AWS appstream2: Agent access setup: MCP connection model vs streaming URL
Summary
Rewrites the connection guidance to describe the MCP connection model where the agent supplies stack and user ID and the MCP service establishes the session; notes that streaming URLs generated via CreateStreamingURL are still supported and passed as a request header.
Security assessment
The change is a connection-model clarification. It does mention that a streaming URL (a bearer-like session token) can still be passed as a header, but it neither introduces nor fixes a vulnerability and gives no new hardening guidance.
Evidence
+With the MCP connection model, you don't need to generate a streaming URL. When your agent connects, it provides the stack and user ID, and the MCP service establishes the streaming session. The agent-specific behavior is determined by the stack's agent access configuration.
Diff
diff --git a/appstream2/latest/developerguide/agent-access-setup.md b/appstream2/latest/developerguide/agent-access-setup.md index 455ca37..2293295 100644 --- a//appstream2/latest/developerguide/agent-access-setup.md +++ b//appstream2/latest/developerguide/agent-access-setup.md @@ -125 +125 @@ Set the `UserControlMode` attribute in the `AgentAccessConfig` to one of the fol -Agents connect to WorkSpaces Applications through a streaming URL. You generate a streaming URL by using the `CreateStreamingURL` API. No agent-specific parameters are required. The agent-specific behavior is determined by the stack's agent access configuration. The streaming URL is passed to the MCP service as a header on each request. +With the MCP connection model, you don't need to generate a streaming URL. When your agent connects, it provides the stack and user ID, and the MCP service establishes the streaming session. The agent-specific behavior is determined by the stack's agent access configuration. @@ -127 +127 @@ Agents connect to WorkSpaces Applications through a streaming URL. You generate -For more information about the `CreateStreamingURL` API, see [CreateStreamingURL](https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateStreamingURL.html) in the _Amazon AppStream 2.0 API Reference_. +You can still connect using a streaming URL. Generate one by using the `CreateStreamingURL` API and pass it to the MCP service as a header on each request. For more information about the `CreateStreamingURL` API, see [CreateStreamingURL](https://docs.aws.amazon.com/appstream2/latest/APIReference/API_CreateStreamingURL.html) in the _Amazon AppStream 2.0 API Reference_.