AWS appstream2: Document new agentaccess-mcp IAM actions and endpoint note
Summary
Adds the agentaccess-mcp:LaunchApplication and agentaccess-mcp:ToggleAppSwitcher actions to the wildcard action list, adds a pointer to supported Regions/endpoints, and lowercases the x-amzn-agentaccess-streaming-session-url header in the mcp-proxy example.
Security assessment
The change expands the documented IAM action set that the agentaccess-mcp:* wildcard covers, which is directly relevant to least-privilege scoping of agent permissions, but it documents new capabilities rather than fixing a permission flaw.
Evidence
+ * `agentaccess-mcp:LaunchApplication` — Launch a cataloged application in the current session
Diff
diff --git a/appstream2/latest/developerguide/getting-started-agent-access.md b/appstream2/latest/developerguide/getting-started-agent-access.md index 2f1b38b..db73889 100644 --- a//appstream2/latest/developerguide/getting-started-agent-access.md +++ b//appstream2/latest/developerguide/getting-started-agent-access.md @@ -100,0 +101,4 @@ The `agentaccess-mcp:*` wildcard includes the following actions: + * `agentaccess-mcp:LaunchApplication` — Launch a cataloged application in the current session + + * `agentaccess-mcp:ToggleAppSwitcher` — Open or close the app-switcher overlay + @@ -239,0 +244,2 @@ Your agent connects to the managed MCP service at the following fixed endpoint: +Replace `region` with your Region code. For the supported Regions and their endpoints, see [WorkSpaces Applications MCP endpoints](./allowed-domains.html#allowed-domains-mcp-endpoints). + @@ -250 +256 @@ The following example shows how to establish the connection using mcp-proxy-for- - "X-Amzn-AgentAccess-Streaming-Session-Url": streaming_url, + "x-amzn-agentaccess-streaming-session-url": streaming_url,