AWS amazonq documentation change
Summary
Updated terminology from 'install' to 'create' for Amazon Q Developer profile setup. Added note about user/group name matching limitations. Changed managed application name pattern to include region reference.
Security assessment
The added note about dialog box matching user/group names (not emails) clarifies access control behavior, helping prevent misconfigurations. However, there's no evidence of addressing a specific vulnerability. The application name change appears operational rather than security-focused.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/subscribe-management.md b/amazonq/latest/qdeveloper-ug/subscribe-management.md index b645a42a3..dcef6fced 100644 --- a//amazonq/latest/qdeveloper-ug/subscribe-management.md +++ b//amazonq/latest/qdeveloper-ug/subscribe-management.md @@ -5 +5 @@ -PrerequisitesStep 1: Install the Amazon Q Developer profileStep 2: Subscribe usersStep 3: Enable identity-enhanced console sessions What resources were created? +PrerequisitesStep 1: Create the Amazon Q Developer profileStep 2: Subscribe usersStep 3: Enable identity-enhanced console sessions What resources were created? @@ -32 +32 @@ Before you begin, make sure that: -## Step 1: Install the Amazon Q Developer profile +## Step 1: Create the Amazon Q Developer profile @@ -38 +38 @@ Before you begin, make sure that: - 3. Make sure you're in the AWS Region where you want to install the [Amazon Q Developer profile](./subscribe-understanding-profile.html) and where you want to store user data. For supported Regions, see [Supported Regions for the Q Developer console and Q Developer profile](./q-admin-setup-subscribe-regions.html#qdev-console-and-profile-regions). + 3. Make sure you're in the AWS Region where you want to create the [Amazon Q Developer profile](./subscribe-understanding-profile.html) and where you want to store user data. For supported Regions, see [Supported Regions for the Q Developer console and Q Developer profile](./q-admin-setup-subscribe-regions.html#qdev-console-and-profile-regions). @@ -54 +54 @@ Choose **Create application**. -The Amazon Q Developer profile and managed application are installed. +The Amazon Q Developer profile and managed application are created. @@ -68,0 +69,4 @@ The **Assign users and groups** dialog box appears. +###### Note + +The dialog box only matches on user names or group names. It does not match on email addresses. + @@ -86 +90 @@ If you don't enable identity-enhanced console sessions, users can still use Amaz -When you installed the Amazon Q Developer profile and subscribed users in your management account, Amazon Q created the following resources on your behalf: +When you created the Amazon Q Developer profile and subscribed users in your management account, Amazon Q created the following resources on your behalf: @@ -92 +96 @@ When you installed the Amazon Q Developer profile and subscribed users in your m - * **A managed application** called **QDefaultProfile** , in the IAM Identity Center that is set up in your management account. The application is associated with the Amazon Q Developer profile. Like the Amazon Q Developer profile, the application is created once and shared between all Amazon Q subscribers in your management account. + * **A managed application** called **QDevProfile-`region`**, in the IAM Identity Center that is set up in your management account. The application is associated with the Amazon Q Developer profile. Like the Amazon Q Developer profile, the application is created once and shared between all Amazon Q subscribers in your management account. @@ -96 +100 @@ When you installed the Amazon Q Developer profile and subscribed users in your m -Amazon Q can create the **QDefaultProfile** managed application in a maximum of 10 AWS accounts per AWS Region within an organization. +Amazon Q can create the **QDevProfile-`region`** managed application in a maximum of 10 AWS accounts per AWS Region within an organization.