AWS amazonq high security documentation change
Summary
Updated firewall configuration documentation with region-specific placeholders, expanded S3 bucket details across regions, and added implementation notes
Security assessment
The changes provide critical security configuration details for proper firewall/proxy setup, including region-specific URL patterns and S3 bucket ARNs. This directly addresses potential misconfiguration risks by clarifying required network permissions. The addition of Frankfurt region S3 buckets and workaround notes indicates this helps prevent service disruptions from overly restrictive firewall rules.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/firewall.md b/amazonq/latest/qdeveloper-ug/firewall.md index cca108b0c..f47d6e0e8 100644 --- a//amazonq/latest/qdeveloper-ug/firewall.md +++ b//amazonq/latest/qdeveloper-ug/firewall.md @@ -12,0 +13,11 @@ If you're using a firewall, proxy server, or [data perimeter](https://aws.amazon +In the following URLs, replace: + + * `idc-directory-id-or-alias` with your IAM Identity Center instance's directory ID or alias. For more information about IAM Identity Center, see [What is IAM Identity Center?](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html) in the _AWS IAM Identity Center User Guide_. + + * `sso-region` with the AWS Region where your IAM Identity Center instance is enabled. For more information, see [Supported Regions for IAM Identity Center](./q-admin-setup-subscribe-regions.html#pro-subscription-regions). + + * `profile-region` with the AWS Region where your Amazon Q Developer profile is installed. For more information about the Amazon Q Developer profile, see [Amazon Q Developer profiles](./subscribe-understanding-profile.html) and [Supported Regions for the Q Developer console and Q Developer profile](./q-admin-setup-subscribe-regions.html#qdev-console-and-profile-regions). + + + + @@ -15,4 +26,4 @@ URL | Purpose -``identity-center-directory-id-or-alias`.awsapps.com ` | Authentication -`oidc.`region`.amazonaws.com` | Authentication -`*.sso.`region`.amazonaws.com` | Authentication -`*.sso-portal.`region`.amazonaws.com` | Authentication +``idc-directory-id-or-alias`.awsapps.com ` | Authentication +`oidc.`sso-region`.amazonaws.com` | Authentication +`*.sso.`sso-region`.amazonaws.com` | Authentication +`*.sso-portal.`sso-region`.amazonaws.com` | Authentication @@ -24 +35 @@ URL | Purpose -`https://q.us-east-1.amazonaws.com` | Amazon Q Developer features +`https://q.`profile-region`.amazonaws.com` | Amazon Q Developer features @@ -28 +39 @@ URL | Purpose -`https://aws-language-servers.us-east-1.amazonaws.com` | Amazon Q Developer in the IDE, language processing +`https://aws-language-servers.us-east-1.amazonaws.com/*` | Amazon Q Developer in the IDE, language processing @@ -37,0 +49,2 @@ The following table lists the URL and ARN of each of the Amazon S3 buckets that +You only need to allowlist the bucket in the AWS Region where the Amazon Q Developer profile is installed. For more information about the Amazon Q Developer profile, see [Amazon Q Developer profiles](./subscribe-understanding-profile.html). + @@ -40,4 +53,43 @@ Amazon S3 bucket URL and ARN | Purpose -`https://amazonq-code-scan-us-east-1-29121b44f7b.s3.amazonaws.com/` `arn:aws:s3:::amazonq-code-scan-us-east-1-29121b44f7b` | An Amazon S3 bucket used to upload artifacts for [Amazon Q code reviews](./code-reviews.html) -`https://amazonq-code-transformation-us-east-1-c6160f047e0.s3.amazonaws.com/` `arn:aws:s3:::amazonq-code-transformation-us-east-1-c6160f047e0` | An Amazon S3 bucket used to upload artifacts for the [Amazon Q Developer Agent for code transformation](./code-transformation.html) -`https://amazonq-feature-development-us-east-1-a5b980054c6.s3.amazonaws.com/` `arn:aws:s3:::amazonq-feature-development-us-east-1-a5b980054c6` | An Amazon S3 bucket used to upload artifacts for the [Amazon Q Developer Agent for software development](./software-dev.html) -`https://amazonq-test-generation-us-east-1-74b667808f2.s3.us-east-1.amazonaws.com/` `arn:aws:s3:::amazonq-test-generation-us-east-1-74b667808f2` | An Amazon S3 bucket used to upload artifacts for the [Amazon Q Developer Agent for unit test generation](./test-generation.html) +US East (N. Virginia): + + * `https://amazonq-code-scan-us-east-1-29121b44f7b.s3.amazonaws.com/` + * `arn:aws:s3:::amazonq-code-scan-us-east-1-29121b44f7b` + +Europe (Frankfurt): + + * `https://amazonq-code-scan-eu-central-1-9374e402cc5.s3.amazonaws.com/` + * `arn:aws:s3:::amazonq-code-scan-eu-central-1-9374e402cc5` + +| An Amazon S3 bucket used to upload artifacts for [Amazon Q code reviews](./code-reviews.html) +US East (N. Virginia): + + * `https://amazonq-code-transformation-us-east-1-c6160f047e0.s3.amazonaws.com/` + * `arn:aws:s3:::amazonq-code-transformation-us-east-1-c6160f047e0` + +Europe (Frankfurt): + + * `https://amazonq-code-transformation-eu-central-1-a0a89cc2b94.s3.amazonaws.com/` + * `arn:aws:s3:::amazonq-code-transformation-eu-central-1-a0a89cc2b94` + +| An Amazon S3 bucket used to upload artifacts for the [Amazon Q Developer Agent for code transformation](./code-transformation.html) +US East (N. Virginia): + + * `https://amazonq-feature-development-us-east-1-a5b980054c6.s3.amazonaws.com/` + * `arn:aws:s3:::amazonq-feature-development-us-east-1-a5b980054c6` + +Europe (Frankfurt): + +###### Note + +A URL and ARN are not available for the Europe (Frankfurt) Region. As a workaround, tell users to use the agentic chat feature for their software development needs. | An Amazon S3 bucket used to upload artifacts for the [Amazon Q Developer Agent for software development](./software-dev.html) +US East (N. Virginia): + + * `https://amazonq-test-generation-us-east-1-74b667808f2.s3.us-east-1.amazonaws.com/` + * `arn:aws:s3:::amazonq-test-generation-us-east-1-74b667808f2` + +Europe (Frankfurt): + + * `https://amazonq-test-generation-eu-central-1-335c4259858.s3.us-east-1.amazonaws.com/` + * `arn:aws:s3:::amazonq-test-generation-eu-central-1-335c4259858` + +| An Amazon S3 bucket used to upload artifacts for the [Amazon Q Developer Agent for unit test generation](./test-generation.html)