AWS appstream2: Agent access guide: MCP server rename, prerequisites moved
Summary
Editorial rewrite of the WorkSpaces Applications agent access getting-started page: 'MCP service' renamed to 'MCP server', minor wording fixes, and the entire inline Prerequisites section (including the sample IAM policy with the agentaccess-mcp:* wildcard and the full action list) removed and replaced with a link to a new Prerequisites page. Navigation label changed from 'MCP Server' to 'Monitoring'.
Security assessment
The change is a documentation restructure: the detailed IAM permission block (including the broad agentaccess-mcp:* wildcard) is deleted from this page and relocated to a separate prerequisites page, so no new security control or vulnerability fix is introduced here. The only security-adjacent content is the pointer to permissions prerequisites, which is a relocation rather than new guidance.
Evidence
+Before you begin, review the agent access requirements. For the account, fleet, permissions, and agent prerequisites, see [Prerequisites](./agent-access-mcp-prerequisites.html).
Diff
diff --git a/appstream2/latest/developerguide/getting-started-agent-access.md b/appstream2/latest/developerguide/getting-started-agent-access.md index db73889..877f810 100644 --- a//appstream2/latest/developerguide/getting-started-agent-access.md +++ b//appstream2/latest/developerguide/getting-started-agent-access.md @@ -7 +7 @@ -Write agent code with the Agent Toolkit for AWSPrerequisitesStep 1: Create a stack with agent access enabledStep 2: Generate a streaming URLStep 3: Connect your agent to the MCP serviceStep 4: Verify agent activityStep 5: Clean up resources +Write agent code with the Agent Toolkit for AWSPrerequisitesStep 1: Create a stack with agent access enabledStep 2: Generate a streaming URLStep 3: Connect your agent to the MCP serverStep 4: Verify agent activityStep 5: Clean up resources @@ -11 +11 @@ Write agent code with the Agent Toolkit for AWSPrerequisitesStep 1: Create a sta -To enable AI agents to operate desktop applications through Amazon WorkSpaces Applications, you create a stack with access enabled for agents, generate a streaming URL, and connect your agent to the managed MCP service. +To enable AI agents to operate desktop applications through Amazon WorkSpaces Applications, you create a stack with access enabled for agents, generate a streaming URL, and connect your agent to the managed MCP server. @@ -27 +27 @@ In this tutorial, you complete the following tasks: - * Step 3: Connect your agent to the MCP service + * Step 3: Connect your agent to the MCP server @@ -46,65 +46 @@ To get started, ask your agent "Help me complete the getting started WorkSpaces -Before you begin, make sure you have the following: - - * An active Amazon WorkSpaces Applications fleet. If you haven't set one up yet, see [Get Started with Amazon WorkSpaces Applications: Set Up With Sample Applications](./getting-started.html). - - * AWS credentials (environment variables, AWS profile, EC2 instance role, or Lambda execution role) with the following IAM permissions. The agent uses these credentials directly to sign requests to the MCP service: - - { - "Sid": "MCP", - "Effect": "Allow", - "Action": ["agentaccess-mcp:*"], - "Resource": "*" - }, - { - "Sid": "AppStream", - "Effect": "Allow", - "Action": ["appstream:CreateStreamingURL", "appstream:DescribeFleets"], - "Resource": "*" - } - -The `agentaccess-mcp:*` wildcard includes the following actions: - - * `agentaccess-mcp:InvokeMcp` — Initialize sessions and discover tools - - * `agentaccess-mcp:GetScreenshot` — Capture screen state - - * `agentaccess-mcp:LeftClick` — Perform left mouse click - - * `agentaccess-mcp:DoubleClick` — Perform double click - - * `agentaccess-mcp:TripleClick` — Perform triple click - - * `agentaccess-mcp:RightClick` — Perform right mouse click - - * `agentaccess-mcp:MiddleClick` — Perform middle mouse click - - * `agentaccess-mcp:TypeText` — Type text string - - * `agentaccess-mcp:KeyPress` — Press key or key combination - - * `agentaccess-mcp:HoldKey` — Hold key for duration - - * `agentaccess-mcp:Scroll` — Scroll at coordinates - - * `agentaccess-mcp:MovePointer` — Move pointer to coordinates - - * `agentaccess-mcp:LeftClickDrag` — Perform left click drag - - * `agentaccess-mcp:LeftMouseDown` — Press and hold left mouse button - - * `agentaccess-mcp:LeftMouseUp` — Release left mouse button - - * `agentaccess-mcp:CheckConnectionStatus` — Check connection status of a streaming session - - * `agentaccess-mcp:CallForwardedTool` — Invoke a forwarded tool on a remote instance - - * `agentaccess-mcp:LaunchApplication` — Launch a cataloged application in the current session - - * `agentaccess-mcp:ToggleAppSwitcher` — Open or close the app-switcher overlay - - * An MCP-compatible agent framework. The agent must be able to make SigV4-signed Streamable HTTP requests to the MCP endpoint. The [Strands Agents SDK](https://strandsagents.com/docs/user-guide/concepts/tools/mcp-tools/) provides native MCP client support, or you can use any framework with the mcp-proxy-for-aws transport. - - * Python 3.10 or later. No specific operating system is required. - - - +Before you begin, review the agent access requirements. For the account, fleet, permissions, and agent prerequisites, see [Prerequisites](./agent-access-mcp-prerequisites.html). @@ -144 +80 @@ Create a WorkSpaces Applications stack with agent access enabled to allow AI age - * **Enable user control mode** — Allow users to observe agent sessions in real time through their browser. Observers see a live view of the desktop as the agent works. In VIEW_STOP mode, observers can stop the agent using a button at the top of the screen. Once stopped, the agent must start a new session to resume. + * **Enable user control mode** — Allow users to observe agent sessions in real time through their browser. Observers see a live view of the desktop as the agent works. In VIEW_STOP mode, observers can stop the agent using a button at the top of the screen. After the agent stops, it must start a new session to resume. @@ -214 +150 @@ Create a streaming URL using the standard WorkSpaces Applications `CreateStreami - 5. In the **URL expiration** section, select the time you want the URL to be valid. A shorter time is recommended. 30 minutes is the default and recommended for testing. + 5. In the **URL expiration** section, select the time you want the URL to be valid. A shorter time is recommended. The default is 30 minutes, which is recommended for testing. @@ -238 +174 @@ At any given time, only one agent can connect to a unique session. Named users, -## Step 3: Connect your agent to the MCP service +## Step 3: Connect your agent to the MCP server @@ -240 +176 @@ At any given time, only one agent can connect to a unique session. Named users, -Your agent connects to the managed MCP service at the following fixed endpoint: +Your agent connects to the managed MCP server at the following fixed endpoint: @@ -327 +263 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -MCP Server +Monitoring