AWS cost-management documentation change
Summary
Expanded permissions documentation for cost optimization capabilities, added cross-region call details, and updated service references
Security assessment
Added detailed IAM policies for cost optimization permissions and clarified cross-region data handling. While these changes improve security documentation, there's no evidence of addressing a specific vulnerability. The changes enhance access control documentation which is security-related but not a direct response to a security incident.
Diff
diff --git a/cost-management/latest/userguide/ce-q-security.md b/cost-management/latest/userguide/ce-q-security.md index 2af7b70e2..40559a76d 100644 --- a//cost-management/latest/userguide/ce-q-security.md +++ b//cost-management/latest/userguide/ce-q-security.md @@ -5 +5 @@ -PermissionsData protection +Cost analysis permissionsCost optimization permissionsq:PassRequest permissionCross-region callsData protection @@ -7 +7 @@ PermissionsData protection -# Security for Amazon Q Developer's cost analysis capability +# Security for cost management capabilities in Amazon Q Developer @@ -9 +9 @@ PermissionsData protection -The following provides an overview of permissions and data protection for Amazon Q Developer's cost analysis capability. +The following provides an overview of permissions and data protection for the cost management capabilities in Amazon Q Developer. @@ -11 +11 @@ The following provides an overview of permissions and data protection for Amazon -## Permissions +## Cost analysis permissions @@ -13 +13 @@ The following provides an overview of permissions and data protection for Amazon -All cost data provided by Amazon Q Developer is sourced from Cost Explorer. The IAM user who accesses Amazon Q Developer’s cost analysis capabilities must have permissions to use Amazon Q Developer and permissions to retrieve cost and usage data from Cost Explorer. The quickest way for an administrator to grant users access to Amazon Q Developer is to use the `AmazonQFullAccess` managed policy. Users also need access to the `ce:GetCostAndUsage` permission. +All cost data provided by Amazon Q Developer is sourced from Cost Explorer. The IAM user who accesses the cost analysis capability in Amazon Q Developer must have permissions to use Amazon Q Developer and permissions to retrieve cost and usage data from Cost Explorer. The quickest way for an administrator to grant users access to Amazon Q Developer is to use the `AmazonQFullAccess` managed policy. Users also need access to the `ce:GetCostAndUsage` permission. @@ -41,0 +42,38 @@ The following IAM policy statement grants users access to the cost analysis capa +## Cost optimization permissions + +The following IAM policy statement grants users access to the cost optimization capability in Amazon Q Developer: + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "EnablesCostOptimizationInAmazonQ", + "Effect": "Allow", + "Action": [ + "q:StartConversation", + "q:SendMessage", + "q:GetConversation", + "q:ListConversations", + "q:PassRequest", + "cost-optimization-hub:GetRecommendation", + "cost-optimization-hub:ListRecommendations", + "cost-optimization-hub:ListRecommendationSummaries", + "compute-optimizer:GetAutoScalingGroupRecommendations", + "compute-optimizer:GetEBSVolumeRecommendations", + "compute-optimizer:GetEC2InstanceRecommendations", + "compute-optimizer:GetECSServiceRecommendations", + "compute-optimizer:GetLambdaFunctionRecommendations", + "compute-optimizer:GetRDSDatabaseRecommendations", + "compute-optimizer:GetIdleRecommendations", + "compute-optimizer:GetEffectiveRecommendationPreferences", + "ce:GetReservationPurchaseRecommendation", + "ce:GetSavingsPlansPurchaseRecommendation" + ], + "Resource": "*" + } + ] + } + +## q:PassRequest permission + @@ -44 +82 @@ The following IAM policy statement grants users access to the cost analysis capa -You can also allow IAM principals to access Cost Explorer and to use Amazon Q Developer, but restrict them from using the cost analysis capability in Amazon Q Developer, by using the `aws:CalledVia` [global condition key](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia). The following IAM policy provides an example of using this condition key. +You can also allow IAM principals to access Cost Explorer and to use Amazon Q Developer, but restrict them from using the cost analysis or cost optimization capabilities in Amazon Q Developer, by using the `aws:CalledVia` [global condition key](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia). The following IAM policy provides an example of using this condition key. @@ -80 +118,5 @@ You can also allow IAM principals to access Cost Explorer and to use Amazon Q De -For users of AWS Organizations, management account administrators can restrict member account users’ access to Cost Explorer data (including access to discounts, credits, and refunds) using the Cost Management preferences in the AWS Billing and Cost Management console. These preferences apply to Amazon Q Developer in the same way that they apply to the management console, SDK, and CLI. Amazon Q Developer respects the existing preferences of customers. +For users of AWS Organizations, management account administrators can restrict member account users’ access to Cost Explorer and Cost Optimization Hub data (including access to discounts, credits, and refunds) using the Cost Management preferences in the AWS Billing and Cost Management console. These preferences apply to Amazon Q Developer in the same way that they apply to the management console, SDK, and CLI. Amazon Q Developer respects the existing preferences of customers. + +## Cross-region calls + +Data from the Cost Optimization Hub and Cost Explorer services is hosted in the US East (N. Virginia) Region. Data from AWS Compute Optimizer is hosted in the AWS Region where the underlying resources, such as EC2 instances, are located. Cost analysis and cost optimization requests may require cross-region calls. For more information, see [Cross-region processing in Amazon Q Developer](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/cross-region-processing.html) in the _Amazon Q Developer User Guide_. @@ -84 +126 @@ For users of AWS Organizations, management account administrators can restrict m -We may use certain content from Amazon Q Developer Free Tier for service improvement. Amazon Q may use this content, for example, to provide better responses to common questions, fix Amazon Q operational issues, for de-bugging, or for model training. Content that AWS may use for service improvement includes, for example, your questions to Amazon Q and the responses and code that Amazon Q generates. We do not use content from Amazon Q Developer Pro or Amazon Q Business for service improvement. +We may use certain content from Amazon Q Developer Free Tier for service improvement. Amazon Q Developer may use this content, for example, to provide better responses to common questions, fix Amazon Q Developer operational issues, for debugging, or for model training. Content that AWS may use for service improvement includes, for example, your questions to Amazon Q Developer and the responses and code that Amazon Q Developer generates. We do not use content from Amazon Q Developer Pro or Amazon Q Business for service improvement. @@ -96 +138 @@ Prompting guidance -Understanding your costs using Cost Explorer reports +Managing your costs with Savings Plans