AWS amazonq medium security documentation change
Summary
Revised profile sharing documentation to remove incorrect override behavior claims and clarify subscription benefits
Security assessment
The removal of 'management account profile overrides member accounts' corrects a potential misconfiguration risk where organizations might have relied on incorrect inheritance behavior for security settings. This change prevents possible privilege escalation scenarios where member account configurations could have been unexpectedly overridden.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/q-admin-profile-sharing.md b/amazonq/latest/qdeveloper-ug/q-admin-profile-sharing.md index 4525c53b9..42c4be176 100644 --- a//amazonq/latest/qdeveloper-ug/q-admin-profile-sharing.md +++ b//amazonq/latest/qdeveloper-ug/q-admin-profile-sharing.md @@ -11,9 +11 @@ This section does not apply to personal accounts (Builder IDs). -If you are a management account administrator within an organization managed by [AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html), you can enable the _profile sharing_ feature. When profile sharing is enabled, the [Amazon Q Developer profile](./subscribe-understanding-profile.html) that has been installed in a management account will be shared with member accounts. There are two reasons you might want to this: - - * **Administrative benefits** : Sharing the profile means that all your member accounts will use the same Amazon Q Developer profile and corresponding settings. The Amazon Q Developer profile in the management account will override any Amazon Q Developer profiles that might be configured in member accounts, ensuring consistency across accounts. - -Use profile sharing with **Deployment option 2** described in [Step 1: Choose a deployment option](./deployment-options.html). - - * **End user benefits** : Sharing the profile allows IAM Identity Center workforce users who are subscribed to Amazon Q Developer Pro in a _management_ account to use their Amazon Q Developer Pro subscription on [AWS apps and websites](./q-on-aws.html) while signed in to a _member_ account. When profile sharing is disabled, these users can still use Amazon Q [in the AWS Management Console, and on AWS apps and websites](./q-on-aws.html), but they'll be subject to Free tier limits and features. - - +If you are a management account administrator within an organization managed by [AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html), you can enable the _profile sharing_ feature. When profile sharing is enabled, the [Amazon Q Developer profile](./subscribe-understanding-profile.html) that has been installed in a management account will be shared with member accounts. Sharing the profile has one benefit: it allows IAM Identity Center workforce users who are subscribed to Amazon Q Developer Pro in a _management_ account to use their Amazon Q Developer Pro subscription [in the AWS Management Console, and on AWS apps and websites](./q-on-aws.html) while signed in to a _member_ account. When profile sharing is disabled, these users can still use Amazon Q in the AWS Management Console, and on AWS apps and websites, while signed in to a member account, but they'll be subject to Free tier limits and features. @@ -20,0 +13 @@ Use profile sharing with **Deployment option 2** described in [Step 1: Choose a +Enabling profile sharing has no effect on users' ability to use [Amazon Q in the integrated development environment (IDE)](./q-in-IDE.html) or [on the command line](./command-line.html). @@ -30 +23 @@ Before you begin, make sure that: - * You have an _organization instance_ of IAM Identity Center set up in your management account and connected to Amazon Q. To check, sign in to your management account, go to the Amazon Q console, choose **Settings** , and make sure the following message appears at the top: **Amazon Q connected to an organization instance of IAM Identity Center**. + * You have an IAM Identity Center instance set up in your management account and connected to Amazon Q. To check, sign in to your management account, go to the Amazon Q Developer console, choose **Settings** , and make sure that a **Start URL** appears. @@ -32 +25 @@ Before you begin, make sure that: - * Your organization instance of IAM Identity Center contains users who are subscribed to Amazon Q Developer Pro in member accounts. + * You have subscribed users to Amazon Q Developer Pro in your management account. @@ -52,0 +46,2 @@ Before you begin, make sure that: +Users who are subscribed to Amazon Q Developer Pro in your management account will now be able to use their Amazon Q Developer Pro subscription in the AWS Management Console, and on AWS apps and websites while signed in to a member account. +