AWS cli medium security documentation change
Summary
Added --kms-key-arn for encryption at rest, --tags for resource tagging, batchEvaluation trace source option, updated ARN patterns with partition support, added length constraints, and updated CLI version references
Security assessment
The --kms-key-arn option explicitly enables encryption of customer data at rest using KMS, addressing data protection requirements. The added min/max length constraints and ARN pattern updates improve input validation security.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore/start-recommendation.md b/cli/latest/reference/bedrock-agentcore/start-recommendation.md index 266ed97dc..be056b943 100644 --- a//cli/latest/reference/bedrock-agentcore/start-recommendation.md +++ b//cli/latest/reference/bedrock-agentcore/start-recommendation.md @@ -15 +15 @@ - * [AWS CLI 2.35.3 Command Reference](../../index.html) » + * [AWS CLI 2.35.5 Command Reference](../../index.html) » @@ -72,0 +73 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc + [--kms-key-arn <value>] @@ -73,0 +75 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc + [--tags <value>] @@ -174 +176 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>>>> * pattern: `arn:aws:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:configuration-bundle/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}` +>>>>> * pattern: `arn:aws[a-zA-Z-]*:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:configuration-bundle/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}` @@ -192 +194 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionSpans`, `cloudwatchLogs`. +>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionSpans`, `cloudwatchLogs`, `batchEvaluation`. @@ -238,0 +241,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>>>>>> * min: `1` +>>>>>> * max: `256` @@ -317,0 +322,8 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>>> +>>> batchEvaluation -> (structure) +>>> +>>>> Use a completed batch evaluation as the source of agent traces. +>>>> +>>>> batchEvaluationArn -> (string) [required] +>>>> +>>>>> The ARN of the completed batch evaluation to use as the trace source. @@ -319 +331 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->> evaluationConfig -> (structure) [required] +>> evaluationConfig -> (structure) @@ -344 +356 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>>>>> * pattern: `arn:aws:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:evaluator\/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}$|^arn:aws:bedrock-agentcore:::evaluator/Builtin.[a-zA-Z0-9_-]+` +>>>>>> * pattern: `arn:aws[a-zA-Z-]*:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:evaluator\/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}$|^arn:aws[a-zA-Z-]*:bedrock-agentcore:::evaluator/Builtin.[a-zA-Z0-9_-]+` @@ -413 +425 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>>>> * pattern: `arn:aws:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:configuration-bundle/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}` +>>>>> * pattern: `arn:aws[a-zA-Z-]*:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:configuration-bundle/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}` @@ -451 +463 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc ->>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionSpans`, `cloudwatchLogs`. +>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionSpans`, `cloudwatchLogs`, `batchEvaluation`. @@ -497,0 +510,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>>>>>> * min: `1` +>>>>>> * max: `256` @@ -576,0 +591,8 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +>>> +>>> batchEvaluation -> (structure) +>>> +>>>> Use a completed batch evaluation as the source of agent traces. +>>>> +>>>> batchEvaluationArn -> (string) [required] +>>>> +>>>>> The ARN of the completed batch evaluation to use as the trace source. @@ -614,0 +637,3 @@ JSON Syntax: + }, + "batchEvaluation": { + "batchEvaluationArn": "string" @@ -674,0 +700,3 @@ JSON Syntax: + }, + "batchEvaluation": { + "batchEvaluationArn": "string" @@ -680,0 +709,12 @@ JSON Syntax: +`--kms-key-arn` (string) + +> The ARN of the KMS key used to encrypt recommendation data. If provided, customer data is encrypted at rest with the specified key. +> +> Constraints: +> +> * min: `1` +> * max: `2048` +> * pattern: `arn:aws(|-cn|-us-gov):kms:[a-zA-Z0-9-]*:[0-9]{12}:key/[a-zA-Z0-9-]{36}` +> + + @@ -692,0 +733,44 @@ JSON Syntax: +`--tags` (map) + +> A map of tag keys and values to associate with the recommendation. +> +> Constraints: +> +> * min: `0` +> * max: `50` +> + +> +> key -> (string) +> +>> Constraints: +>> +>> * min: `1` +>> * max: `128` +>> * pattern: `[a-zA-Z0-9\s._:/=+@-]*` +>> + +> +> value -> (string) +> +>> Constraints: +>> +>> * min: `0` +>> * max: `256` +>> * pattern: `[a-zA-Z0-9\s._:/=+@-]*` +>> + + +Shorthand Syntax: + + + KeyName1=string,KeyName2=string + + +JSON Syntax: + + + {"string": "string" + ...} + + @@ -901 +985 @@ recommendationConfig -> (tagged union structure) ->>>>> * pattern: `arn:aws:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:configuration-bundle/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}` +>>>>> * pattern: `arn:aws[a-zA-Z-]*:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:configuration-bundle/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}` @@ -919 +1003 @@ recommendationConfig -> (tagged union structure) ->>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionSpans`, `cloudwatchLogs`. +>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionSpans`, `cloudwatchLogs`, `batchEvaluation`. @@ -965,0 +1050,2 @@ recommendationConfig -> (tagged union structure) +>>>>>> * min: `1` +>>>>>> * max: `256` @@ -1044,0 +1131,8 @@ recommendationConfig -> (tagged union structure) +>>> +>>> batchEvaluation -> (structure) +>>> +>>>> Use a completed batch evaluation as the source of agent traces. +>>>> +>>>> batchEvaluationArn -> (string) [required] +>>>> +>>>>> The ARN of the completed batch evaluation to use as the trace source. @@ -1046 +1140 @@ recommendationConfig -> (tagged union structure) ->> evaluationConfig -> (structure) [required] +>> evaluationConfig -> (structure) @@ -1071 +1165 @@ recommendationConfig -> (tagged union structure) ->>>>>> * pattern: `arn:aws:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:evaluator\/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}$|^arn:aws:bedrock-agentcore:::evaluator/Builtin.[a-zA-Z0-9_-]+` +>>>>>> * pattern: `arn:aws[a-zA-Z-]*:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:evaluator\/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}$|^arn:aws[a-zA-Z-]*:bedrock-agentcore:::evaluator/Builtin.[a-zA-Z0-9_-]+` @@ -1140 +1234 @@ recommendationConfig -> (tagged union structure) ->>>>> * pattern: `arn:aws:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:configuration-bundle/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}` +>>>>> * pattern: `arn:aws[a-zA-Z-]*:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:configuration-bundle/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}` @@ -1178 +1272 @@ recommendationConfig -> (tagged union structure) ->>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionSpans`, `cloudwatchLogs`. +>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sessionSpans`, `cloudwatchLogs`, `batchEvaluation`. @@ -1224,0 +1319,2 @@ recommendationConfig -> (tagged union structure) +>>>>>> * min: `1` +>>>>>> * max: `256` @@ -1303,0 +1400,8 @@ recommendationConfig -> (tagged union structure) +>>> +>>> batchEvaluation -> (structure) +>>> +>>>> Use a completed batch evaluation as the source of agent traces. +>>>> +>>>> batchEvaluationArn -> (string) [required] +>>>> +>>>>> The ARN of the completed batch evaluation to use as the trace source. @@ -1337 +1441 @@ updatedAt -> (timestamp) - * [AWS CLI 2.35.3 Command Reference](../../index.html) » + * [AWS CLI 2.35.5 Command Reference](../../index.html) »