AWS amazonq medium security documentation change
Summary
Added detailed corporate proxy configuration instructions for VS Code including SSL certificate handling and troubleshooting
Security assessment
Added explicit guidance for secure proxy configuration and SSL certificate management to prevent man-in-the-middle attacks and ensure secure connections. Includes certificate authority configuration and error handling for corporate environments.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/firewall.md b/amazonq/latest/qdeveloper-ug/firewall.md index e7051e223..c4afceebd 100644 --- a//amazonq/latest/qdeveloper-ug/firewall.md +++ b//amazonq/latest/qdeveloper-ug/firewall.md @@ -5 +5 @@ -General URLs to allowlistAmazon S3 bucket URLs and ARNs to allowlist +General URLs to allowlistAmazon S3 bucket URLs and ARNs to allowlistConfiguring a corporate proxy in Amazon Q for Visual Studio Code @@ -37,0 +38 @@ URL | Purpose +`q-developer-integration.us-east-1.api.aws` | Amazon Q Developer in the IDE, endpoints @@ -51,4 +51,0 @@ You only need to allowlist the bucket in the AWS Region where the Amazon Q Devel -###### Note - -You don't need to allowlist buckets if your user base is using version 1.72.0 (Visual Studio Code) or 3.74 (JetBrains) or later of the Amazon Q plugin. If users are using earlier versions of the plugin, or another IDE, you will still need to allowlist the buckets. - @@ -100,0 +98,101 @@ Europe (Frankfurt): +## Configuring a corporate proxy in Amazon Q for Visual Studio Code + +To configure proxy support for Amazon Q when working behind a corporate proxy, complete the steps in the following sections. + +### Step 1: Configuring proxy settings in VS Code + +The following procedure describes how to configure your proxy settings in VS Code. + + 1. From VS Code, open VS Code **Settings** by pressing `CMD + ,` (Mac) or `Ctrl + ,` (Windows/Linux). + + 2. From the **Settings** search bar, enter `Http: Proxy`, then locate it in the search results. + + 3. Enter your corporate proxy URL. Your corporate proxy URL must be in the following format: + +`http`s`://`proxy-url`:`proxy-port`` + +For example: + +`http://proxy.company.com:8080` + + 4. (Optional) in the **Settings** search bar, enter `HTTP: No Proxy`, then locate it in the results. + + 5. Choose the **Add Item** button, then add domains that bypass the proxy, separated by commas. + + + + +### Step 2: Configuring SSL certificate handling + +Amazon Q automatically detects and uses your system's trusted certificates. If you're still experiencing certificate errors, manually specify a certificate bundle by completing the following procedure. + +###### Note + +The following are situations where manual configuration is required. + + * You're encountering certificate-related errors after configuring the proxy. + + * Your corporate proxy uses certificates that aren't in the system trust store. + + * Amazon Q fails to automatically detect your corporate certificates. + + + + + 1. From VS Code, open VS Code **Settings** by pressing `CMD + ,` (Mac) or `Ctrl + ,` (Windows/Linux). + + 2. From the **Settings** search bar, enter `Amazon Q › Proxy: Certificate Authority`, then locate it in the search results. + + 3. Enter the path of your corporate certificate file. It will have a `.pem` or `.crt` file extension. + +An example path resembles the following: + +`/path/to/corporate-ca-bundle.pem` + +For instructions on obtaining this file, see Getting your corporate certificate. + +###### Note + +Specifying a certificate overrides the automatic certificate detection. + + + + +### Step 3: Restart VS Code + +You must restart VS Code in order to update Amazon Q with your changes. + +### Troubleshooting + +If you've completed the procedures in the previous sections and are still experiencing issues, use the following to troubleshoot. + + 1. Make sure your proxy URL format includes `http://` or `https://`. + + 2. Make sure your certificate file path is correct and accessible. + + 3. Review your Amazon Q logs in the **Output panel** of VS Code. + +###### Note + +If you encounter the following error messages: + + * `unable to verify the first certificate`, make sure you followed the instructions in Step 2: Configuring SSL certificate handling to specify a certificate manually. + + * `self signed certificate`, make sure you followed the instructions in Step 2: Configuring SSL certificate handling to specify a certificate manually. + + * `ECONNREFUSED`, check your internet connection and proxy information. + + + + +#### Getting your corporate certificate + +To obtain your corporate certificate, ask your IT team for the following information. + + * Your corporate certificate bundle, which is typically a `.pem` or `.crt` file. + + * Your proxy server details, including your host name, port, and authentication method. + + + +