AWS amazonq documentation change

Service: amazonq · 2025-06-04 · Documentation medium

File: amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md

Summary

Added new IAM policy example allowing Amazon Q to access cost data and provide optimization recommendations, including permissions for Cost Explorer, Cost Optimization Hub, and Compute Optimizer

Security assessment

This change documents security-related permissions for accessing financial and optimization data, making it security documentation. However, there's no indication this addresses an existing security issue - it appears to be a new capability rather than a vulnerability fix.

Diff

diff --git a/amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md b/amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md
index 6bff15f1e..21bcaa03b 100644
--- a//amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md
+++ b//amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md
@@ -5 +5 @@
-Allow users to access Amazon Q with an Amazon Q Developer Pro subscriptionAllow Amazon Q access to customer managed keysAllow users to chat with Amazon QAllow users to use Amazon Q CLI with AWS CloudShellAllow users to run transformations on the command lineAllow users to diagnose console errors with Amazon QAllow users to generate code from CLI commands with Amazon QAllow users to chat about resources with Amazon QAllow Amazon Q to perform actions on your behalf in chatDeny Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform actions on your behalf in specific regionsDeny Amazon Q permission to perform actions on your behalfAllow users to chat with plugins from one providerAllow users to chat with a specific pluginDeny access to Amazon QAllow users to view their permissions
+Allow users to access Amazon Q with an Amazon Q Developer Pro subscriptionAllow Amazon Q access to customer managed keysAllow users to chat with Amazon QAllow users to use Amazon Q CLI with AWS CloudShellAllow users to run transformations on the command lineAllow users to diagnose console errors with Amazon QAllow users to generate code from CLI commands with Amazon QAllow users to chat about resources with Amazon QAllow Amazon Q to perform actions on your behalf in chatAllow Amazon Q to access cost data and provide cost optimization recommendationsDeny Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform actions on your behalf in specific regionsDeny Amazon Q permission to perform actions on your behalfAllow users to chat with plugins from one providerAllow users to chat with a specific pluginDeny access to Amazon QAllow users to view their permissions
@@ -251,0 +252,57 @@ The following example policy grants permission to chat with Amazon Q, and allows
+## Allow Amazon Q to access cost data and provide cost optimization recommendations
+
+The following example policy grants permission to chat with Amazon Q about your costs and allows Amazon Q to access your cost data and provide cost analysis and optimization recommendations. This policy includes the relevant permissions in AWS Cost Explorer, AWS Cost Optimization Hub, and AWS Compute Optimizer.
+    
+    
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Sid": "AllowAmazonQChatAndPassRequest",
+          "Effect": "Allow",
+          "Action": [
+            "q:StartConversation",
+            "q:SendMessage",
+            "q:GetConversation",
+            "q:ListConversations",
+            "q:UpdateConversation",
+            "q:DeleteConversation",
+            "q:PassRequest"
+          ],
+          "Resource": "*"
+        },
+        {
+          "Sid": "AllowCostAnalysis",
+          "Effect": "Allow",
+          "Action": [
+            "ce:GetCostAndUsage",
+            "ce:GetCostForecast",
+            "ce:GetTags",
+            "ce:GetCostCategories",
+            "ce:GetDimensionValues"
+          ],
+          "Resource": "*"
+        },
+        {
+          "Sid": "AllowCostOptimization",
+          "Effect": "Allow",
+          "Action": [
+            "cost-optimization-hub:GetRecommendation",
+            "cost-optimization-hub:ListRecommendations",
+            "cost-optimization-hub:ListRecommendationSummaries",
+            "compute-optimizer:GetAutoScalingGroupRecommendations",
+            "compute-optimizer:GetEBSVolumeRecommendations",
+            "compute-optimizer:GetEC2InstanceRecommendations",
+            "compute-optimizer:GetECSServiceRecommendations",
+            "compute-optimizer:GetRDSDatabaseRecommendations",
+            "compute-optimizer:GetLambdaFunctionRecommendations",
+            "compute-optimizer:GetIdleRecommendations",
+            "compute-optimizer:GetEffectiveRecommendationPreferences",
+            "ce:GetReservationPurchaseRecommendation",
+            "ce:GetSavingsPlansPurchaseRecommendation"
+          ],
+          "Resource": "*"
+        }
+      ]
+    }
+