AWS cli medium security documentation change
Summary
Added new 'remoteagent' and 'remoteagentsigv4' integration options, documented new 'runtimeRoleArn' field with IAM ARN constraints, added parameter constraints (min/max values), and updated CLI version references.
Security assessment
The change introduces a new 'runtimeRoleArn' field that controls runtime permissions for automatic verification and VPC connectivity, which directly impacts access control. The ARN pattern constraint (arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+) enforces secure IAM role usage. New SigV4 authentication method ('remoteagentsigv4') enhances secure communication. Input validation constraints (min/max) help prevent overprivileged configurations.
Diff
diff --git a/cli/latest/reference/devops-agent/list-associations.md b/cli/latest/reference/devops-agent/list-associations.md index 3189bee6b..9380f5fd6 100644 --- a//cli/latest/reference/devops-agent/list-associations.md +++ b//cli/latest/reference/devops-agent/list-associations.md @@ -15 +15 @@ - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) » @@ -129,0 +130,7 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops +> +> Constraints: +> +> * min: `1` +> * max: `100` +> + @@ -329 +336 @@ associations -> (list) ->>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sourceAws`, `aws`, `github`, `slack`, `dynatrace`, `servicenow`, `mcpservernewrelic`, `mcpserverdatadog`, `mcpserver`, `gitlab`, `mcpserversplunk`, `eventChannel`, `azure`, `azuredevops`, `mcpservergrafana`, `pagerduty`, `mcpserversigv4`. +>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sourceAws`, `aws`, `github`, `slack`, `dynatrace`, `servicenow`, `mcpservernewrelic`, `mcpserverdatadog`, `mcpserver`, `gitlab`, `mcpserversplunk`, `eventChannel`, `azure`, `azuredevops`, `mcpservergrafana`, `pagerduty`, `mcpserversigv4`, `remoteagent`, `remoteagentsigv4`. @@ -436,0 +444,12 @@ associations -> (list) +>>>> +>>>> runtimeRoleArn -> (string) +>>>> +>>>>> Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `255` +>>>>> * pattern: `arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+` +>>>>> + @@ -588,0 +608,12 @@ associations -> (list) +>>>> +>>>> runtimeRoleArn -> (string) +>>>> +>>>>> Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `255` +>>>>> * pattern: `arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+` +>>>>> + @@ -692,0 +724,31 @@ associations -> (list) +>>> +>>> remoteagent -> (structure) +>>> +>>>> Remote A2A agent integration configuration (token-based auth). +>>> +>>> remoteagentsigv4 -> (structure) +>>> +>>>> Remote A2A agent integration configuration (SigV4 auth). +>> +>> capabilities -> (map) +>> +>>> Enabled capabilities for this association. +>>> +>>> key -> (string) +>>> +>>>> AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association. +>>>> +>>>> Possible values: +>>>> +>>>> * `RELEASE_READINESS_REVIEW` +>>>> * `RELEASE_READINESS_REVIEW_AUTOMATED_TESTING` +>>>> + +>>> +>>> value -> (structure) +>>> +>>>> Capability configuration for the AWS DevOps Agent. +>>>> +>>>> enabled -> (boolean) +>>>> +>>>>> Whether the capability is enabled. @@ -704 +766 @@ associations -> (list) - * [AWS CLI 2.35.5 Command Reference](../../index.html) » + * [AWS CLI 2.35.8 Command Reference](../../index.html) »