AWS appstream2 documentation change
Summary
Added documentation for MCP tool forwarding and user control mode features, updated prerequisites and limitations, added VPC endpoint options for S3 access, and modified CloudWatch event names.
Security assessment
The change adds documentation for 'User control mode' which enhances security oversight by allowing real-time monitoring and stopping of agent sessions (VIEW_STOP mode). It also promotes secure S3 access through VPC endpoints. No specific vulnerability is addressed.
Diff
diff --git a/appstream2/latest/developerguide/agent-access-setup.md b/appstream2/latest/developerguide/agent-access-setup.md index 6054492db..794704c75 100644 --- a//appstream2/latest/developerguide/agent-access-setup.md +++ b//appstream2/latest/developerguide/agent-access-setup.md @@ -7 +7 @@ -PrerequisitesHow agent access worksComputer input and visionScreenshot storageDesktop screen layoutHome folder storageApplication settings persistenceStreaming URLsMCP proxy for AWSMonitoring +PrerequisitesHow agent access worksComputer input and visionScreenshot storageDesktop screen layoutHome folder storageApplication settings persistenceMCP tool forwardingUser control modeStreaming URLsMCP proxy for AWSMonitoring @@ -25,3 +25 @@ To use agent access, you need the following: - * If you plan to enable home folders, the same Amazon S3 access requirement applies. - - * A fleet running the latest WorkSpaces Applications Agent. To read more on updating your WorkSpaces Applications Agent, see [Keep Your Amazon WorkSpaces Applications Image Up-to-Date](./keep-image-updated.html). + * A fleet running the latest WorkSpaces Applications Agent. To read more on updating your WorkSpaces Applications Agent, see [Keep Your Amazon WorkSpaces Applications Image Up-to-Date](./keep-image-updated.html). For information about managing agent versions, see [Managing agent versions](https://docs.aws.amazon.com/appstream2/latest/developerguide/base-images-agent.html). @@ -38,2 +35,0 @@ WorkSpaces agent access configurations have the following limitations: - * Domain-joined fleets are not supported. - @@ -51 +47 @@ WorkSpaces agent access configurations have the following limitations: -You enable agent access when you create a stack. When agent access is enabled, the stack is configured with agent-specific settings instead of the standard Amazon WorkSpaces Applications configuration for human users. You can enable agent access through the Amazon WorkSpaces Applications console, AWS CLI, or API. +You enable agent access when you create a stack. When agent access is enabled, the stack is configured with agent-specific settings instead of the Amazon WorkSpaces Applications configuration for human users. You can enable agent access through the Amazon WorkSpaces Applications console, AWS CLI, or API. @@ -83 +79 @@ You configure the screen resolution and image format for the agent streaming env -You can enable home folders so that agent files are saved to an Amazon S3 bucket in your AWS account. The Amazon WorkSpaces Applications fleet associated with the stack must allow access to Amazon S3 through the internet. +You can enable home folders so that agent files are saved to an Amazon S3 bucket in your AWS account. The Amazon WorkSpaces Applications fleet associated with the stack must allow access to Amazon S3 through the internet or an Amazon S3 VPC endpoint. For more information, see [Enable and administer home folders for your users](https://docs.aws.amazon.com/appstream2/latest/developerguide/home-folders.html). @@ -87 +83,22 @@ You can enable home folders so that agent files are saved to an Amazon S3 bucket -You can optionally enable application settings persistence. When enabled, your agent's application customizations and Windows settings are saved after each streaming session and applied during the next session. These settings are saved to an Amazon S3 bucket in your AWS account. The Amazon WorkSpaces Applications fleet associated with the stack must allow access to Amazon S3 through the internet. +You can optionally enable application settings persistence. When enabled, your agent's application customizations and Windows settings are saved after each streaming session and applied during the next session. These settings are saved to an Amazon S3 bucket in your AWS account. The Amazon WorkSpaces Applications fleet associated with the stack must allow access to Amazon S3 through the internet or an Amazon S3 VPC endpoint. For more information, see [Enable application settings persistence for your users](https://docs.aws.amazon.com/appstream2/latest/developerguide/app-settings-persistence.html). + +## MCP tool forwarding + +You can enable MCP tool forwarding to allow agents to interact with applications and the desktop operating system through direct MCP calls rather than using computer use tools. When enabled, MCP tools available on your WorkSpaces application session are forwarded to the agent. The forwarded tools appear when the agent lists its available tools. + +## User control mode + +You can enable user control mode to allow users to observe and interact with agent sessions in real time. When user control mode is enabled, observers connect to the session through their browser using a streaming URL. They see a real-time view of the desktop as the agent interacts with it. + +In `VIEW_STOP` mode, a stop button appears at the top of the observer's screen. The observer can use this button to stop the agent if needed. Once an agent is stopped, it must start a new session to resume work. + +Set the `UserControlMode` attribute in the `AgentAccessConfig` to one of the following values: + + * `VIEW_ONLY` — Users can view and observe agent actions as they happen. + + * `VIEW_STOP` — Users can view agent actions and stop the agent if needed. + + * `DISABLED` — Users cannot view or stop the agent session. + + + @@ -117 +134 @@ You can monitor agent activity through the following services: - * `SessionStart` + * `McpSessionStart` @@ -119 +136 @@ You can monitor agent activity through the following services: - * `SessionEnd` + * `McpSessionDuration` @@ -132 +149 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Provide agents access to WorkSpaces [Preview] +Provide agents access to WorkSpaces