AWS amazonq documentation change
Summary
Restructured deployment option descriptions with clearer step-by-step instructions and updated links. Added explicit bullet points for deployment procedures across all options.
Security assessment
The changes primarily improve documentation structure and clarity around IAM Identity Center deployment steps. While IAM Identity Center is security-related, there's no evidence these changes address a specific vulnerability or weakness. The updates focus on procedural clarity rather than introducing new security controls or mitigating existing risks.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/deployment-options.md b/amazonq/latest/qdeveloper-ug/deployment-options.md index 4a47f023c..220e23b60 100644 --- a//amazonq/latest/qdeveloper-ug/deployment-options.md +++ b//amazonq/latest/qdeveloper-ug/deployment-options.md @@ -35 +35,7 @@ Deployment option | Description | Advantages | Disadvantages -**Deployment option 1 (easiest)** : Deploy in a standalone account | Use this option if you're an end user and you want to subscribe yourself (and optionally, a small team of users) to quickly evaluate the features of Amazon Q. With this deployment option, you enable IAM Identity Center, install the Amazon Q Developer profile, and subscribe yourself (and team members) in your **standalone** account. For instructions, see [Subscribe users to Amazon Q Developer Pro in a standalone account](./subscribe-standalone.html). | **Good for demos**. You can try out Pro tier features for yourself without having to do an enterprise-wide implementation. **More features than personal accounts (Builder IDs)**. For more information, see [Limitations of Builder IDs](./getting-started-builderid.html#builder-id-limitations). | **Fewer features** Because IAM Identity Center is enabled in a standalone account, it is considered to be an _account instance_ , which has fewer features than organization instances1. +**Deployment option 1 (easiest)** : Deploy in a standalone account | Use this option if you're an end user and you want to subscribe yourself (and optionally, a small team of users) to quickly evaluate the features of Amazon Q. With this deployment option, in your **standalone** account, you: + + * enable IAM Identity Center, + * install the Amazon Q Developer profile, and + * subscribe yourself (and team members). For detailed instructions, see [Subscribe users to Amazon Q Developer Pro in a standalone account](./subscribe-standalone.html). + +| **Good for demos**. You can try out Pro tier features for yourself without having to do an enterprise-wide implementation. **More features than personal accounts (Builder IDs)**. For more information, see [Limitations of Builder IDs](./getting-started-builderid.html#builder-id-limitations). | **Fewer features** Because IAM Identity Center is enabled in a standalone account, it is considered to be an _account instance_ , which has fewer features than organization instances1. @@ -38,2 +44,5 @@ Deployment option | Description | Advantages | Disadvantages - * In the **management** account, you enable IAM Identity Center, [install the Amazon Q Developer profile,](./subscribe-management.html#subscribe-management-install-profile) and [share it](./subscribe-management.html#subscribe-management-install-profile) with member accounts. - * In a **member** account, you [subscribe users](./subscribe-member.html). + * In the **management** account, you enable IAM Identity Center. + * In a **member** account, you: + * install the Amazon Q Developer profile, and + * subscribe users. +For detailed instructions, see [Subscribe users to Amazon Q Developer Pro in a member account](./subscribe-member.html). @@ -42 +51,7 @@ Deployment option | Description | Advantages | Disadvantages -**Deployment option 3** : Deploy in a member account only | Use this option if you're an adminstrator of multiple users. With this deployment option, you enable IAM Identity Center, install the Amazon Q Developer profile, and subscribe users in a **member** account. For instructions, see [Subscribe users to Amazon Q Developer Pro in a member account](./subscribe-member.html). | **Quick setup**. Individual member account administrators can deploy without waiting or needing approval for an enterprise-wide implementation. **Flexibility for complex organizations**. Use this option when you don't have a unified identity provider or identity store containing the entire user base that you want to subscribe to the Pro tier. | **Fewer features**. Because IAM Identity Center is enabled in a member account, it is considered to be an _account instance_ , which has fewer features than organization instances1. +**Deployment option 3** : Deploy in a member account only | Use this option if you're an adminstrator of multiple users. With this deployment option, in a **member** account, you: + + * enable IAM Identity Center, + * install the Amazon Q Developer profile, and + * subscribe users. For detailed instructions, see [Subscribe users to Amazon Q Developer Pro in a member account](./subscribe-member.html). + +| **Quick setup**. Individual member account administrators can deploy without waiting or needing approval for an enterprise-wide implementation. **Flexibility for complex organizations**. Use this option when you don't have a unified identity provider or identity store containing the entire user base that you want to subscribe to the Pro tier. | **Fewer features**. Because IAM Identity Center is enabled in a member account, it is considered to be an _account instance_ , which has fewer features than organization instances1. @@ -47 +62,8 @@ Deployment option | Description | Advantages | Disadvantages -Warning: Only use this option if you cannot use any other option. | Use this option if you're an adminstrator of multiple users. With this deployment option, you enable IAM Identity Center, install the Amazon Q Developer profile, and subscribe users in the **management** account. For instructions, see [Subscribe users to Amazon Q Developer Pro in a management account](./subscribe-management.html). | **More features**. Because IAM Identity Center is installed in a management account, it is considered to be an _organization instance_ , which has more features than account instances2. | **Does not comply with best practices**. Because users are subscribed in the management account, and because of a limitation in Amazon Q Developer where [delegated administration](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html) is not supported, management account administrators must handle subscription management tasks. You cannot follow the [recommended practice](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html#delegated-admin-best-practices) of delegating tasks to member accounts. +Because this option violates best practices, only use it if you cannot use any other option. | Use this option if you're an adminstrator of multiple users. With this deployment option, in the **management** account, you: + + * enable IAM Identity Center, + * install the Amazon Q Developer profile, + * subscribe users, and + * optionally, [share the Amazon Q Developer profile](./subscribe-management.html#subscribe-management-install-profile) with member accounts. + +For detailed instructions, see [Subscribe users to Amazon Q Developer Pro in a management account](./subscribe-management.html). | **More features**. Because IAM Identity Center is installed in a management account, it is considered to be an _organization instance_ , which has more features than account instances2. | **Does not comply with best practices**. Because users are subscribed in the management account, and because of a limitation in Amazon Q Developer where [delegated administration](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html) is not supported, management account administrators must handle subscription management tasks. You cannot follow the [recommended practice](https://docs.aws.amazon.com/singlesignon/latest/userguide/delegated-admin.html#delegated-admin-best-practices) of delegating tasks to member accounts.