docs(permissions): update permissions role to include new permissions BYOF

[Hweinstock]

Problem

e2e test role is missing a ton of permissions for the new BYOF feature.
#1441

Solution

• add the permissions, verify by running locally with new role.
• add permissions to documentation.

Testing

 ✓  e2e  e2e-tests/strands-bedrock-byo-filesystem.test.ts > e2e: Strands/Bedrock — create → deploy → invoke > deploys to AWS successfully 92212ms
 ✓  e2e  e2e-tests/strands-bedrock-byo-filesystem.test.ts > e2e: Strands/Bedrock — create → deploy → invoke > invokes the deployed agent 21953ms
 ✓  e2e  e2e-tests/strands-bedrock-byo-filesystem.test.ts > e2e: Strands/Bedrock — create → deploy → invoke > status shows the deployed agent 9952ms
 ✓  e2e  e2e-tests/strands-bedrock-byo-filesystem.test.ts > e2e: Strands/Bedrock — create → deploy → invoke > status looks up agent runtime by ID 9495ms
 ✓  e2e  e2e-tests/strands-bedrock-byo-filesystem.test.ts > e2e: Strands/Bedrock — create → deploy → invoke > logs returns entries from the invocation 10068ms
 ✓  e2e  e2e-tests/strands-bedrock-byo-filesystem.test.ts > e2e: Strands/Bedrock — create → deploy → invoke > logs supports level filtering 10224ms
 ✓  e2e  e2e-tests/strands-bedrock-byo-filesystem.test.ts > e2e: Strands/Bedrock — create → deploy → invoke > traces list succeeds after invocation 2582ms

 Test Files  1 passed (1)
      Tests  7 passed (7)
   Start at  20:45:06
   Duration  262.03s (transform 142ms, setup 0ms, import 829ms, tests 261.10s, environment 0ms)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[github-actions]

Package Tarball

aws-agentcore-0.18.0.tgz

How to install

gh release download pr-1483-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.18.0.tgz

[agentcore-cli-automation]

Reviewed the diff against the BYOF code paths in src/cli/commands/shared/filesystem-utils.ts, src/cli/primitives/AgentPrimitive.tsx, src/cli/tui/screens/agent/useAddAgent.ts, and src/cli/tui/screens/create/useCreateFlow.ts. Each of the seven permissions added to the FilesystemNetworkValidation Sid maps directly to a real SDK call:

• ec2:DescribeSecurityGroups → DescribeSecurityGroupsCommand (filesystem-utils.ts:214, 348)
• ec2:DescribeSubnets → DescribeSubnetsCommand (filesystem-utils.ts:317, 417; AgentPrimitive.tsx:386; useAddAgent.ts:230)
• elasticfilesystem:DescribeAccessPoints → DescribeAccessPointsCommand (filesystem-utils.ts:174)
• elasticfilesystem:DescribeMountTargets → DescribeMountTargetsCommand (filesystem-utils.ts:248)
• elasticfilesystem:DescribeMountTargetSecurityGroups → DescribeMountTargetSecurityGroupsCommand (filesystem-utils.ts:253)
• s3files:ListMountTargets → ListMountTargetsCommand (filesystem-utils.ts:193, 274)
• s3files:GetMountTarget → GetMountTargetCommand (filesystem-utils.ts:279)

JSON is valid, the new Sid is also referenced from the "Scoping down by feature" table, and the e2e run in the PR description confirms the policy works end-to-end. No code changes needed. LGTM.