AWS cli medium security documentation change
Summary
Added new remote agent integrations, runtime IAM role configuration, and release readiness capabilities
Security assessment
Added security features including: 1) runtimeRoleArn for controlled AWS access during verification/testing with strict IAM constraints (min/max/pattern validation), 2) SigV4 authentication for remote agents, 3) capability controls for security-sensitive operations. These directly impact authorization and runtime security.
Diff
diff --git a/cli/latest/reference/devops-agent/associate-service.md b/cli/latest/reference/devops-agent/associate-service.md index 115eeda62..71089e695 100644 --- a//cli/latest/reference/devops-agent/associate-service.md +++ b//cli/latest/reference/devops-agent/associate-service.md @@ -15 +15 @@ - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) » @@ -69,0 +70 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops + [--capabilities <value>] @@ -123 +124 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops -> This is a Tagged Union structure. Only one of the following top level keys can be set: `sourceAws`, `aws`, `github`, `slack`, `dynatrace`, `servicenow`, `mcpservernewrelic`, `mcpserverdatadog`, `mcpserver`, `gitlab`, `mcpserversplunk`, `eventChannel`, `azure`, `azuredevops`, `mcpservergrafana`, `pagerduty`, `mcpserversigv4`. +> This is a Tagged Union structure. Only one of the following top level keys can be set: `sourceAws`, `aws`, `github`, `slack`, `dynatrace`, `servicenow`, `mcpservernewrelic`, `mcpserverdatadog`, `mcpserver`, `gitlab`, `mcpserversplunk`, `eventChannel`, `azure`, `azuredevops`, `mcpservergrafana`, `pagerduty`, `mcpserversigv4`, `remoteagent`, `remoteagentsigv4`. @@ -230,0 +232,12 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops +>> +>> runtimeRoleArn -> (string) +>> +>>> Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association. +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `255` +>>> * pattern: `arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+` +>>> + @@ -382,0 +396,12 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops +>> +>> runtimeRoleArn -> (string) +>> +>>> Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association. +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `255` +>>> * pattern: `arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+` +>>> + @@ -486,0 +512,8 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops +> +> remoteagent -> (structure) +> +>> Remote A2A agent integration configuration (token-based auth). +> +> remoteagentsigv4 -> (structure) +> +>> Remote A2A agent integration configuration (SigV4 auth). @@ -508 +541,2 @@ JSON Syntax: - "instanceIdentifier": "string" + "instanceIdentifier": "string", + "runtimeRoleArn": "string" @@ -545 +579,2 @@ JSON Syntax: - "instanceIdentifier": "string" + "instanceIdentifier": "string", + "runtimeRoleArn": "string" @@ -571,0 +607,6 @@ JSON Syntax: + }, + "remoteagent": { + + }, + "remoteagentsigv4": { + @@ -575,0 +617,42 @@ JSON Syntax: +`--capabilities` (map) + +> Enabled capabilities for this association. +> +> key -> (string) +> +>> AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association. +>> +>> Possible values: +>> +>> * `RELEASE_READINESS_REVIEW` +>> * `RELEASE_READINESS_REVIEW_AUTOMATED_TESTING` +>> + +> +> value -> (structure) +> +>> Capability configuration for the AWS DevOps Agent. +>> +>> enabled -> (boolean) +>> +>>> Whether the capability is enabled. + +Shorthand Syntax: + + + KeyName1={enabled=boolean},KeyName2={enabled=boolean} + + Where valid key names are: + RELEASE_READINESS_REVIEW + RELEASE_READINESS_REVIEW_AUTOMATED_TESTING + + +JSON Syntax: + + + {"RELEASE_READINESS_REVIEW"|"RELEASE_READINESS_REVIEW_AUTOMATED_TESTING": { + "enabled": true|false + } + ...} + + @@ -753 +836 @@ association -> (structure) ->> This is a Tagged Union structure. Only one of the following top level keys can be set: `sourceAws`, `aws`, `github`, `slack`, `dynatrace`, `servicenow`, `mcpservernewrelic`, `mcpserverdatadog`, `mcpserver`, `gitlab`, `mcpserversplunk`, `eventChannel`, `azure`, `azuredevops`, `mcpservergrafana`, `pagerduty`, `mcpserversigv4`. +>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sourceAws`, `aws`, `github`, `slack`, `dynatrace`, `servicenow`, `mcpservernewrelic`, `mcpserverdatadog`, `mcpserver`, `gitlab`, `mcpserversplunk`, `eventChannel`, `azure`, `azuredevops`, `mcpservergrafana`, `pagerduty`, `mcpserversigv4`, `remoteagent`, `remoteagentsigv4`. @@ -860,0 +944,12 @@ association -> (structure) +>>> +>>> runtimeRoleArn -> (string) +>>> +>>>> Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `255` +>>>> * pattern: `arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+` +>>>> + @@ -1012,0 +1108,12 @@ association -> (structure) +>>> +>>> runtimeRoleArn -> (string) +>>> +>>>> Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association. +>>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `255` +>>>> * pattern: `arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+` +>>>> + @@ -1116,0 +1224,31 @@ association -> (structure) +>> +>> remoteagent -> (structure) +>> +>>> Remote A2A agent integration configuration (token-based auth). +>> +>> remoteagentsigv4 -> (structure) +>> +>>> Remote A2A agent integration configuration (SigV4 auth). +> +> capabilities -> (map) +> +>> Enabled capabilities for this association. +>> +>> key -> (string) +>> +>>> AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association. +>>> +>>> Possible values: +>>> +>>> * `RELEASE_READINESS_REVIEW` +>>> * `RELEASE_READINESS_REVIEW_AUTOMATED_TESTING` +>>> + +>> +>> value -> (structure) +>> +>>> Capability configuration for the AWS DevOps Agent. +>>> +>>> enabled -> (boolean) +>>> +>>>> Whether the capability is enabled. @@ -1167 +1305 @@ webhook -> (structure) - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) »