AWS appstream2: Agent access: Linux persistence note, MCP tool forwarding setup, CloudTrail data events
Summary
Adds a note that application settings persistence is Windows-only, states that MCP tool forwarding requires a configuration file on the image with a link to setup steps, and clarifies that agent tool calls are logged as CloudTrail data events requiring a trail configured for data events.
Security assessment
The change documents that AI agent tool calls are captured as CloudTrail data events and that a trail must be explicitly configured to log data events; without that configuration agent activity would be unaudited. This is audit/logging guidance rather than a fix for a specific vulnerability.
Evidence
+ * **AWS CloudTrail** — AWS CloudTrail logs agent session events. Open the AWS CloudTrail console to view agent activity. Tool calls are logged as data events, which requires a trail configured to [log data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html).
Diff
diff --git a/appstream2/latest/developerguide/getting-started-agent-access.md b/appstream2/latest/developerguide/getting-started-agent-access.md index 877f810..952db29 100644 --- a//appstream2/latest/developerguide/getting-started-agent-access.md +++ b//appstream2/latest/developerguide/getting-started-agent-access.md @@ -76 +76 @@ Create a WorkSpaces Applications stack with agent access enabled to allow AI age - * **Application settings persistence** — Optionally enable this to save your agent's application customizations and Windows settings between sessions. Settings are saved to an Amazon S3 bucket in your AWS account. + * **Application settings persistence** — Optionally enable this to save your agent's application customizations and Windows settings between sessions. Settings are saved to an Amazon S3 bucket in your AWS account. This setting is available on Windows and is not supported on Linux. @@ -78 +78 @@ Create a WorkSpaces Applications stack with agent access enabled to allow AI age - * **Enable MCP tool forwarding** — Allow agents to interact with applications and the desktop operating system through direct MCP calls rather than using computer use tools. When enabled, MCP tools configured on the WorkSpaces application session are forwarded to the agent. + * **Enable MCP tool forwarding** — Allow agents to interact with applications and the desktop operating system through direct MCP calls rather than using computer use tools. When enabled, MCP tools configured on the WorkSpaces application session are forwarded to the agent. Tool forwarding also requires a configuration file on the image. For the platform-specific path and setup steps, see [Setting up tool forwarding](./agent-access-mcp-tool-forwarding-details.html#agent-access-tool-forwarding-setup). @@ -202 +202 @@ You can verify agent activity using the following AWS services: - * **AWS CloudTrail** — AWS CloudTrail logs agent session events. Open the AWS CloudTrail console to view agent activity. + * **AWS CloudTrail** — AWS CloudTrail logs agent session events. Open the AWS CloudTrail console to view agent activity. Tool calls are logged as data events, which requires a trail configured to [log data events](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html).