AWS cli medium security documentation change

Service: cli · 2026-06-19 · Security-related medium

File: cli/latest/reference/devops-agent/update-association.md

Summary

Added support for new remote agent integrations (remoteagent, remoteagentsigv4), introduced runtimeRoleArn for secure VPC connectivity/testing, and added --capabilities option for enabling automated release readiness features.

Security assessment

Added runtimeRoleArn with IAM ARN pattern validation for secure role assumption during automated testing and VPC connectivity. Introduced new SigV4 authentication method for remote agents, which is a security protocol. Documented IAM role constraints and authentication methods.

Diff

diff --git a/cli/latest/reference/devops-agent/update-association.md b/cli/latest/reference/devops-agent/update-association.md
index 67a300304..0124a038d 100644
--- a//cli/latest/reference/devops-agent/update-association.md
+++ b//cli/latest/reference/devops-agent/update-association.md
@@ -15 +15 @@
-  * [AWS CLI 2.35.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.35.8 Command Reference](../../index.html) »
@@ -69,0 +70 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+    [--capabilities <value>]
@@ -123 +124 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
-> This is a Tagged Union structure. Only one of the following top level keys can be set: `sourceAws`, `aws`, `github`, `slack`, `dynatrace`, `servicenow`, `mcpservernewrelic`, `mcpserverdatadog`, `mcpserver`, `gitlab`, `mcpserversplunk`, `eventChannel`, `azure`, `azuredevops`, `mcpservergrafana`, `pagerduty`, `mcpserversigv4`.
+> This is a Tagged Union structure. Only one of the following top level keys can be set: `sourceAws`, `aws`, `github`, `slack`, `dynatrace`, `servicenow`, `mcpservernewrelic`, `mcpserverdatadog`, `mcpserver`, `gitlab`, `mcpserversplunk`, `eventChannel`, `azure`, `azuredevops`, `mcpservergrafana`, `pagerduty`, `mcpserversigv4`, `remoteagent`, `remoteagentsigv4`.
@@ -230,0 +232,12 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>> 
+>> runtimeRoleArn -> (string)
+>>
+>>> Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `1`
+>>>   * max: `255`
+>>>   * pattern: `arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+`
+>>> 
+
@@ -382,0 +396,12 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+>> 
+>> runtimeRoleArn -> (string)
+>>
+>>> Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `1`
+>>>   * max: `255`
+>>>   * pattern: `arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+`
+>>> 
+
@@ -486,0 +512,8 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/devops
+> 
+> remoteagent -> (structure)
+>
+>> Remote A2A agent integration configuration (token-based auth).
+> 
+> remoteagentsigv4 -> (structure)
+>
+>> Remote A2A agent integration configuration (SigV4 auth).
@@ -508 +541,2 @@ JSON Syntax:
-        "instanceIdentifier": "string"
+        "instanceIdentifier": "string",
+        "runtimeRoleArn": "string"
@@ -545 +579,2 @@ JSON Syntax:
-        "instanceIdentifier": "string"
+        "instanceIdentifier": "string",
+        "runtimeRoleArn": "string"
@@ -571,0 +607,6 @@ JSON Syntax:
+      },
+      "remoteagent": {
+    
+      },
+      "remoteagentsigv4": {
+    
@@ -575,0 +617,42 @@ JSON Syntax:
+`--capabilities` (map)
+
+> Enabled capabilities for this association.
+> 
+> key -> (string)
+>
+>> AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association.
+>> 
+>> Possible values:
+>> 
+>>   * `RELEASE_READINESS_REVIEW`
+>>   * `RELEASE_READINESS_REVIEW_AUTOMATED_TESTING`
+>> 
+
+> 
+> value -> (structure)
+>
+>> Capability configuration for the AWS DevOps Agent.
+>> 
+>> enabled -> (boolean)
+>>
+>>> Whether the capability is enabled.
+
+Shorthand Syntax:
+    
+    
+      KeyName1={enabled=boolean},KeyName2={enabled=boolean}
+    
+    Where valid key names are:
+      RELEASE_READINESS_REVIEW
+      RELEASE_READINESS_REVIEW_AUTOMATED_TESTING
+    
+
+JSON Syntax:
+    
+    
+    {"RELEASE_READINESS_REVIEW"|"RELEASE_READINESS_REVIEW_AUTOMATED_TESTING": {
+          "enabled": true|false
+        }
+      ...}
+    
+
@@ -753 +836 @@ association -> (structure)
->> This is a Tagged Union structure. Only one of the following top level keys can be set: `sourceAws`, `aws`, `github`, `slack`, `dynatrace`, `servicenow`, `mcpservernewrelic`, `mcpserverdatadog`, `mcpserver`, `gitlab`, `mcpserversplunk`, `eventChannel`, `azure`, `azuredevops`, `mcpservergrafana`, `pagerduty`, `mcpserversigv4`.
+>> This is a Tagged Union structure. Only one of the following top level keys can be set: `sourceAws`, `aws`, `github`, `slack`, `dynatrace`, `servicenow`, `mcpservernewrelic`, `mcpserverdatadog`, `mcpserver`, `gitlab`, `mcpserversplunk`, `eventChannel`, `azure`, `azuredevops`, `mcpservergrafana`, `pagerduty`, `mcpserversigv4`, `remoteagent`, `remoteagentsigv4`.
@@ -860,0 +944,12 @@ association -> (structure)
+>>> 
+>>> runtimeRoleArn -> (string)
+>>>
+>>>> Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
+>>>> 
+>>>> Constraints:
+>>>> 
+>>>>   * min: `1`
+>>>>   * max: `255`
+>>>>   * pattern: `arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+`
+>>>> 
+
@@ -1012,0 +1108,12 @@ association -> (structure)
+>>> 
+>>> runtimeRoleArn -> (string)
+>>>
+>>>> Optional role ARN that AIDevOps assumes at runtime for automatic verification testing and VPC connectivity on this association.
+>>>> 
+>>>> Constraints:
+>>>> 
+>>>>   * min: `1`
+>>>>   * max: `255`
+>>>>   * pattern: `arn:aws:iam::\d{12}:role/[a-zA-Z0-9+=,.@_/-]+`
+>>>> 
+
@@ -1116,0 +1224,31 @@ association -> (structure)
+>> 
+>> remoteagent -> (structure)
+>>
+>>> Remote A2A agent integration configuration (token-based auth).
+>> 
+>> remoteagentsigv4 -> (structure)
+>>
+>>> Remote A2A agent integration configuration (SigV4 auth).
+> 
+> capabilities -> (map)
+>
+>> Enabled capabilities for this association.
+>> 
+>> key -> (string)
+>>
+>>> AWS DevOps Agent capability types representing the set of automated capabilities that can be enabled per association.
+>>> 
+>>> Possible values:
+>>> 
+>>>   * `RELEASE_READINESS_REVIEW`
+>>>   * `RELEASE_READINESS_REVIEW_AUTOMATED_TESTING`
+>>> 
+
+>> 
+>> value -> (structure)
+>>
+>>> Capability configuration for the AWS DevOps Agent.
+>>> 
+>>> enabled -> (boolean)
+>>>
+>>>> Whether the capability is enabled.
@@ -1167 +1305 @@ webhook -> (structure)
-  * [AWS CLI 2.35.5 Command Reference](../../index.html) »
+  * [AWS CLI 2.35.8 Command Reference](../../index.html) »