AWS amazonq documentation change
Summary
Restructured region support documentation with clearer separation between Builder ID and IAM Identity Center users, added multi-region subscription guidance, and clarified data storage locations
Security assessment
The changes clarify data storage locations ("data is stored in the Region where you install the profile") and reference encryption at rest documentation. While this improves security transparency, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/q-admin-setup-subscribe-regions.md b/amazonq/latest/qdeveloper-ug/q-admin-setup-subscribe-regions.md index 4bc068f8e..39a16fdb9 100644 --- a//amazonq/latest/qdeveloper-ug/q-admin-setup-subscribe-regions.md +++ b//amazonq/latest/qdeveloper-ug/q-admin-setup-subscribe-regions.md @@ -5 +5 @@ -Supported Regions for IAM Identity CenterSupported Regions for the Q Developer console and Q Developer profile +Personal account (Builder ID) usersIAM Identity Center workforce users @@ -9 +9,22 @@ Supported Regions for IAM Identity CenterSupported Regions for the Q Developer c -The AWS services and resources that support Amazon Q Developer Pro subscriptions are available in the following AWS Regions. +Region information for the Pro tier varies depending on whether you're an end-user with a personal account (Builder ID), or you're an administrator of IAM Identity Center workforce users. + +## Personal account (Builder ID) users + +If you're the owner of a personal account (Builder ID), your Pro tier subscription is supported in the following Region: + + * US East (N. Virginia) + + + + +## IAM Identity Center workforce users + +Read this section if you're an administrator of IAM Identity Center workforce users. + +###### Topics + + * IAM Identity Center Regions supported by Amazon Q Developer + + * Supported Regions for the Q Developer console and Q Developer profile + + * Subscribing users to Amazon Q Developer Pro across AWS Regions @@ -11 +31,0 @@ The AWS services and resources that support Amazon Q Developer Pro subscriptions -For information about subscribing users across AWS Regions, see [Subscribe users to Amazon Q Developer Pro across AWS Regions](./subscribe-multi-region.html). @@ -13 +32,0 @@ For information about subscribing users across AWS Regions, see [Subscribe users -## Supported Regions for IAM Identity Center @@ -15 +33,0 @@ For information about subscribing users across AWS Regions, see [Subscribe users -The users that you want to subscribe to Amazon Q Developer Pro must have user entries in an IAM Identity Center instance (or a connected identity provider) in one of the Regions listed on the [Supported Regions page](./regions.html#default-regions), except for opt-in Regions. If your users have user entries in an IAM Identity Center instance in an opt-in Region, they can't be subscribed, which means they will only have access to the Free tier in the AWS console, and they won’t have access to Amazon Q in the IDE. Regardless of your Amazon Q Developer users' Region, data is stored in the Region where you install the Amazon Q Developer profile. @@ -17 +35,9 @@ The users that you want to subscribe to Amazon Q Developer Pro must have user en -For more information about Amazon Q Developer profiles, see [Amazon Q Developer profiles](./subscribe-understanding-profile.html). +### IAM Identity Center Regions supported by Amazon Q Developer + +The workforce users that you want to subscribe to Amazon Q Developer Pro must have identities in an IAM Identity Center instance (or a connected identity provider) in one of the Regions listed on the [Supported Regions page](./regions.html#default-regions), except for opt-in Regions. If your users have identities in an IAM Identity Center instance in an opt-in Region, they can't be subscribed, which means they will only have access to the Free tier [in the AWS Management Console, and on AWS apps and websites](./q-on-aws.html), and they won’t have access to Amazon Q in the IDE or at the command line. + +Amazon Q stores the subscriptions of IAM Identity Center workforce users in the same Region as your IAM Identity Center instance. + +Regardless of the IAM Identity Center Region, data is stored in the Region where you install the Amazon Q Developer profile. + +For more information about Amazon Q Developer profiles, see [Amazon Q Developer profile](./subscribe-understanding-profile.html). @@ -21 +47 @@ For more information about data protection, see [Data protection in Amazon Q Dev -## Supported Regions for the Q Developer console and Q Developer profile +### Supported Regions for the Q Developer console and Q Developer profile @@ -23 +49 @@ For more information about data protection, see [Data protection in Amazon Q Dev -The **Amazon Q Developer console** and **Amazon Q Developer profiles** are supported in the following Regions: +The **Amazon Q Developer console** and **Amazon Q Developer profile** are supported in the following Regions: @@ -32 +58 @@ The **Amazon Q Developer console** and **Amazon Q Developer profiles** are suppo -For more information about Amazon Q Developer profiles, see [Amazon Q Developer profiles](./subscribe-understanding-profile.html). +For more information about the Amazon Q Developer profile, see [Amazon Q Developer profile](./subscribe-understanding-profile.html). @@ -52,0 +79,52 @@ The following features aren’t supported for Q Developer profiles created in th +### Subscribing users to Amazon Q Developer Pro across AWS Regions + +When you subscribe an IAM Identity Center workforce user to Amazon Q Developer Pro, you might need to work in two different AWS Regions: + + * One Region for the IAM Identity Center instance (where user identities are managed, and where subscriptions are stored) + + * Another Region for the Amazon Q Developer console (where the [Amazon Q Developer profile](./subscribe-understanding-profile.html), customizations, and subscriptions are managed) + + + + +The Regions are not always the same because the Amazon Q Developer console is supported in fewer Regions than IAM Identity Center. + +In a scenario where your IAM Identity Center is in a different Region from your Amazon Q Developer console, use the guidance in the following example to subscribe users. + +#### Example subscription process in a multi-Region scenario + +Let's walk through subscribing a user where: + + * The IAM Identity Center instance is in **US West (N. California)**. + + * The Amazon Q Developer console is in **US East (N. Virginia)**. This is the closest Region to the IAM Identity Center instance that the Amazon Q Developer console supports. + + + + +###### To subscribe the user + + 1. Add the user in your IAM Identity Center instance in **US West (N. California)**. + + 2. Switch to the Amazon Q Developer console in the **US East (N. Virginia)**. + + 3. Subscribe the user through the Amazon Q Developer console in **US East (N. Virginia)**. + + + + +Upon being subscribed: + + * The user's subscription is created in **US West (N. California)**. + + * The user's subscription is associated with their user entry in **US West (N. California)**. + + * The user's subscription is associated with the Amazon Q Developer profile in **US East (N. Virginia)**. + + + + +Additionally, any data that Amazon Q Developer needs to store on the user's behalf will be stored in **US East (N. Virginia)**. For more information about data storage and security, see [Encryption at rest](./data-encryption.html#encryption-rest). + +For detailed instructions on subscribing users, see [Getting started with IAM Identity Center](./getting-started-idc.html). + @@ -59 +137 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Managing subscriptions +Pro tier subscriptions