AWS amazonq medium security documentation change
Summary
Swapped deployment options 2 and 3, added a warning against using management account deployment unless necessary, and updated disadvantages to emphasize non-compliance with best practices
Security assessment
The change adds a warning explicitly discouraging management account deployment (option 3) unless unavoidable, highlighting security best practice violations. It emphasizes that this approach prevents delegated administration, increasing centralization risks. The reference to AWS best practices for account management indicates security implications of improper access control.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/tracking-across-org.md b/amazonq/latest/qdeveloper-ug/tracking-across-org.md index 3b366990f..a0c5cf1b3 100644 --- a//amazonq/latest/qdeveloper-ug/tracking-across-org.md +++ b//amazonq/latest/qdeveloper-ug/tracking-across-org.md @@ -39,2 +39,6 @@ Deployment option | Description | Advantages | Disadvantages -**Deployment option 2** : Deploy in a management account only | With this deployment option, you [enable IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/enable-identity-center.html), [install the Amazon Q Developer profile](./subscribe-management.html#subscribe-management-install-profile), and [subscribe users](./subscribe-management.html#subscribe-management-subscribe) in the **management** account. | **More features**. Because IAM Identity Center is enabled in a management account, it is considered to be an _organization instance_. Organization instances support all features of IAM Identity Center. For a list of supported features, see [When to use an organization instance](https://docs.aws.amazon.com/singlesignon/latest/userguide/identity-center-instances.html#identity-center-instances-organization) in the _AWS IAM Identity Center User Guide_. | **Centralized management**. Because users are subscribed in the management account, and because of a limitation in Amazon Q Developer where [delegated administration](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html) is not supported, management account administrators must handle subscription management tasks. You cannot follow the recommended practice of delegating tasks to member accounts. -**Deployment option 3** : Deploy in a member account only | With this deployment option, you [enable IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/enable-identity-center.html), [install the Amazon Q Developer profile](./subscribe-member.html), and [subscribe users](./subscribe-member.html#subscribe-member-new-other) in a **member** account. | **Quick setup**. Individual member account administrators can deploy without waiting or needing approval for an enterprise-wide implementation. **Flexibility for complex organizations**. Use this option when you don't have a unified identity provider or identity store containing the entire user base that you want to subscribe to Amazon Q Developer Pro. | **Fewer features**. Because IAM Identity Center is enabled in a member account, it is considered to be an _account instance_. Account instances support fewer features than organization instances. For example, account instance don't support permission sets, which means that users cannot use their Amazon Q Developer Pro subscriptions in the AWS console and AWS websites. For a list of the limitations of account instances, see [Account instance considerations](https://docs.aws.amazon.com/singlesignon/latest/userguide/identity-center-instances.html#identity-center-instances-account) in the _AWS IAM Identity Center User Guide_. +**Deployment option 2** : Deploy in a member account only | With this deployment option, you [enable IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/enable-identity-center.html), [install the Amazon Q Developer profile](./subscribe-member.html), and [subscribe users](./subscribe-member.html#subscribe-member-new-other) in a **member** account. | **Quick setup**. Individual member account administrators can deploy without waiting or needing approval for an enterprise-wide implementation. **Flexibility for complex organizations**. Use this option when you don't have a unified identity provider or identity store containing the entire user base that you want to subscribe to Amazon Q Developer Pro. | **Fewer features**. Because IAM Identity Center is enabled in a member account, it is considered to be an _account instance_. Account instances support fewer features than organization instances. For example, account instance don't support permission sets, which means that users cannot use their Amazon Q Developer Pro subscriptions in the AWS console and AWS websites. For a list of the limitations of account instances, see [Account instance considerations](https://docs.aws.amazon.com/singlesignon/latest/userguide/identity-center-instances.html#identity-center-instances-account) in the _AWS IAM Identity Center User Guide_. +**Deployment option 3** : Deploy in a management account only + +###### Warning + +Only use this option if options 1 and 2 are not available to you. | With this deployment option, you [enable IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/enable-identity-center.html), [install the Amazon Q Developer profile](./subscribe-management.html#subscribe-management-install-profile), and [subscribe users](./subscribe-management.html#subscribe-management-subscribe) in the **management** account. | **More features**. Because IAM Identity Center is enabled in a management account, it is considered to be an _organization instance_. Organization instances support all features of IAM Identity Center. For a list of supported features, see [When to use an organization instance](https://docs.aws.amazon.com/singlesignon/latest/userguide/identity-center-instances.html#identity-center-instances-organization) in the _AWS IAM Identity Center User Guide_. | **Does not comply with best practices**. Because users are subscribed in the management account, and because of a limitation in Amazon Q Developer where [delegated administration](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html) is not supported, management account administrators must handle subscription management tasks. You cannot follow the [recommended practice](https://docs.aws.amazon.com/latest/userguide/orgs_best-practices_mgmt-acct.html) of delegating tasks to member accounts.