AWS cli documentation change
Summary
Updated documentation for 'get-harness' command. Changes include: added harness-version parameter, updated navigation links, added awsSkills tool type, refined git URL pattern, added allowedWorkloadConfiguration for invocation restrictions, added managed/disabled memory configurations, and standardized 'Harness' to lowercase 'harness' throughout.
Security assessment
The change adds documentation for security features including workload restrictions (allowedWorkloadConfiguration with hostingEnvironments/workloadIdentities) and encryption (managedMemoryConfiguration.encryptionKeyArn). However, there's no evidence this addresses a specific vulnerability; it documents new security capabilities.
Diff
diff --git a/cli/latest/reference/bedrock-agentcore-control/get-harness.md b/cli/latest/reference/bedrock-agentcore-control/get-harness.md index 1aa0bffc8..168e6ee05 100644 --- a//cli/latest/reference/bedrock-agentcore-control/get-harness.md +++ b//cli/latest/reference/bedrock-agentcore-control/get-harness.md @@ -13 +13 @@ - * [next](get-memory.html "get-memory") | + * [next](get-harness-endpoint.html "get-harness-endpoint") | @@ -15 +15 @@ - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) » @@ -23 +23 @@ - * [get-memory →](get-memory.html "next chapter \(use the right arrow\)") + * [get-harness-endpoint →](get-harness-endpoint.html "next chapter \(use the right arrow\)") @@ -59 +59 @@ First time using the AWS CLI? See the [User Guide](https://docs.aws.amazon.com/c -Operation to get a single Harness. +Operation to get a single harness. @@ -69,0 +70 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc + [--harness-version <value>] @@ -104,0 +106,12 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/bedroc +`--harness-version` (string) + +> Specific version of the harness to retrieve. If omitted, returns the current Harness configuration, including its status. +> +> Constraints: +> +> * min: `1` +> * max: `5` +> * pattern: `([1-9][0-9]{0,4})` +> + + @@ -224 +237 @@ harness -> (structure) ->> The ID of the Harness. +>> The ID of the harness. @@ -234 +247 @@ harness -> (structure) ->> The name of the Harness. +>> The name of the harness. @@ -244 +257 @@ harness -> (structure) ->> The ARN of the Harness. +>> The ARN of the harness. @@ -254 +267 @@ harness -> (structure) ->> The status of the Harness. +>> The status of the harness. @@ -266,0 +280,12 @@ harness -> (structure) +> +> harnessVersion -> (string) +> +>> The version of the harness. Incremented on every successful UpdateHarness. +>> +>> Constraints: +>> +>> * min: `1` +>> * max: `5` +>> * pattern: `([1-9][0-9]{0,4})` +>> + @@ -270 +295 @@ harness -> (structure) ->> IAM role the Harness assumes when running. +>> IAM role the harness assumes when running. @@ -282 +307 @@ harness -> (structure) ->> The createdAt time of the Harness. +>> The createdAt time of the harness. @@ -286 +311 @@ harness -> (structure) ->> The updatedAt time of the Harness. +>> The updatedAt time of the harness. @@ -545 +570 @@ harness -> (structure) ->> The system prompt of the Harness. +>> The system prompt of the harness. @@ -567 +592 @@ harness -> (structure) ->> The tools of the Harness. +>> The tools of the harness. @@ -820 +845 @@ harness -> (structure) ->> The skills of the Harness. +>> The skills of the harness. @@ -828 +853 @@ harness -> (structure) ->>> This is a Tagged Union structure. Only one of the following top level keys can be set: `path`, `s3`, `git`. +>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `path`, `s3`, `git`, `awsSkills`. @@ -866 +891 @@ harness -> (structure) ->>>>> * pattern: `https://.*` +>>>>> * pattern: `https://[^#@]+` @@ -890,0 +916,18 @@ harness -> (structure) +>>> +>>> awsSkills -> (structure) +>>> +>>>> AWS Skills baked into the harness’s underlying Runtime. +>>>> +>>>> paths -> (list) +>>>> +>>>>> Optionally filter allowed skills with glob syntax, e.g., [‘core-skills/*’]. +>>>>> +>>>>> (string) +>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `1` +>>>>>> * max: `4096` +>>>>>> * pattern: `([^*?\[\]]|\*)+` +>>>>>> + @@ -894 +937 @@ harness -> (structure) ->> The allowed tools of the Harness. All tools are allowed by default. +>> The allowed tools of the harness. All tools are allowed by default. @@ -1199 +1242 @@ harness -> (structure) ->> Environment variables exposed in the environment in which the Harness operates. +>> Environment variables exposed in the environment in which the harness operates. @@ -1666,0 +1710,51 @@ harness -> (structure) +>>> +>>> allowedWorkloadConfiguration -> (structure) +>>> +>>>> The configuration that restricts which workloads in the request’s identity chain are allowed to invoke the target, identified by their hosting environments and workload identities. At launch, this is supported only for AgentCore Runtime targets, and the allowed workloads are AgentCore Gateways. +>>>> +>>>> hostingEnvironments -> (list) +>>>> +>>>>> The list of hosting environments whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `10` +>>>>> + +>>>>> +>>>>> (structure) +>>>>> +>>>>>> A hosting environment whose workloads are allowed to invoke the target. At launch, the only supported hosting environment is AgentCore Gateway. +>>>>>> +>>>>>> arn -> (string) [required] +>>>>>> +>>>>>>> The Amazon Resource Name (ARN) of the hosting environment. +>>>>>>> +>>>>>>> Constraints: +>>>>>>> +>>>>>>> * min: `20` +>>>>>>> * max: `1011` +>>>>>>> + +>>>> +>>>> workloadIdentities -> (list) +>>>> +>>>>> The list of workload identities that are allowed to invoke the target. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `10` +>>>>> + +>>>>> +>>>>> (string) +>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `3` +>>>>>> * max: `255` +>>>>>> * pattern: `[A-Za-z0-9_.-]+` +>>>>>> + @@ -1674 +1768 @@ harness -> (structure) ->> This is a Tagged Union structure. Only one of the following top level keys can be set: `agentCoreMemoryConfiguration`. +>> This is a Tagged Union structure. Only one of the following top level keys can be set: `agentCoreMemoryConfiguration`, `managedMemoryConfiguration`, `disabled`. @@ -1718,0 +1813,63 @@ harness -> (structure) +>> +>> managedMemoryConfiguration -> (structure) +>> +>>> Harness creates and manages a memory resource in the customer’s account. +>>> +>>> arn -> (string) +>>> +>>>> The ARN of the managed AgentCore Memory resource. Read-only on Get, ignored on Create/Update input. +>>>> +>>>> Constraints: +>>>> +>>>> * pattern: `arn:aws:bedrock-agentcore:[a-z0-9-]+:[0-9]{12}:memory\/[a-zA-Z][a-zA-Z0-9-_]{0,99}-[a-zA-Z0-9]{10}` +>>>> + +>>> +>>> strategies -> (list) +>>> +>>>> Strategy types to enable. Defaults to [SEMANTIC, SUMMARIZATION]. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `4` +>>>> + +>>>> +>>>> (string) +>>>> +>>>>> Possible values: +>>>>> +>>>>> * `SEMANTIC` +>>>>> * `SUMMARIZATION` +>>>>> * `USER_PREFERENCE` +>>>>> * `EPISODIC` +>>>>> + +>>> +>>> eventExpiryDuration -> (integer) +>>>