AWS amazonq documentation change
Summary
Added requirement to update IAM roles when using IAM Identity Center/OIDC
Security assessment
The change adds documentation about proper IAM role configuration for authentication, which is a security best practice but doesn't address a specific vulnerability
Diff
diff --git a/amazonq/latest/qbusiness-ug/browser-extensions-prerequisites.md b/amazonq/latest/qbusiness-ug/browser-extensions-prerequisites.md index 5c603b968..0156d98c6 100644 --- a//amazonq/latest/qbusiness-ug/browser-extensions-prerequisites.md +++ b//amazonq/latest/qbusiness-ug/browser-extensions-prerequisites.md @@ -13 +13,5 @@ As admins, before you can integrate the Amazon Q Business browser extension, you - 3. To use this feature, you must enable **Allow end users to send queries directly to the LLM** in your Admin controls and guardrails. For more information, see the [Response settings](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/guardrails-global-controls.html#guardrails-global-response) topic in [Admin controls and guardrails](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/guardrails.html) and [`chatMode`](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_ChatSync.html#qbusiness-ChatSync-request-chatMode) if you are configuring programmatically. + 3. To use this feature, do the following + + * Enable **Allow end users to send queries directly to the LLM** in your Admin controls and guardrails. For more information, see the [Response settings](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/guardrails-global-controls.html#guardrails-global-response) topic in [Admin controls and guardrails](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/guardrails.html) and [`chatMode`](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_ChatSync.html#qbusiness-ChatSync-request-chatMode) if you are configuring programmatically. + + * If you are using the IAM Identity Center or OpenID Connect (OIDC) provider in , make sure your IAM role for an Amazon Q Business web experience using IAM Federation is up to date. For more information, see [IAM role for an Amazon Q Business web experience using IAM Federation](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/web-experience-iam-role-iam.html).