AWS appstream2: Document SigV4 and OAuth bearer authorization for MCP agent access
Summary
Updates the MCP agent-access prerequisites to describe two supported request authorization methods for the MCP endpoint: SigV4 signing with AWS credentials, and OAuth 2.1 bearer tokens obtained via AWS Sign-In, with a cross-reference to the authorization topic. Also drops redundant 'Amazon' branding from WorkSpaces Applications references.
Security assessment
The added text documents authentication/authorization mechanisms for calling the MCP server endpoint (SigV4-signed requests or short-lived OAuth 2.1 bearer tokens via AWS Sign-In), which is security-relevant guidance on credential scoping and token lifetime, but no specific vulnerability or CVE is referenced.
Evidence
+ * **OAuth bearer token** – The agent uses OAuth 2.1 authorization through AWS Sign-In to retrieve a short-lived access token, and passes it as a bearer token on each request.
Diff
diff --git a/appstream2/latest/developerguide/agent-access-mcp-prerequisites.md b/appstream2/latest/developerguide/agent-access-mcp-prerequisites.md index 54d5218..91f1b8b 100644 --- a//appstream2/latest/developerguide/agent-access-mcp-prerequisites.md +++ b//appstream2/latest/developerguide/agent-access-mcp-prerequisites.md @@ -15 +15 @@ This topic covers what you need in place before an agent can connect: the AWS ac -Agent access supports the same operating systems as Amazon WorkSpaces Applications. How you get an image depends on the operating system. +Agent access supports the same operating systems as WorkSpaces Applications. How you get an image depends on the operating system. @@ -29 +29 @@ To set up agent access, you need the following: - * An active Amazon WorkSpaces Applications fleet (Always-On or On-Demand). If you haven't created a fleet, see [Get Started with Amazon WorkSpaces Applications: Set Up With Sample Applications](./getting-started.html). + * An active WorkSpaces Applications fleet (Always-On or On-Demand). If you haven't created a fleet, see [Get Started with Amazon WorkSpaces Applications: Set Up With Sample Applications](./getting-started.html). @@ -33 +33 @@ To set up agent access, you need the following: - * An AWS account with permissions to create and manage Amazon WorkSpaces Applications stacks. + * An AWS account with permissions to create and manage WorkSpaces Applications stacks. @@ -101 +101,7 @@ The `agentaccess-mcp:*` wildcard includes the following actions: - * An MCP-compatible agent framework. The agent must be able to make Signature Version 4 (SigV4)-signed Streamable HTTP requests to the MCP endpoint. The [Strands Agents SDK](https://strandsagents.com/docs/user-guide/concepts/tools/mcp-tools/) provides native MCP client support, or you can use any framework with the mcp-proxy-for-aws transport. + * An MCP-compatible agent framework that can send Streamable HTTP requests to the MCP endpoint, authorized in one of two ways: + + * **Signature Version 4 (SigV4) signing** – The agent signs each request to the MCP server with its AWS credentials. + + * **OAuth bearer token** – The agent uses OAuth 2.1 authorization through AWS Sign-In to retrieve a short-lived access token, and passes it as a bearer token on each request. + +For more information about both authorization methods, see [Request authorization](./agent-access-mcp-server-endpoint.html#agent-access-mcp-server-authorization). The [Strands Agents SDK](https://strandsagents.com/docs/user-guide/concepts/tools/mcp-tools/) provides native MCP client support, or you can use any framework with the `mcp-proxy-for-aws` transport.