AWS amazonq medium security documentation change
Summary
Changed terminology from 'install' to 'create' for profile setup, added note about user/group name matching in assignments, and updated managed application name format
Security assessment
The added note clarifies that user/group assignments only match names (not emails), which prevents potential misconfigurations in access control. This addresses a security-relevant configuration detail by ensuring administrators understand how identity matching works.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/subscribe-standalone.md b/amazonq/latest/qdeveloper-ug/subscribe-standalone.md index b72ded0f7..a1c7d3a70 100644 --- a//amazonq/latest/qdeveloper-ug/subscribe-standalone.md +++ b//amazonq/latest/qdeveloper-ug/subscribe-standalone.md @@ -5 +5 @@ -PrerequisitesStep 1: Install the Amazon Q Developer Pro profile and subscribe yourself Step 2: Subscribe team membersWhat resources were created? +PrerequisitesStep 1: Create the Amazon Q Developer Pro profile and subscribe yourself Step 2: Subscribe team membersWhat resources were created? @@ -32 +32 @@ The instructions on this page assume you have not already installed an IAM Ident -## Step 1: Install the Amazon Q Developer Pro profile and subscribe yourself +## Step 1: Create the Amazon Q Developer Pro profile and subscribe yourself @@ -38 +38 @@ The instructions on this page assume you have not already installed an IAM Ident - 3. Make sure you're in the AWS Region where you want to install the [Amazon Q Developer profile](./subscribe-understanding-profile.html) and where you want to store user data. For supported Regions, see [Supported Regions for the Q Developer console and Q Developer profile](./q-admin-setup-subscribe-regions.html#qdev-console-and-profile-regions). + 3. Make sure you're in the AWS Region where you want to create the [Amazon Q Developer profile](./subscribe-understanding-profile.html) and where you want to store user data. For supported Regions, see [Supported Regions for the Q Developer console and Q Developer profile](./q-admin-setup-subscribe-regions.html#qdev-console-and-profile-regions). @@ -58 +58 @@ Choose **Create application**. -The Amazon Q Developer profile and managed application are installed, and your subscription is created. +The Amazon Q Developer profile and managed application are created, and your subscription is created. @@ -107,0 +108,4 @@ The **Assign users and groups** dialog box appears. +###### Note + +The dialog box only matches on user names or group names. It does not match on email addresses. + @@ -135 +139 @@ You can't convert or merge an account instance of IAM Identity Center into an or - * **A managed application** called **QDefaultProfile** , in the IAM Identity Center that is set up in your standalone account. The application is associated with the Amazon Q Developer profile. Like the Amazon Q Developer profile, the application is created once and shared between all Amazon Q subscribers in your standalone account. + * **A managed application** called **QDevProfile-`region`**, in the IAM Identity Center that is set up in your standalone account. The application is associated with the Amazon Q Developer profile. Like the Amazon Q Developer profile, the application is created once and shared between all Amazon Q subscribers in your standalone account.