AWS amazonq medium security documentation change
Summary
Updated VPC endpoint configuration details with region specificity and removed Cloud9 references
Security assessment
The change specifies exact region requirements (us-east-1) for CodeWhisperer endpoints and removes outdated configuration examples. Incorrect VPC endpoint configuration could lead to security exposure through misrouted traffic or service unavailability. The explicit region guidance helps prevent misconfigurations that might expose API traffic.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/vpc-interface-endpoints.md b/amazonq/latest/qdeveloper-ug/vpc-interface-endpoints.md index 0d83a72c5..805530c94 100644 --- a//amazonq/latest/qdeveloper-ug/vpc-interface-endpoints.md +++ b//amazonq/latest/qdeveloper-ug/vpc-interface-endpoints.md @@ -46 +46 @@ Create the following VPC endpoints for Amazon Q using the following service name - * com.amazonaws.`region`.codewhisperer + * com.amazonaws.us-east-1.codewhisperer @@ -51,3 +51 @@ Create the following VPC endpoints for Amazon Q using the following service name -If you enable private DNS for the endpoint, you can make API requests to Amazon Q using its default DNS name for the Region, for example, `q.us-east-1.amazonaws.com`. - -For more information, see [Accessing a service through an interface endpoint](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#access-service-though-endpoint) in the _Amazon VPC User Guide_. +Replace `region` with AWS Region where your Amazon Q Developer profile is installed. For more information, see [Supported Regions for the Q Developer console and Q Developer profile](./q-admin-setup-subscribe-regions.html#qdev-console-and-profile-regions). @@ -57 +55,5 @@ For more information, see [Accessing a service through an interface endpoint](ht -Currently, you can only create an interface endpoint for Amazon Q Developer in the US East (N. Virginia) Region and Europe (Frankfurt) Region. +The Amazon CodeWhisperer endpoint (com.amazonaws.us-east-1.codewhisperer) is only supported in the US East (N. Virginia) Region. + +If you enable private DNS for the endpoint, you can make API requests to Amazon Q using its default DNS name for the Region, for example, `q.us-east-1.amazonaws.com`. + +For more information, see [Accessing a service through an interface endpoint](https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html#access-service-though-endpoint) in the _Amazon VPC User Guide_. @@ -76 +78 @@ This section describes the process of using an in-console coding environment to -In this context, an in-console IDE is an IDE that you access inside the AWS console, and authenticate to with IAM. Examples include AWS Cloud9, SageMaker AI Studio, and AWS Glue Studio. +In this context, an in-console IDE is an IDE that you access inside the AWS console, and authenticate to with IAM. Examples include SageMaker AI Studio and AWS Glue Studio. @@ -82,2 +83,0 @@ In this context, an in-console IDE is an IDE that you access inside the AWS cons - * [AWS Cloud9](./cloud9-setup.html) - @@ -90,2 +89,0 @@ In this context, an in-console IDE is an IDE that you access inside the AWS cons - * [AWS Cloud9](https://docs.aws.amazon.com/cloud9/latest/user-guide/vpc-settings.html) -