AWS amazonq medium security documentation change
Summary
Expanded corporate proxy configuration documentation to cover multiple IDEs (Eclipse, JetBrains, Visual Studio, VS Code) with detailed certificate handling instructions and troubleshooting guidance
Security assessment
The changes add explicit security documentation about SSL/TLS certificate management for corporate proxies, including warnings about unsupported SOCKS proxies, certificate format requirements (.pem), and environment variable configurations to handle corporate CA certificates. These changes help prevent man-in-the-middle attacks and connection failures in secure environments by ensuring proper certificate validation.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/firewall.md b/amazonq/latest/qdeveloper-ug/firewall.md index c4afceebd..0f9888d70 100644 --- a//amazonq/latest/qdeveloper-ug/firewall.md +++ b//amazonq/latest/qdeveloper-ug/firewall.md @@ -5 +5 @@ -General URLs to allowlistAmazon S3 bucket URLs and ARNs to allowlistConfiguring a corporate proxy in Amazon Q for Visual Studio Code +General URLs to allowlistAmazon S3 bucket URLs and ARNs to allowlistConfiguring a corporate proxy in Amazon Q @@ -98 +98 @@ Europe (Frankfurt): -## Configuring a corporate proxy in Amazon Q for Visual Studio Code +## Configuring a corporate proxy in Amazon Q @@ -100 +100 @@ Europe (Frankfurt): -To configure proxy support for Amazon Q when working behind a corporate proxy, complete the steps in the following sections. +If your end users are working behind a corporate proxy, have them complete the following steps to successfully connect to Amazon Q. @@ -102 +102 @@ To configure proxy support for Amazon Q when working behind a corporate proxy, c -### Step 1: Configuring proxy settings in VS Code +### Step 1: Configuring proxy settings in your IDE @@ -104 +104 @@ To configure proxy support for Amazon Q when working behind a corporate proxy, c -The following procedure describes how to configure your proxy settings in VS Code. +Specify your proxy server's URL in your IDE. @@ -106 +106 @@ The following procedure describes how to configure your proxy settings in VS Cod - 1. From VS Code, open VS Code **Settings** by pressing `CMD + ,` (Mac) or `Ctrl + ,` (Windows/Linux). +###### Note @@ -108 +108,27 @@ The following procedure describes how to configure your proxy settings in VS Cod - 2. From the **Settings** search bar, enter `Http: Proxy`, then locate it in the search results. +You must configure an HTTP or HTTPS proxy. SOCKS proxies are not supported. + +Eclipse + + + 1. In Eclipse, open **Preferences** as follows: + + * On Windows or Ubuntu: + + * From the Eclipse menu bar, choose **Window** , and then choose **Preferences**. + + * On macOS: + + * From the menu bar, choose **Eclipse** , and then choose **Settings** or **Preferences** depending on your macOS version. + + 2. In the search bar, enter `Amazon Q` and open Amazon Q. + + 3. Under **Proxy Settings** , set **HTTPS Proxy URL** to your corporate proxy URL. + +Examples: `http://proxy.company.com:8080`, `https://proxy.company.com:8443` + + 4. Leave the Amazon Q settings open and go to the next step. + + + + +JetBrains @@ -110 +135,0 @@ The following procedure describes how to configure your proxy settings in VS Cod - 3. Enter your corporate proxy URL. Your corporate proxy URL must be in the following format: @@ -112 +137 @@ The following procedure describes how to configure your proxy settings in VS Cod -`http`s`://`proxy-url`:`proxy-port`` +In JetBrains, manually configure your proxy server's host name and port following the guidance in the [HTTP Proxy](https://www.jetbrains.com/help/idea/settings-http-proxy.html) topic of the IntelliJ IDEA documentation. @@ -114 +139 @@ The following procedure describes how to configure your proxy settings in VS Cod -For example: +Visual Studio @@ -116 +141,22 @@ For example: -`http://proxy.company.com:8080` + + 1. From the Visual Studio main menu, choose **Tools** , then choose **Options**. + + 2. From the **Options** menu, expand **AWS Toolkit** , then choose **Proxy**. + + 3. From the **Proxy** menu, set **Host** and **Port** to your corporate proxy host and port. + +Examples: `http://proxy.company.com:8080`, `https://proxy.company.com:8443` + + + + +Visual Studio Code + + + 1. From VS Code, open VS Code **Settings** by pressing `CMD + ,` (Mac) or `Ctrl + ,` (Windows/Linux). + + 2. From the **Settings** search bar, enter `Http: Proxy`, then locate it in the search results. + + 3. Enter your corporate proxy URL. + +Examples: `http://proxy.company.com:8080`, `https://proxy.company.com:8443` @@ -127 +173 @@ For example: -Amazon Q automatically detects and uses your system's trusted certificates. If you're still experiencing certificate errors, manually specify a certificate bundle by completing the following procedure. +Amazon Q automatically detects and uses the trusted certificates installed on your system. If you are experiencing certificate errors, you must manually specify a certificate bundle by completing the following procedure. @@ -133 +179 @@ The following are situations where manual configuration is required. - * You're encountering certificate-related errors after configuring the proxy. + * You are encountering certificate-related errors after configuring the proxy. @@ -135 +181 @@ The following are situations where manual configuration is required. - * Your corporate proxy uses certificates that aren't in the system trust store. + * Your corporate proxy uses certificates that aren't in your system's trust store. @@ -141,0 +188,44 @@ The following are situations where manual configuration is required. +Eclipse + + + * In the Amazon Q settings in Eclipse, under **Proxy Settings** , set **CA Cert PEM** to the path of your corporate certificate file. The file must have a `.pem` file extension. (You cannot use a `.crt` file.) + +An example path resembles the following: + +`/path/to/corporate-ca-bundle.pem` + +For instructions on obtaining this file, see Getting your corporate certificate. + + + + +JetBrains + + +In JetBrains, manually install your corporate certificate following the guidance in the [Trusted root certificates](https://www.jetbrains.com/help/idea/ssl-certificates.html#manual_configuration) topic of the IntelliJ IDEA documentation. + +For instructions on obtaining the certificate, see Getting your corporate certificate. + +Visual Studio + + + * Configure the following Windows Environment Variables: + + * `NODE_OPTIONS = --use-openssl-ca` + + * `NODE_EXTRA_CA_CERTS = `cert-path`` + +Replace `cert-path` with the path of your corporate certificate file. The file must have a `.pem` file extension. (You cannot use a `.crt` file.) + +An example path resembles the following: + +`/path/to/corporate-ca-bundle.pem` + +For instructions on obtaining the corporate certificate file, see Getting your corporate certificate. For detailed information about the Windows Environment Variables, see the [Node.js documentation](https://nodejs.org/api/cli.html#cli_node_extra_ca_certs_file). + + + + +Visual Studio Code + + @@ -153,0 +244,24 @@ For instructions on obtaining this file, see Getting your corporate certificate. + + + +### Step 3: Restart your IDE + +You must restart your IDE in order to update Amazon Q with your changes. + +### Troubleshooting + +If you completed the procedures in the previous sections and you are still experiencing issues, use the following instructions to troubleshoot. + +Eclipse + + + 1. Make sure your proxy URL format includes `http://` or `https://`. + + 2. Make sure your certificate file path is correct and accessible. + + 3. Review your Amazon Q logs in the Eclipse Error Log. To navigate to the Error Log, do one of the following: + + * Sign in to Amazon Q in Eclipse, choose the down-arrow next to the Q icon at the top-right, and then choose **Help** , **View Logs**. + + * From the Eclipse menu, choose **Window** , **Show View** , **Error Log**. + @@ -156 +270 @@ For instructions on obtaining this file, see Getting your corporate certificate. -Specifying a certificate overrides the automatic certificate detection. +If you encounter the following error messages: @@ -157,0 +272 @@ Specifying a certificate overrides the automatic certificate detection. + * `unable to verify the first certificate`, make sure you followed the instructions in Step 2: Configuring SSL certificate handling to specify a certificate manually. @@ -158,0 +274,3 @@ Specifying a certificate overrides the automatic certificate detection. + * `self signed certificate`, make sure you followed the instructions in Step 2: Configuring SSL certificate handling to specify a certificate manually. + + * `ECONNREFUSED`, check your internet connection and proxy information. @@ -161 +278,0 @@ Specifying a certificate overrides the automatic certificate detection. -### Step 3: Restart VS Code @@ -163 +279,0 @@ Specifying a certificate overrides the automatic certificate detection. -You must restart VS Code in order to update Amazon Q with your changes. @@ -165 +281,53 @@ You must restart VS Code in order to update Amazon Q with your changes. -### Troubleshooting +JetBrains + + + 1. Make sure your proxy URL format includes `http://` or `https://`. + + 2. Make sure your certificate file path is correct and accessible. + + 3. Review your Amazon Q logs in the JetBrains log file. For help on finding the log file, see [Locating IDE log files](https://intellij-support.jetbrains.com/hc/en-us/articles/207241085-Locating-IDE-log-files) on the JetBrains IDEs Support page. + +###### Note + +If you encounter the following error messages: + + * `unable to verify the first certificate`, make sure you followed the instructions in Step 2: Configuring SSL certificate handling to specify a certificate manually. + + * `self signed certificate`, make sure you followed the instructions in Step 2: Configuring SSL certificate handling to specify a certificate manually. + + * `ECONNREFUSED`, check your internet connection and proxy information. + + + + +Visual Studio