AWS signin documentation change

Service: signin · 2026-07-13 · Documentation low

File: signin/latest/userguide/aws-mcp-server.md

Summary

Enhanced documentation with policy links, API references, and realistic example values in CloudTrail events

Security assessment

Changes improve documentation clarity by adding hyperlinks and concrete example values. The refresh_token grant_type addition and realistic IDs improve accuracy but don't address security flaws or introduce security features.

Diff

diff --git a/signin/latest/userguide/aws-mcp-server.md b/signin/latest/userguide/aws-mcp-server.md
index c149ca2d6..2c566823d 100644
--- a//signin/latest/userguide/aws-mcp-server.md
+++ b//signin/latest/userguide/aws-mcp-server.md
@@ -32 +32 @@ Before connecting an agent to AWS MCP Server, make sure that:
-Grant the required permissions by attaching the AWS managed policy:
+Grant the required permissions by attaching the [AWS managed policy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSMCPSignInOAuthAccessPolicy.html):
@@ -169,2 +169,2 @@ API | Purpose
-`signin:IntrospectOAuth2Token` | Returns metadata describing an OAuth token.  
-`signin:RevokeOAuth2Token` | Revokes a refresh token.  
+[`IntrospectOAuth2Token`](https://docs.aws.amazon.com/signin/latest/APIReference/API_dataplane-signin_IntrospectOAuth2TokenWithIAM.html) | Returns metadata describing an OAuth token.  
+[`RevokeOAuth2Token`](https://docs.aws.amazon.com/signin/latest/APIReference/API_dataplane-signin_RevokeOAuth2TokenWithIAM.html) | Revokes a refresh token.  
@@ -234 +234 @@ Example CloudTrail events are available for:
-            "client_id": "arn:aws:signin:us-west-2::external-client/dcr/client-id"
+            "client_id": "arn:aws:signin:us-west-2::external-client/dcr/b3f2c8a1-9d4e-4f7a-8c6b-2e1f5a3d9b7c"
@@ -275 +275,2 @@ Example CloudTrail events are available for:
-                }
+                },
+                "signInSessionArn": "arn:aws:signin:us-west-2:111111111111:session/daff060f-7871-4ab6-92cd-a07bbdabe61a"
@@ -286 +287 @@ Example CloudTrail events are available for:
-            "client_id": "arn:aws:signin:us-west-2::external-client/dcr/client-id"
+            "client_id": "arn:aws:signin:us-west-2::external-client/dcr/b3f2c8a1-9d4e-4f7a-8c6b-2e1f5a3d9b7c"
@@ -290 +291,2 @@ Example CloudTrail events are available for:
-            "signInSessionArn": "arn:aws:signin:us-west-2:111111111111:session/session-id",
+            "signInSessionArn": "arn:aws:signin:us-west-2:111111111111:session/daff060f-7871-4ab6-92cd-a07bbdabe61a",
+            "grant_type": "refresh_token",