AWS cli high security documentation change
Summary
Added new '--user-context' parameter for access control filtering, expanded retrieval configuration with managed search and reranking capabilities, added new output fields including document IDs and cloud storage locations, updated constraints and patterns, and fixed documentation typos.
Security assessment
The addition of '--user-context' with required userId enables access control filtering, which directly addresses authorization concerns by restricting retrieval results to documents the user is authorized to access. This prevents unauthorized data exposure. The security_issue_related is true due to explicit access control implementation, and adds_security_documentation is true as it documents this security feature.
Diff
diff --git a/cli/latest/reference/bedrock-agent-runtime/retrieve.md b/cli/latest/reference/bedrock-agent-runtime/retrieve.md index 628b696ea..6fb7d8a6b 100644 --- a//cli/latest/reference/bedrock-agent-runtime/retrieve.md +++ b//cli/latest/reference/bedrock-agent-runtime/retrieve.md @@ -15 +15 @@ - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) » @@ -74,0 +75 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc + [--user-context <value>] @@ -151,3 +152,11 @@ JSON Syntax: -> * min: `0` -> * max: `10` -> * pattern: `^[0-9a-zA-Z]+$` +> * min: `10` +> * max: `2048` +> * pattern: `^[0-9a-zA-Z]{10}$|^arn:aws(-[^:]+)?:bedrock:[a-z0-9-]{1,20}:[0-9]{12}:knowledge-base/[0-9a-zA-Z]{10}$` +> + + +`--retrieval-configuration` (structure) + +> Contains configurations for the knowledge base query and retrieval process. For more information, see [Query configurations](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html) . +> +> managedSearchConfiguration -> (structure) @@ -154,0 +164,1015 @@ JSON Syntax: +>> Contains configurations for managed search. For more information, see [Query configurations](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html) . +>> +>> filter -> (tagged union structure) +>> +>>> Specifies the filters to use on the metadata attributes in the knowledge base data sources before returning results. For more information, see [Query configurations](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html) . See the examples below to see how to use these filters. +>>> +>>> This data type is used in the following API operations: +>>> +>>> * [Retrieve request](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_Retrieve.html#API_agent-runtime_Retrieve_RequestSyntax) – in the `filter` field +>>> * [RetrieveAndGenerate request](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_RetrieveAndGenerate.html#API_agent-runtime_RetrieveAndGenerate_RequestSyntax) – in the `filter` field +>>> + +>>> +>>> ### Note +>>> +>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `andAll`, `equals`, `greaterThan`, `greaterThanOrEquals`, `in`, `lessThan`, `lessThanOrEquals`, `listContains`, `notEquals`, `notIn`, `orAll`, `startsWith`, `stringContains`. +>>> +>>> andAll -> (list) +>>> +>>>> Knowledge base data sources are returned if their metadata attributes fulfill all the filter conditions inside this list. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `2` +>>>> + +>>>> +>>>> (tagged union structure) +>>>> +>>>>> Specifies the filters to use on the metadata attributes in the knowledge base data sources before returning results. For more information, see [Query configurations](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html) . See the examples below to see how to use these filters. +>>>>> +>>>>> This data type is used in the following API operations: +>>>>> +>>>>> * [Retrieve request](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_Retrieve.html#API_agent-runtime_Retrieve_RequestSyntax) – in the `filter` field +>>>>> * [RetrieveAndGenerate request](https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_RetrieveAndGenerate.html#API_agent-runtime_RetrieveAndGenerate_RequestSyntax) – in the `filter` field +>>>>> + +>>>>> +>>>>> ### Note +>>>>> +>>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `andAll`, `equals`, `greaterThan`, `greaterThanOrEquals`, `in`, `lessThan`, `lessThanOrEquals`, `listContains`, `notEquals`, `notIn`, `orAll`, `startsWith`, `stringContains`. +>>>>> +>>>>> andAll -> (list) +>>>>> +>>>>>> Knowledge base data sources are returned if their metadata attributes fulfill all the filter conditions inside this list. +>>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `2` +>>>>>> + +>>>>>> +>>>>>> ( … recursive … ) +>>>>> +>>>>> equals -> (structure) +>>>>> +>>>>>> Knowledge base data sources are returned if they contain a metadata attribute whose name matches the `key` and whose value matches the `value` in this object. +>>>>>> +>>>>>> The following example would return data sources with an `animal` attribute whose value is `cat` : +>>>>>> +>>>>>>> `"equals": { "key": "animal", "value": "cat" }` +>>>>>> +>>>>>> key -> (string) [required] +>>>>>> +>>>>>>> The name that the metadata attribute must match. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `1` +>>>>>>> * max: `100` +>>>>>>> + +>>>>>> +>>>>>> value -> (document) [required] +>>>>>> +>>>>>>> The value to which to compare the value of the metadata attribute. +>>>>> +>>>>> greaterThan -> (structure) +>>>>> +>>>>>> Knowledge base data sources are returned if they contain a metadata attribute whose name matches the `key` and whose value is greater than the `value` in this object. +>>>>>> +>>>>>> The following example would return data sources with an `year` attribute whose value is greater than `1989` : +>>>>>> +>>>>>>> `"greaterThan": { "key": "year", "value": 1989 }` +>>>>>> +>>>>>> key -> (string) [required] +>>>>>> +>>>>>>> The name that the metadata attribute must match. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `1` +>>>>>>> * max: `100` +>>>>>>> + +>>>>>> +>>>>>> value -> (document) [required] +>>>>>> +>>>>>>> The value to which to compare the value of the metadata attribute. +>>>>> +>>>>> greaterThanOrEquals -> (structure) +>>>>> +>>>>>> Knowledge base data sources are returned if they contain a metadata attribute whose name matches the `key` and whose value is greater than or equal to the `value` in this object. +>>>>>> +>>>>>> The following example would return data sources with an `year` attribute whose value is greater than or equal to `1989` : +>>>>>> +>>>>>>> `"greaterThanOrEquals": { "key": "year", "value": 1989 }` +>>>>>> +>>>>>> key -> (string) [required] +>>>>>> +>>>>>>> The name that the metadata attribute must match. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `1` +>>>>>>> * max: `100` +>>>>>>> + +>>>>>> +>>>>>> value -> (document) [required] +>>>>>> +>>>>>>> The value to which to compare the value of the metadata attribute. +>>>>> +>>>>> in -> (structure) +>>>>> +>>>>>> Knowledge base data sources are returned if they contain a metadata attribute whose name matches the `key` and whose value is in the list specified in the `value` in this object. +>>>>>> +>>>>>> The following example would return data sources with an `animal` attribute that is either `cat` or `dog` : +>>>>>> +>>>>>>> `"in": { "key": "animal", "value": ["cat", "dog"] }` +>>>>>> +>>>>>> key -> (string) [required] +>>>>>> +>>>>>>> The name that the metadata attribute must match. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `1` +>>>>>>> * max: `100` +>>>>>>> + +>>>>>> +>>>>>> value -> (document) [required] +>>>>>> +>>>>>>> The value to which to compare the value of the metadata attribute. +>>>>> +>>>>> lessThan -> (structure) +>>>>> +>>>>>> Knowledge base data sources are returned if they contain a metadata attribute whose name matches the `key` and whose value is less than the `value` in this object. +>>>>>> +>>>>>> The following example would return data sources with an `year` attribute whose value is less than to `1989` . +>>>>>> +>>>>>>> `"lessThan": { "key": "year", "value": 1989 }` +>>>>>> +>>>>>> key -> (string) [required] +>>>>>> +>>>>>>> The name that the metadata attribute must match. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `1` +>>>>>>> * max: `100` +>>>>>>> + +>>>>>> +>>>>>> value -> (document) [required] +>>>>>> +>>>>>>> The value to which to compare the value of the metadata attribute. +>>>>> +>>>>> lessThanOrEquals -> (structure) +>>>>> +>>>>>> Knowledge base data sources are returned if they contain a metadata attribute whose name matches the `key` and whose value is less than or equal to the `value` in this object. +>>>>>> +>>>>>> The following example would return data sources with an `year` attribute whose value is less than or equal to `1989` . +>>>>>>