+>   * min: `0`
+>   * max: `10`
+> 
+
+> 
+> (structure)
+>
+>> A reference to an insight analysis to run against sessions.
+>> 
+>> insightId -> (string) [required]
+>>
+>>> Canonical insight identifiers using the Builtin.Insight.* naming convention. Used by BatchEvaluate, InternalEvaluate, and ServiceEngineEvaluate flows.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * pattern: `(Builtin\.[a-zA-Z0-9._-]+|[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10})`
+>>> 
+
+
@@ -650,0 +810,43 @@ outputConfig -> (tagged union structure)
+tags -> (map)
+
+> The tags associated with the batch evaluation.
+> 
+> Constraints:
+> 
+>   * min: `0`
+>   * max: `50`
+> 
+
+> 
+> key -> (string)
+>
+>> Constraints:
+>> 
+>>   * min: `1`
+>>   * max: `128`