AWS amazonq documentation change

Service: amazonq · 2025-04-18 · Documentation medium

File: amazonq/latest/qdeveloper-ug/managed-policy.md

Summary

Added new GitLabDuoWithAmazonQPermissionsPolicy IAM policy for GitLab integration, including OAuth app connection management and plugin permissions

Security assessment

Introduces documentation for a new managed policy governing integration security permissions, but no evidence of addressing an existing security issue

Diff

diff --git a/amazonq/latest/qdeveloper-ug/managed-policy.md b/amazonq/latest/qdeveloper-ug/managed-policy.md
index 9b67fbcf8..90de48c89 100644
--- a//amazonq/latest/qdeveloper-ug/managed-policy.md
+++ b//amazonq/latest/qdeveloper-ug/managed-policy.md
@@ -5 +5 @@
-AmazonQFullAccessAmazonQDeveloperAccessAWSServiceRoleForAmazonQDeveloperPolicyAWSServiceRoleForUserSubscriptionsPolicy updates
+AmazonQFullAccessAmazonQDeveloperAccessAWSServiceRoleForAmazonQDeveloperPolicyAWSServiceRoleForUserSubscriptionsGitLabDuoWithAmazonQPermissionsPolicyPolicy updates
@@ -236,0 +237,53 @@ To view this policy in the context of other AWS managed policies, see [AWSServic
+## GitLabDuoWithAmazonQPermissionsPolicy
+
+This policy grants permission to connect with Amazon Q and utilize the features in the GitLab Duo with Amazon Q integration. The policy is added to the IAM role created from the Amazon Q Developer console to access Amazon Q. You need to manually provide the IAM role to GitLab as an Amazon Resource Name (ARN). The policy allows the following:
+
+  * **GitLab Duo usage permissions** \- Allows basic operations such as sending events and messages, creating and updating auth grants, generating code recommendations, listing plugins, and verifying OAuth app connections.
+
+  * **GitLab Duo management permissions** \- Enables the creation and deletion of OAuth app connections, providing control over the integration setup.
+
+  * **GitLab Duo plugin permissions** \- Grants specific permissions to create, delete, and retrieve plugins related to the GitLab Duo integration with Amazon Q.
+
+
+
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Sid": "GitLabDuoUsagePermissions",
+          "Effect": "Allow",
+          "Action": [
+            "q:SendEvent",
+            "q:CreateAuthGrant",
+            "q:UpdateAuthGrant",
+            "q:GenerateCodeRecommendations",
+            "q:SendMessage",
+            "q:ListPlugins",
+            "q:VerifyOAuthAppConnection"
+          ],
+          "Resource": "*"
+        },
+        {
+          "Sid": "GitLabDuoManagementPermissions",
+          "Effect": "Allow",
+          "Action": [
+            "q:CreateOAuthAppConnection",
+            "q:DeleteOAuthAppConnection"
+          ],
+          "Resource": "*"
+        },
+        {
+          "Sid": "GitLabDuoPluginPermissions",
+          "Effect": "Allow",
+          "Action": [
+            "q:CreatePlugin",
+            "q:DeletePlugin",
+            "q:GetPlugin"
+          ],
+          "Resource": "arn:aws:qdeveloper:*:*:plugin/GitLabDuoWithAmazonQ/*"
+        }
+      ]
+    }
+
@@ -242,0 +296 @@ Change | Description | Date
+GitLabDuoWithAmazonQPermissionsPolicy \- New policy |  Allows GitLab to connect with Amazon Q to use GitLab Duo with Amazon Q integration features. |  April 17, 2025