AWS amazonq documentation change
Summary
Added new required endpoint 'q-developer-integration.us-east-1.api.aws' to allowlist
Security assessment
Network allowlisting is a security-related practice but the change itself doesn't address a specific vulnerability - it updates required endpoints for proper service functionality.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/firewall.md b/amazonq/latest/qdeveloper-ug/firewall.md index e7051e223..c4afceebd 100644 --- a//amazonq/latest/qdeveloper-ug/firewall.md +++ b//amazonq/latest/qdeveloper-ug/firewall.md @@ -5 +5 @@ -General URLs to allowlistAmazon S3 bucket URLs and ARNs to allowlist +General URLs to allowlistAmazon S3 bucket URLs and ARNs to allowlistConfiguring a corporate proxy in Amazon Q for Visual Studio Code @@ -37,0 +38 @@ URL | Purpose +`q-developer-integration.us-east-1.api.aws` | Amazon Q Developer in the IDE, endpoints @@ -51,4 +51,0 @@ You only need to allowlist the bucket in the AWS Region where the Amazon Q Devel -###### Note - -You don't need to allowlist buckets if your user base is using version 1.72.0 (Visual Studio Code) or 3.74 (JetBrains) or later of the Amazon Q plugin. If users are using earlier versions of the plugin, or another IDE, you will still need to allowlist the buckets. - @@ -100,0 +98,101 @@ Europe (Frankfurt): +## Configuring a corporate proxy in Amazon Q for Visual Studio Code + +To configure proxy support for Amazon Q when working behind a corporate proxy, complete the steps in the following sections. + +### Step 1: Configuring proxy settings in VS Code + +The following procedure describes how to configure your proxy settings in VS Code. + + 1. From VS Code, open VS Code **Settings** by pressing `CMD + ,` (Mac) or `Ctrl + ,` (Windows/Linux). + + 2. From the **Settings** search bar, enter `Http: Proxy`, then locate it in the search results. + + 3. Enter your corporate proxy URL. Your corporate proxy URL must be in the following format: + +`http`s`://`proxy-url`:`proxy-port`` + +For example: + +`http://proxy.company.com:8080` + + 4. (Optional) in the **Settings** search bar, enter `HTTP: No Proxy`, then locate it in the results. + + 5. Choose the **Add Item** button, then add domains that bypass the proxy, separated by commas. + + + + +### Step 2: Configuring SSL certificate handling + +Amazon Q automatically detects and uses your system's trusted certificates. If you're still experiencing certificate errors, manually specify a certificate bundle by completing the following procedure. + +###### Note + +The following are situations where manual configuration is required. + + * You're encountering certificate-related errors after configuring the proxy. + + * Your corporate proxy uses certificates that aren't in the system trust store. + + * Amazon Q fails to automatically detect your corporate certificates. + + + + + 1. From VS Code, open VS Code **Settings** by pressing `CMD + ,` (Mac) or `Ctrl + ,` (Windows/Linux). + + 2. From the **Settings** search bar, enter `Amazon Q › Proxy: Certificate Authority`, then locate it in the search results. + + 3. Enter the path of your corporate certificate file. It will have a `.pem` or `.crt` file extension. + +An example path resembles the following: + +`/path/to/corporate-ca-bundle.pem` + +For instructions on obtaining this file, see Getting your corporate certificate. + +###### Note + +Specifying a certificate overrides the automatic certificate detection. + + + + +### Step 3: Restart VS Code + +You must restart VS Code in order to update Amazon Q with your changes. + +### Troubleshooting + +If you've completed the procedures in the previous sections and are still experiencing issues, use the following to troubleshoot. + + 1. Make sure your proxy URL format includes `http://` or `https://`. + + 2. Make sure your certificate file path is correct and accessible. + + 3. Review your Amazon Q logs in the **Output panel** of VS Code. + +###### Note + +If you encounter the following error messages: + + * `unable to verify the first certificate`, make sure you followed the instructions in Step 2: Configuring SSL certificate handling to specify a certificate manually. + + * `self signed certificate`, make sure you followed the instructions in Step 2: Configuring SSL certificate handling to specify a certificate manually. + + * `ECONNREFUSED`, check your internet connection and proxy information. + + + + +#### Getting your corporate certificate + +To obtain your corporate certificate, ask your IT team for the following information. + + * Your corporate certificate bundle, which is typically a `.pem` or `.crt` file. + + * Your proxy server details, including your host name, port, and authentication method. + + + +