AWS amazonq documentation change
Summary
Added documentation for a new policy example allowing users to run transformations on the command line with Amazon Q, including specific actions like StartAgentSession, ImportArtifact, ExportArtifact, and TransformCode
Security assessment
The change adds a new policy example for a feature but does not address any specific security vulnerability or weakness. It's a routine documentation update for a new capability.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md index d026d8875..680b7e939 100644 --- a/amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md +++ b/amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md @@ -5 +5 @@ -Allow users to access Amazon Q with an Amazon Q Developer Pro subscriptionAllow Amazon Q access to customer managed keysAllow users to chat with Amazon QAllow users to use Amazon Q CLI with AWS CloudShellAllow users to diagnose console errors with Amazon QAllow users to generate code from CLI commands with Amazon QAllow users to chat about resources with Amazon QAllow Amazon Q to perform actions on your behalf in chatDeny Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform actions on your behalf in specific regionsDeny Amazon Q permission to perform actions on your behalfAllow users to chat with plugins from one providerAllow users to chat with a specific pluginDeny access to Amazon QAllow users to view their permissions +Allow users to access Amazon Q with an Amazon Q Developer Pro subscriptionAllow Amazon Q access to customer managed keysAllow users to chat with Amazon QAllow users to use Amazon Q CLI with AWS CloudShellAllow users to run transformations on the command lineAllow users to diagnose console errors with Amazon QAllow users to generate code from CLI commands with Amazon QAllow users to chat about resources with Amazon QAllow Amazon Q to perform actions on your behalf in chatDeny Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform actions on your behalf in specific regionsDeny Amazon Q permission to perform actions on your behalfAllow users to chat with plugins from one providerAllow users to chat with a specific pluginDeny access to Amazon QAllow users to view their permissions @@ -124,0 +125,21 @@ The `codewhisperer` prefix is a legacy name from a service that merged with Amaz +## Allow users to run transformations on the command line + +The following example policy grants permissions to transform code with the Amazon Q command line tool for transformations. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "qdeveloper:StartAgentSession", + "qdeveloper:ImportArtifact", + "qdeveloper:ExportArtifact", + "qdeveloper:TransformCode" + ] + "Resource": "*" + } + ] + } +