AWS amazonq documentation change
Summary
Expanded documentation about enabling organization-wide subscription visibility through AWS Organizations trusted access. Added details about security controls for cross-account access.
Security assessment
The changes explicitly document security-related functionality (trusted access requirements for organizational visibility) but do not indicate remediation of a specific security vulnerability. The updates explain security features rather than address exploits.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/subscribe-visibility.md b/amazonq/latest/qdeveloper-ug/subscribe-visibility.md index d7b19482c..5cd0f69ae 100644 --- a/amazonq/latest/qdeveloper-ug/subscribe-visibility.md +++ b/amazonq/latest/qdeveloper-ug/subscribe-visibility.md @@ -5 +5 @@ -# Viewing Amazon Q Developer subscriptions in multiple accounts +# Viewing an aggregated list of Amazon Q Developer subscriptions @@ -13 +13 @@ Consolidated subscription information will also appear on the **Dashboard** page -Not sure what member and management accounts are? See [Terminology and concepts for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) in the _AWS Organizations User Guide_ for explanations. +If you are a member account administrator, you will only ever be able to view the subscriptions within the member accounts that you administer. This is true regardless of whether organization-wide visibility was enabled in the management account. @@ -15 +15,7 @@ Not sure what member and management accounts are? See [Terminology and concepts -Use the following instructions to enable organization-wide visibility of your Amazon Q Developer subscriptions. +To enable organization-wide visibility of Amazon Q Developer subscriptions, you must enable trusted access to Amazon Q in your organization. _Trusted access_ is an AWS Organizations feature that, when enabled, designates Amazon Q as a _trusted service_ that is allowed to query your organization's structure. This querying is required in order to show subscriptions in member accounts within the management account. + +To learn more about trusted access, see [Enabling trusted access for AWS Account Management](https://docs.aws.amazon.com/accounts/latest/reference/using-orgs-trusted-access.html) in the _AWS Organizations User Guide_. + +To learn more about member and management accounts, see [Terminology and concepts for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) in the _AWS Organizations User Guide_ for explanations. + +Use the following instructions to enable trusted access to Amazon Q in your organization. @@ -21 +27 @@ Before you begin, make sure that: - * You are an adminstrator of an AWS _management_ account. + * You are an administrator of an AWS _management_ account. @@ -32 +38 @@ Before you begin, make sure that: -###### To enable organization-wide visibility of your Amazon Q Developer subscriptions +###### To enable trusted access (enable organization-wide visibility of subscriptions) @@ -36 +42 @@ Before you begin, make sure that: - 2. Go to the **Amazon Q** console (not the Amazon Q Developer console). + 2. Do one of the following: @@ -38 +44,3 @@ Before you begin, make sure that: - 3. Make sure you're in the AWS Region where you want to subscribe users. You might have been switched to the US East (N. Virginia) Region if you came from the Amazon Q Developer console, so you might need to switch back. For supported Regions, see [Amazon Q Developer Pro Region support](./q-admin-setup-subscribe-regions.html). + * Open the Amazon Q console (not the Amazon Q Developer console). + + * Open the AWS Organizations console, and choose **Services**. From the list of services, choose **Amazon Q**. Choose **Navigate to console** to go to the Amazon Q console. @@ -43,0 +52,2 @@ The Amazon Q console appears. + 3. Make sure you're in the AWS Region where you want to subscribe users. You might have been switched to the US East (N. Virginia) Region if you came from the Amazon Q Developer console, so you might need to switch back. For supported Regions, see [Amazon Q Developer Pro Region support](./q-admin-setup-subscribe-regions.html). + @@ -48 +58 @@ The Amazon Q console appears. - 6. Choose **On**. + 6. Under **View subscriptions from member accounts** , choose **On**. @@ -52 +62 @@ The Amazon Q console appears. -Users and groups who are subscribed in member accounts now appear in the Amazon Q and Amazon Q Developer consoles when you're signed in as a management account administrator. These users and groups appear as read-only with a greyed-out selector next to them, indicating that you cannot take action on them as a management account administrator. If you need to modify these users and groups, you must sign in to the member account that manages them. +Trusted access to Amazon Q is now enabled. Users and groups who are subscribed in member accounts now appear in the Amazon Q and Amazon Q Developer consoles when you're signed in as a management account administrator. These users and groups appear as read-only with a greyed-out selector next to them, indicating that you cannot take action on them as a management account administrator. If you need to modify these users and groups, you must sign in to the member account that manages them.