AWS amazonq documentation change
Summary
Restructured subscription process into three steps: profile installation, user subscription, and identity-aware sessions. Added details about IAM Identity Center region requirements, profile management, and resource creation documentation.
Security assessment
Added requirements for IAM Identity Center deployment in supported regions and clarified security-related resource associations (profile/managed application). While these improve security documentation, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/subscribe-management.md b/amazonq/latest/qdeveloper-ug/subscribe-management.md index 643fd4412..6d8fb722e 100644 --- a//amazonq/latest/qdeveloper-ug/subscribe-management.md +++ b//amazonq/latest/qdeveloper-ug/subscribe-management.md @@ -5 +5 @@ -PrerequisitesStep 1: Enable Amazon Q Developer Pro and subscribe usersStep 2: Enable identity-aware console sessionsWhat resources were created? +PrerequisitesStep 1: Install the Amazon Q Developer profileStep 2: Subscribe usersStep 3: Enable identity-aware console sessionsWhat resources were created? @@ -7 +7 @@ PrerequisitesStep 1: Enable Amazon Q Developer Pro and subscribe usersStep 2: En -# Subscribe users in a management account +# Subscribe users to Amazon Q Developer Pro in a management account @@ -11 +11 @@ A _management account_ is an AWS account that is part of an organization managed -If you are the owner of a management account, use the following instructions to subscribe users to Amazon Q Developer Pro in this account. +If you are the owner of a management account, use the following instructions to subscribe users to Amazon Q Developer Pro in your account. @@ -21 +21 @@ Before you begin, make sure that: - * You have the minimum permissions required to subscribe users and manage Amazon Q Developer settings. For more information, see [Allow administrators to use the Amazon Q subscription console](./id-based-policy-examples-admins.html#q-admin-setup-admin-users-sub), and [Allow administrators to use the Amazon Q Developer console](./id-based-policy-examples-admins.html#q-admin-setup-admin-users). + * You have the minimum permissions required to subscribe users and manage Amazon Q Developer settings. For more information, see [Allow administrators to use the Amazon Q console](./id-based-policy-examples-admins.html#q-admin-setup-admin-users-sub), and [Allow administrators to use the Amazon Q Developer console](./id-based-policy-examples-admins.html#q-admin-setup-admin-users). @@ -23 +23 @@ Before you begin, make sure that: - * You have an organization instance of IAM Identity Center set up in your management account. This IAM Identity Center contains the users you want to subscribe to Amazon Q Developer Pro. + * You have an organization instance of IAM Identity Center set up in your management account. This IAM Identity Center contains the users you want to subscribe to Amazon Q Developer Pro, and must be deployed in a supported AWS Region, as described in [Supported Regions for IAM Identity Center](./q-admin-setup-subscribe-regions.html#pro-subscription-regions). For more information about IAM Identity Center, see [Organization instances of IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/organization-instances-identity-center.html). @@ -28 +28 @@ Before you begin, make sure that: -## Step 1: Enable Amazon Q Developer Pro and subscribe users +## Step 1: Install the Amazon Q Developer profile @@ -30 +30 @@ Before you begin, make sure that: - 1. Sign in to the AWS Management Console using your management AWS account. + 1. Sign in to the AWS Management Console using your AWS management account. @@ -32 +32 @@ Before you begin, make sure that: - 2. Do one of the following: + 2. Switch to the **Amazon Q Developer** console. @@ -34 +34 @@ Before you begin, make sure that: - * Go to the **Amazon Q Developer** console and then choose **Subscribe to Amazon Q** , which will redirect you to the **Amazon Q** console. + 3. Make sure you're in the AWS Region where you want to install the [Amazon Q Developer profile](./subscribe-understanding-profile.html) and where you want to store user data. For supported Regions, see [Supported Regions for the Q Developer console and Q Developer profile](./q-admin-setup-subscribe-regions.html#qdev-console-and-profile-regions). @@ -36 +36 @@ Before you begin, make sure that: -Or + 4. Choose **Get started**. @@ -38 +38 @@ Or - * Go directly to the **Amazon Q** console. +The **Create Amazon Q Developer profile** dialog box appears. @@ -40 +40 @@ Or - 3. Make sure you're in the AWS Region where you want to subscribe users. You might have been switched to the US East (N. Virginia) Region if you came from the Amazon Q Developer console, so you might need to switch back. For supported Regions, see [Amazon Q Developer Pro Region support](./q-admin-setup-subscribe-regions.html). + 5. Review the contents of the dialog box and provide a name for your profile in **Profile name**. For help with cross-region inferencing, see [Cross-region processing in Amazon Q Developer](./cross-region-processing.html). For help with the **Share Amazon Q Developer settings with member account** check box, see [Enabling profile sharing in Amazon Q Developer](./q-admin-profile-sharing.html). For help with disabling dashboard metrics, see [Disabling the Amazon Q Developer dashboard](./dashboard-disabling.html). @@ -42,3 +42 @@ Or -The Amazon Q console appears. - - +Choose **Create application**. @@ -46 +44 @@ The Amazon Q console appears. - 4. Choose **Subscribe**. +The Amazon Q Developer profile and managed application are installed. @@ -48 +45,0 @@ The Amazon Q console appears. -The **Create Amazon Q Developer Pro application** dialog box may appear. It only appears the very first time you subscribe users. @@ -50 +46,0 @@ The **Create Amazon Q Developer Pro application** dialog box may appear. It only - @@ -52 +47,0 @@ The **Create Amazon Q Developer Pro application** dialog box may appear. It only - 5. Review the contents of the dialog box. For help with the **Share Amazon Q Developer settings with member account** check box, see [Enabling profile sharing in Amazon Q Developer](./q-admin-profile-sharing.html). @@ -54 +49 @@ The **Create Amazon Q Developer Pro application** dialog box may appear. It only -Choose **Create application**. +## Step 2: Subscribe users @@ -56,3 +51 @@ Choose **Create application**. -The Amazon Q Developer managed application and Amazon Q Developer profile are installed. - -###### Note + 1. In the Amazon Q Developer console, from the navigation pane, choose **Subscriptions**. @@ -60 +53 @@ The Amazon Q Developer managed application and Amazon Q Developer profile are in -At this point, you can choose **Cancel** to only install the Amazon Q Developer management application and profile and not proceed with subscribing users. You might want to do this if you plan on subscribing your users in member accounts and sharing the Amazon Q Developer profile with these accounts. For more information, see [Enabling profile sharing in Amazon Q Developer](./q-admin-profile-sharing.html). + 2. Choose **Subscribe**. @@ -64 +57 @@ The **Assign users and groups** dialog box appears. - + 3. Start typing the group or user you want to subscribe. The group or user will auto-populate with the ones available in the IAM Identity Center set up in your management account. @@ -66 +59 @@ The **Assign users and groups** dialog box appears. - 6. Choose **Get started**. + 4. Choose **Assign**. @@ -68 +61 @@ The **Assign users and groups** dialog box appears. - 7. Start typing the group or user you want to subscribe. The group or user will auto-populate with the ones available in the IAM Identity Center set up in your management account. + 5. Have users check their email. They should receive an email titled **Activate Your Amazon Q Developer Pro Subscription** within 24 hours. In this email, users will find guidance on how to begin using their Amazon Q Developer Pro license in the AWS Management Console and their Integrated Development Environment (IDE). The email includes users' unique Start URL and AWS Region for authentication, and provides quickstart steps for using Amazon Q Developer in their IDE. This email streamlines the onboarding process and saves you valuable time by eliminating the need for you to manually notify each new user. @@ -70 +62,0 @@ The **Assign users and groups** dialog box appears. - @@ -72 +63,0 @@ The **Assign users and groups** dialog box appears. - 8. Choose **Assign**. @@ -74 +64,0 @@ The **Assign users and groups** dialog box appears. - 9. Have users check their email. They should receive an email titled **Activate Your Amazon Q Developer Pro Subscription** within 24 hours. In this email, users will find guidance on how to begin using their Amazon Q Developer Pro license in the AWS Management Console and their Integrated Development Environment (IDE). The email includes users' unique Start URL and AWS Region for authentication, and provides quickstart steps for using Amazon Q Developer in their IDE. This email streamlines the onboarding process and saves you valuable time by eliminating the need for you to manually notify each new user. @@ -76,4 +66 @@ The **Assign users and groups** dialog box appears. - - - -## Step 2: Enable identity-aware console sessions +## Step 3: Enable identity-aware console sessions @@ -89 +76 @@ If you don't enable identity-aware console sessions, users can still use Amazon -When you subscribed users in your management account, Amazon Q created the following resources on your behalf: +When you installed the Amazon Q Developer profile and subscribed users in your management account, Amazon Q created the following resources on your behalf: @@ -93 +80,3 @@ When you subscribed users in your management account, Amazon Q created the follo - * **A managed application** called **QDefaultProfile** , in the IAM Identity Center that is set up in your management account. The application enables an Amazon Q Developer profile (see the next bullet for details). The application is created once and shared between all Amazon Q subscribers under your management account. + * **An Amazon Q Developer profile** , in the Amazon Q Developer console, under **Settings**. + + * **A managed application** called **QDefaultProfile** , in the IAM Identity Center that is set up in your management account. The application is associated with the Amazon Q Developer profile. Like the Amazon Q Developer profile, the application is created once and shared between all Amazon Q subscribers in your management account. @@ -99,2 +87,0 @@ Amazon Q can create the **QDefaultProfile** managed application in a maximum of - * **An Amazon Q Developer profile** , in the Amazon Q Developer console, under **Settings**. An _Amazon Q Developer profile_ is a collection of Amazon Q Developer settings associated with a **QDefaultProfile** application. For more information about the Amazon Q Developer profile, see [Understanding Amazon Q Developer profiles](./q-admin-setup-subscribe-understanding.html#subscribe-understanding-profile). -