AWS appstream2 medium security documentation change
Summary
Added session concurrency limitations, updated authentication requirements to mandate certificate-based authentication for agent sessions, expanded MCP server configuration details with JSON specifications, and added security considerations for tool forwarding.
Security assessment
Mandating certificate-based authentication (explicitly required for agent sessions) directly addresses authentication security. Added transport limitations (stdio-only) and path security considerations prevent injection vulnerabilities. IAM condition key change ('ponte-mcp' to 'agentaccess-mcp') corrects potential misconfiguration risks.
Diff
diff --git a/appstream2/latest/developerguide/agent-access-mcp-server.md b/appstream2/latest/developerguide/agent-access-mcp-server.md index 1a8a9ce22..d05e340b3 100644 --- a//appstream2/latest/developerguide/agent-access-mcp-server.md +++ b//appstream2/latest/developerguide/agent-access-mcp-server.md @@ -59,0 +60,4 @@ How you authenticate the streaming session depends on your fleet type: +###### Note + +At any given time, only one agent can connect to a unique session. Named users, specified through the `UserId` parameter, can have only one active session per fleet at a time. To run multiple agents concurrently, each agent must connect to its own unique session. + @@ -92 +96 @@ For more information about the `CreateStreamingURL` API, see [CreateStreamingURL -When agents access domain-joined streaming instances, the connection must be federated through a SAML provider. This requirement applies to both standard and agent sessions. Standard sessions allow users to enter their password manually or use certificate-based authentication for a seamless login experience. For agent sessions, certificate-based authentication is required. +When agents access domain-joined streaming instances, the connection must be federated through a SAML provider. This requirement applies to both traditional and agent sessions. For agent sessions, [Certificate-Based Authentication](./certificate-based-authentication.html) is required. @@ -295 +299 @@ To set up MCP tool forwarding: - 2. **Configure the MCP server on the WorkSpace** — The service looks for a configuration file at the following path: + 2. **Verify that the MCP server configuration file is present** — The service looks for a configuration file at the following path: @@ -299 +303,20 @@ To set up MCP tool forwarding: - 3. **Verify tool availability** — If the configuration file is present, the service connects to the MCP servers configured in the file and forwards the tools. The forwarded tools appear when the agent lists its available tools. + 3. **Configure the MCP server on the WorkSpace image** — The configuration file is JSON with a single top-level `mcpServers` object. Each key is a unique name that you choose for a server. Each value specifies how to launch that server. + + { + "mcpServers": { + "filesystem": { + "command": "C:/path/to/python.exe", + "args": ["C:/mcpServerPath/filesystem.py", "C:/UserName/Documents"] + }, + "weather": { + "command": "C:/Program Files/my-mcp/weather.exe" + } + } + } + +Field | Required | Type | Description +---|---|---|--- +`command` | Yes | String | Absolute path to the executable to launch. +`args` | No | Array of strings | Arguments passed to the executable. + + 4. **Verify tool availability** — If the configuration file is present, the service connects to the MCP servers configured in the file and forwards the tools. The forwarded tools appear when the agent lists its available tools. @@ -307,0 +331,24 @@ Both IAM access and the service setting must be enabled for tool forwarding to w +### MCP tool forwarding considerations + +Note the following considerations when you configure MCP tool forwarding: + + * **Transport is standard I/O (stdio) only.** Each entry must launch a process that speaks MCP over its standard input and output. Remote HTTP or SSE MCP endpoints are not supported. To use a remote endpoint, wrap it in a local stdio server. + + * **Only`command` and `args` are supported.** There is no field for environment variables or working directory. Each server inherits the environment of the streaming session and runs as the session user. Use absolute paths for `command` and for any path arguments. + + * **Use forward slashes in paths** (for example, `C:/Program Files/my-mcp/server.exe`). JSON treats the backslash as an escape character, so a Windows-style path written with single backslashes is invalid. Windows accepts forward slashes for absolute paths, which avoids the need to escape every separator as `\\`. + + * **Tool-call timeout.** Each forwarded tool call must complete within 5 seconds. The MCP server cancels calls that take longer and returns an error to the agent. Design forwarded tools to return quickly. + + + + +### How forwarded tools appear to the agent + +To prevent collisions between servers, the MCP server renames each forwarded tool in the agent's tool list using the following pattern: + + + forwarded___server-name___original-tool-name + +The `server-name` is the key from your configuration file. For example, a `get_forecast` tool from the `weather` server is listed as `forwarded___weather___get_forecast`. When the agent calls the forwarded name, the MCP server routes the request to the original tool on the owning server. Agent code that matches on tool names must expect this prefix. + @@ -318 +365 @@ The IAM action for calling forwarded tools is `CallForwardedTool`. You can scope - "ponte-mcp:StackArn": "arn:aws:appstream:region:account-id:stack/stack-name" + "agentaccess-mcp:StackArn": "arn:aws:appstream:region:account-id:stack/stack-name"