AWS amazonq documentation change
Summary
Restructured documentation to focus on deployment options when using AWS Organizations, added guidance about IAM Identity Center implementation decisions, and introduced a comparison table of deployment strategies
Security assessment
The changes emphasize proper IAM Identity Center configuration and profile management, which are security-related features. However, there's no evidence of addressing a specific vulnerability. The documentation adds security-adjacent guidance about identity management best practices and permission set implications.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/tracking-across-org.md b/amazonq/latest/qdeveloper-ug/tracking-across-org.md index a046d60fc..3b366990f 100644 --- a//amazonq/latest/qdeveloper-ug/tracking-across-org.md +++ b//amazonq/latest/qdeveloper-ug/tracking-across-org.md @@ -5 +5 @@ -# Subscribe users to Amazon Q Developer Pro across your organization +Deployment options for Amazon Q Developer Pro if you're using AWS Organizations @@ -7 +7 @@ -If your business has [AWS Organizations](https://docs.aws.amazon.com/) set up, you will have a mix of management and member accounts. You may want to subscribe users in each of your member accounts and then assign a different Amazon Q administrator, and a different (or overlapping) set of developers, to each account. Both management account administrators and member account administrators can view and manage end users' Amazon Q Developer Pro subscriptions, filter and search subscribers, view dashboard metrics, and download reports. +# Subscribe users to Amazon Q Developer Pro across accounts @@ -9 +9 @@ If your business has [AWS Organizations](https://docs.aws.amazon.com/) set up, y -If you plan to subscribe users in multiple accounts in AWS Organizations, consider enabling the following features: +###### Note @@ -11 +11 @@ If you plan to subscribe users in multiple accounts in AWS Organizations, consid - * **Profile sharing** – Allows management account administrators to share the [Amazon Q Developer profile](./subscribe-understanding-profile.html) set up in their account with member accounts. This ensures consistency of Amazon Q Developer Pro settings across accounts. For more information, see [Enabling profile sharing in Amazon Q Developer](./q-admin-profile-sharing.html). +This page is intended for enterprise administrators who are using AWS Organizations and who want to deploy Amazon Q Developer Pro to their user base. If you're an individual who wants to use Amazon Q Developer Pro for personal use, or if you're an enterprise administrator who does not want to use AWS Organizations, see instead [Subscribe users in a standalone account](./subscribe-standalone.html) for end-to-end instructions on subscribing to Amazon Q Developer Pro. @@ -13 +13 @@ If you plan to subscribe users in multiple accounts in AWS Organizations, consid - * **Organization-wide visibility of subscriptions** – Allows management account administrators to see subscriptions created in member accounts while signed in to their management account. For more information, see [Viewing an aggregated list of Amazon Q Developer subscriptions](./subscribe-visibility.html). +When using [AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html), you'll have a mix of management and member accounts. To subscribe users, you'll need to make three key decisions across these accounts: @@ -14,0 +15 @@ If you plan to subscribe users in multiple accounts in AWS Organizations, consid + * **Decision 1: Where to enable AWS IAM Identity Center** – IAM Identity Center is the service that you use to manage user identities. You can enable IAM Identity Center in a management or member account. For more information about IAM Identity Center, see [What is IAM Identity Center?](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html) in the _IAM Identity Center User Guide_. @@ -15,0 +17 @@ If you plan to subscribe users in multiple accounts in AWS Organizations, consid + * **Decision 2: Where to install the Amazon Q Developer profile** – The profile is a collection of Pro tier settings. You can install the profile in a management or member account. For more information about the profile, see [Amazon Q Developer profiles](./subscribe-understanding-profile.html). @@ -16,0 +19 @@ If you plan to subscribe users in multiple accounts in AWS Organizations, consid + * **Decision 3: Where to subscribe users** – After you add users to IAM Identity Center, you must subscribe them. You can subscribe users in a management or member account. For more information about subscriptions, see [Managing Amazon Q Developer Pro subscriptions](./q-admin-setup-subscribe-general.html). @@ -18 +21,20 @@ If you plan to subscribe users in multiple accounts in AWS Organizations, consid -For more information about AWS Organizations, including information about management accounts and member accounts, see [Terminology and concepts for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html) in the _AWS Organizations User Guide_. + + + +Your specific combination of these three decisions constitutes your _deployment option_. + +Deployment options are described in the following table. + +## Deployment options for Amazon Q Developer Pro if you're using AWS Organizations + +Deployment option | Description | Advantages | Disadvantages +---|---|---|--- +**Deployment option 1** : Deploy in management and member accounts | With this deployment option: + + * In the **management** account, you [enable IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/enable-identity-center.html). + * In the **management** account, you [install the Amazon Q Developer profile](./subscribe-management.html#subscribe-management-install-profile) and then [share it with member accounts](./q-admin-profile-sharing.html). + * In a **member** account, you [subscribe users](./subscribe-member.html). + +| **More features**. Because IAM Identity Center is installed in a management account, it is considered to be an _organization instance_. Organization instances support all features of IAM Identity Center. For a list of supported features, see [When to use an organization instance](https://docs.aws.amazon.com/singlesignon/latest/userguide/identity-center-instances.html#identity-center-instances-organization) in the _AWS IAM Identity Center User Guide_. **Distributed management**. Subscription management tasks are distributed across member accounts, which is a best practice. | **Complexity**. Requires coordination across accounts by multiple administrators. +**Deployment option 2** : Deploy in a management account only | With this deployment option, you [enable IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/enable-identity-center.html), [install the Amazon Q Developer profile](./subscribe-management.html#subscribe-management-install-profile), and [subscribe users](./subscribe-management.html#subscribe-management-subscribe) in the **management** account. | **More features**. Because IAM Identity Center is enabled in a management account, it is considered to be an _organization instance_. Organization instances support all features of IAM Identity Center. For a list of supported features, see [When to use an organization instance](https://docs.aws.amazon.com/singlesignon/latest/userguide/identity-center-instances.html#identity-center-instances-organization) in the _AWS IAM Identity Center User Guide_. | **Centralized management**. Because users are subscribed in the management account, and because of a limitation in Amazon Q Developer where [delegated administration](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html) is not supported, management account administrators must handle subscription management tasks. You cannot follow the recommended practice of delegating tasks to member accounts. +**Deployment option 3** : Deploy in a member account only | With this deployment option, you [enable IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/enable-identity-center.html), [install the Amazon Q Developer profile](./subscribe-member.html), and [subscribe users](./subscribe-member.html#subscribe-member-new-other) in a **member** account. | **Quick setup**. Individual member account administrators can deploy without waiting or needing approval for an enterprise-wide implementation. **Flexibility for complex organizations**. Use this option when you don't have a unified identity provider or identity store containing the entire user base that you want to subscribe to Amazon Q Developer Pro. | **Fewer features**. Because IAM Identity Center is enabled in a member account, it is considered to be an _account instance_. Account instances support fewer features than organization instances. For example, account instance don't support permission sets, which means that users cannot use their Amazon Q Developer Pro subscriptions in the AWS console and AWS websites. For a list of the limitations of account instances, see [Account instance considerations](https://docs.aws.amazon.com/singlesignon/latest/userguide/identity-center-instances.html#identity-center-instances-account) in the _AWS IAM Identity Center User Guide_.