AWS amazonq documentation change
Summary
Added sections explaining subscription statuses, organization-wide visibility, and profile sharing capabilities. Updated trusted access references to profile sharing terminology.
Security assessment
The changes document access control features (profile sharing across accounts) but there's no evidence of addressing a specific vulnerability. Profile sharing configuration is a security-related feature documentation.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/q-admin-setup-subscribe-understanding.md b/amazonq/latest/qdeveloper-ug/q-admin-setup-subscribe-understanding.md index 12b70b522..9e9e271a1 100644 --- a/amazonq/latest/qdeveloper-ug/q-admin-setup-subscribe-understanding.md +++ b/amazonq/latest/qdeveloper-ug/q-admin-setup-subscribe-understanding.md @@ -4,0 +5,2 @@ +Understanding subscription statusesAcross your organizationUnderstanding subscription visibilityUnderstanding profile sharing + @@ -9 +11,3 @@ The Amazon Q subscription console gives administrators visibility into how end u -In the Amazon Q subscription console, administrators can view a list of subscribed users, their subscription status, and their corresponding associations. The associations that administrators can view depends on the permissions assigned to those administrators. +## Understanding subscription statuses + +In the Amazon Q console, administrators can view a list of subscribed users, and their subscription statuses. @@ -13 +17,25 @@ A subscription is pending until the first time an end user accesses a feature of -If [trusted access](./q-admin-trusted-access.html) is enabled for the organization, organization management account administrators can see all subscription associations across applications and across various accounts. However, member account administrators can only view the subscriptions and applications within the accounts that they administer. This means that if one account administrator subscribes an end user to an Amazon Q subscription and provides access to an application in that account, another member account administrator in a different account won't be able to see it. +For more information about subscription statuses, see [Amazon Q Developer subscription statuses](./q-admin-setup-subscribe-status.html). + +## Understanding subscriptions across your organization + +If your business has [AWS Organizations](https://docs.aws.amazon.com/) set up, you will have a mix of management and member accounts. You may want to subscribe users in each of your member accounts and then assign a different Amazon Q administrator, and a different (or overlapping) set of developers, to each account. Both management account administrators and member account administrators can view and manage end users' Amazon Q Developer Pro subscriptions, filter and search subscribers, view dashboard metrics, and download reports. + +For more information about AWS Organizations, including information about management accounts and member accounts, see [Terminology and concepts for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) in the _AWS Organizations User Guide_. + +## Understanding subscription visibility + +###### Note + +This section is only relevant if your business has [AWS Organizations](https://docs.aws.amazon.com/) set up. + +By default, when an Amazon Q administrator views subscriptions in the Amazon Q and Amazon Q Developer consoles, they will only see Amazon Q Developer Pro subscriptions created in their own account. You can optionally configure Amazon Q to allow management account administrators to see all subscriptions across all accounts in the organization in a single unified list on the **Subscriptions** page of the Amazon Q console. Member account administrators will still only be able to view subscriptions in the member accounts that they administer. + +To have Amazon Q display an aggregated list of subscriptions, see [Viewing an aggregated list of Amazon Q Developer subscriptions](./subscribe-visibility.html). + +## Understanding profile sharing + +###### Note + +This section is only relevant if your business has [AWS Organizations](https://docs.aws.amazon.com/) set up. + +When profile sharing access is enabled, end users who are subscribed to Amazon Q Developer Pro in a _management_ account will be able to use their Amazon Q Developer Pro subscription to [chat with Amazon Q in the AWS Management Console and other AWS websites](./q-on-aws.html) while signed in to a _member_ account. When this setting is disabled, these users can still chat with Amazon Q in a member account, but they'll be subject to Free tier limits and features. @@ -15 +43 @@ If [trusted access](./q-admin-trusted-access.html) is enabled for the organizati -Both organization management administrators and member account administrators can view end users' applications and AWS account associations that they have access to, filter and search end users, and download reports. +To enable profile sharing, see [Enabling profile sharing in Amazon Q Developer](./q-admin-profile-sharing.html).