AWS amazonq documentation change
Summary
Updated subscription process documentation with clarified steps for installing Amazon Q Developer Pro profile, IAM Identity Center requirements, and resource creation details. Removed redundant console navigation instructions and added profile management context.
Security assessment
Changes focus on procedural updates and clarification of IAM Identity Center requirements rather than addressing security vulnerabilities. While IAM Identity Center is a security service, the modifications describe standard setup processes rather than patching weaknesses.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/subscribe-member.md b/amazonq/latest/qdeveloper-ug/subscribe-member.md index 7b5abd9aa..830a4d40c 100644 --- a//amazonq/latest/qdeveloper-ug/subscribe-member.md +++ b//amazonq/latest/qdeveloper-ug/subscribe-member.md @@ -5 +5 @@ -PrerequisitesStep 1: Enable Amazon Q Developer Pro and subscribe the first userStep 2: Subscribe other usersStep 3: Enable identity-aware console sessionsWhat resources were created? +PrerequisitesStep 1: Install the Amazon Q Developer Pro profile and subscribe the first userStep 2: Subscribe other usersStep 3: Enable identity-aware console sessionsWhat resources were created? @@ -7 +7 @@ PrerequisitesStep 1: Enable Amazon Q Developer Pro and subscribe the first userS -# Subscribe users in a member account +# Subscribe users to Amazon Q Developer Pro in a member account @@ -32 +32 @@ Before you begin, make sure that: - * You have the minimum permissions required to subscribe users and manage Amazon Q Developer settings. For more information, see [Allow administrators to use the Amazon Q subscription console](./id-based-policy-examples-admins.html#q-admin-setup-admin-users-sub), and [Allow administrators to use the Amazon Q Developer console](./id-based-policy-examples-admins.html#q-admin-setup-admin-users). + * You have the minimum permissions required to subscribe users and manage Amazon Q Developer settings. For more information, see [Allow administrators to use the Amazon Q console](./id-based-policy-examples-admins.html#q-admin-setup-admin-users-sub), and [Allow administrators to use the Amazon Q Developer console](./id-based-policy-examples-admins.html#q-admin-setup-admin-users). @@ -33,0 +34 @@ Before you begin, make sure that: + * (Optional) You have an organization instance of IAM Identity Center set up in the _management account_ or you have an account instance of IAM Identity Center set up in your _member account_. This IAM Identity Center contains the users you want to subscribe to Amazon Q Developer Pro, and must be deployed in a supported AWS Region, as described in [Supported Regions for IAM Identity Center](./q-admin-setup-subscribe-regions.html#pro-subscription-regions). If you don't have an IAM Identity Center instance installed, that's ok. One will be installed when you subscribe the first user. For more information about IAM Identity Center, see [Organization and account instances of IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/identity-center-instances.html). @@ -37 +37,0 @@ Before you begin, make sure that: -## Step 1: Enable Amazon Q Developer Pro and subscribe the first user @@ -39,9 +39 @@ Before you begin, make sure that: - 1. Sign in to the AWS Management Console using your member AWS account. - - 2. Do one of the following: - - * Go to the **Amazon Q Developer** console and then choose **Subscribe to Amazon Q** , which will redirect you to the **Amazon Q** console. - -Or - - * Go directly to the **Amazon Q** console. +## Step 1: Install the Amazon Q Developer Pro profile and subscribe the first user @@ -49 +41 @@ Or - 3. Make sure you're in the AWS Region where you want to subscribe users. You might have been switched to the US East (N. Virginia) Region if you came from the Amazon Q Developer console, so you might need to switch back. For supported Regions, see [Amazon Q Developer Pro Region support](./q-admin-setup-subscribe-regions.html). + 1. Sign in to the AWS Management Console using your member AWS account. @@ -51 +43 @@ Or -The Amazon Q console appears. + 2. Switch to the **Amazon Q Developer** console. @@ -53 +45 @@ The Amazon Q console appears. - + 3. Make sure you're in the AWS Region where you want to install the [Amazon Q Developer profile](./subscribe-understanding-profile.html) and where you want to store user data. For supported Regions, see [Supported Regions for the Q Developer console and Q Developer profile](./q-admin-setup-subscribe-regions.html#qdev-console-and-profile-regions). @@ -59 +51 @@ The Amazon Q console appears. -If you see a **Subscribe** button instead of **Get started** button, it means that you've already run through the 'Get started' workflow and can skip to Step 2: Subscribe other users. +If you see a **Settings** button instead of **Get started** button, it means that you've already run through the 'Get started' workflow and can skip to Step 2: Subscribe other users. @@ -61 +53 @@ If you see a **Subscribe** button instead of **Get started** button, it means th - 5. Follow the on-screen prompts to enable Amazon Q Developer Pro in your account and subscribe your first user. + 5. Follow the on-screen prompts to subscribe your first user. @@ -65 +57 @@ If you see a **Subscribe** button instead of **Get started** button, it means th - * If the first user's email address doesn't match one in an existing IAM Identity Center, then Amazon Q creates an IAM Identity Center in your member account, and adds the first user to it. + * If the first user's email address doesn't match one in an existing IAM Identity Center, then Amazon Q creates an IAM Identity Center account instance in your member account, and adds the first user to it. Note that: @@ -67 +59 @@ If you see a **Subscribe** button instead of **Get started** button, it means th -A welcome dialog box appears. + * Amazon Q only creates an IAM Identity Center account instance if there is no IAM Identity Center already in your member account. @@ -69 +61 @@ A welcome dialog box appears. - + * Otherwise, if there is an IAM Identity Center account instance in your member account, but the user is not in it, then Amazon Q creates the user in the existing IAM Identity Center. @@ -71 +63 @@ A welcome dialog box appears. - 6. Choose **Enable and subscribe** to enable Amazon Q Developer Pro in your account and subscribe the first user. +The **Create Amazon Q Developer profile** dialog box appears. @@ -73 +65 @@ A welcome dialog box appears. -A **You're subscribed** dialog box appears. + 6. Review the contents of the dialog box and provide a name for your profile in **Profile name**. For help with cross-region inferencing, see [Cross-region processing in Amazon Q Developer](./cross-region-processing.html). For help with disabling dashboard metrics, see [Disabling the Amazon Q Developer dashboard](./dashboard-disabling.html). @@ -75 +67 @@ A **You're subscribed** dialog box appears. - +Choose **Create application**. @@ -77 +69 @@ A **You're subscribed** dialog box appears. - 7. Choose **Done**. +The Amazon Q Developer profile and managed application are installed, and the first user is subscribed. @@ -79 +71 @@ A **You're subscribed** dialog box appears. - 8. (Optional) Verify that your subscription was created: + 7. (Optional) Verify that the first user's subscription was created: @@ -81 +73 @@ A **You're subscribed** dialog box appears. - 1. In the Amazon Q console, in the navigation pane, choose **Subscriptions**. + 1. In the Amazon Q Developer console, in the navigation pane, choose **Subscriptions**. @@ -87,2 +78,0 @@ The subscription of the first user should appear in the list in the **Pending** - - @@ -93 +83 @@ The subscription will change to the **Active** state after the user's first use - 9. Have users check their email. They should receive an email titled **Activate Your Amazon Q Developer Pro Subscription** within 24 hours. In this email, users will find guidance on how to begin using their Amazon Q Developer Pro license in the AWS Management Console and their Integrated Development Environment (IDE). The email includes users' unique Start URL and AWS Region for authentication, and provides quickstart steps for using Amazon Q Developer in their IDE. This email streamlines the onboarding process and saves you valuable time by eliminating the need for you to manually notify each new user. + 8. Have the first user check their email. They should receive an email titled **Activate Your Amazon Q Developer Pro Subscription** within 24 hours. In this email, users will find guidance on how to begin using their Amazon Q Developer Pro license in the AWS Management Console and their Integrated Development Environment (IDE). The email includes users' unique Start URL and AWS Region for authentication, and provides quickstart steps for using Amazon Q Developer in their IDE. This email streamlines the onboarding process and saves you valuable time by eliminating the need for you to manually notify each new user. @@ -100 +90 @@ The subscription will change to the **Active** state after the user's first use -To subscribe other users, add them to your IAM Identity Center instance if they're not already there, and then subscribe them to Amazon Q by choosing **Subscribe** in the Amazon Q console. +To subscribe other users, add them to your IAM Identity Center instance if they're not already there, and then subscribe them to Amazon Q Developer Pro by choosing **Subscribe** in the Amazon Q Developer console. @@ -112,16 +102 @@ If you don't enable identity-aware console sessions, users can still use Amazon -The ability to enable identity-aware console sessions—and therefore the ability to use Amazon Q Developer Pro subscriptions on AWS apps and websites—is only supported with organization instances of IAM Identity Center, not account instances. Use the following procedure to check whether you're using an organization instance. - -###### To check whether Amazon Q is using an organization instance - - 1. Go to the Amazon Q console (not the Amazon Q Developer console). - - 2. Choose **Settings**. - -If you're connected to an organization instance, you should see the following message: - - - -If you're using organization instance, contact the management account administrator to enable identity-aware console sessions in the organization instance of IAM Identity Center. - - - +The ability to enable identity-aware console sessions—and therefore the ability to use Amazon Q Developer Pro subscriptions on AWS apps and websites—is only supported with organization instances of IAM Identity Center, not account instances. @@ -137 +112 @@ When you subscribed users in your member account, Amazon Q created the following -Account instances of IAM Identity Center have [limitations](https://docs.aws.amazon.com/singlesignon/latest/userguide/account-instances-identity-center.html#about-account-instance). For example, account instances don't support console access. (Users can still use Amazon Q in the console, it's just that they'll be subject to the Free tier monthly limits.) If you want your users to be able to use Amazon Q Developer Pro in the console and other AWS websites, they must exist in an _organization instance_ of IAM Identity Center, in a management account. For more information, see [Subscribe users in a management account](./subscribe-management.html). +Account instances of IAM Identity Center have [limitations](https://docs.aws.amazon.com/singlesignon/latest/userguide/account-instances-identity-center.html#about-account-instance). For example, account instances don't support console access. (Users can still use Amazon Q in the console, it's just that they'll be subject to the Free tier monthly limits.) If you want your users to be able to use Amazon Q Developer Pro in the console and other AWS websites, they must exist in an _organization instance_ of IAM Identity Center, in a management account. For more information, see [Subscribe users to Amazon Q Developer Pro in a management account](./subscribe-management.html). @@ -147 +122,3 @@ You can't convert or merge an account instance of IAM Identity Center into an or - * **A managed application** called **QDefaultProfile** , in IAM Identity Center. The application enables a settings profile (see the next bullet for details). The application is created once and shared between all Amazon Q Developer Pro subscribers in your member account. + * **An Amazon Q Developer profile** , in the Amazon Q Developer console, under **Settings**. + + * **A managed application** called **QDefaultProfile** , in IAM Identity Center. The application is associated with the Amazon Q Developer profile. Like the Amazon Q Developer profile, the application is created once and shared between all Amazon Q Developer Pro subscribers in your member account. @@ -153,2 +129,0 @@ You can install the **QDefaultProfile** managed application in a maximum of 50 A - * **An Amazon Q Developer profile** , in the Amazon Q Developer console, under **Settings**. An _Amazon Q Developer profile_ is a collection of Amazon Q Developer settings associated with a **QDefaultProfile** application. For more information about the Amazon Q Developer profile, see [Understanding Amazon Q Developer profiles](./q-admin-setup-subscribe-understanding.html#subscribe-understanding-profile). - @@ -166 +141 @@ In a management account -Managing subscriptions +Across your organization