AWS chatbot medium security documentation change
Summary
Updated terminology from 'chat channels' to 'chat applications' and added a permissions documentation reference. Modified IAM configuration steps to include guardrail policies.
Security assessment
The change adds a specific guardrail policy (AWS-Chatbot-LambdaInvoke-Policy-e4aef1dc-0da7-4ac5-b506-d282beac41ae) during IAM role configuration, which enforces security controls for Lambda invocation permissions. This explicitly defines security boundaries and limits chatbot privileges.
Diff
diff --git a/chatbot/latest/adminguide/chatbot-run-lambda-function-remotely-tutorial.md b/chatbot/latest/adminguide/chatbot-run-lambda-function-remotely-tutorial.md index c3251566f..8e9691295 100644 --- a//chatbot/latest/adminguide/chatbot-run-lambda-function-remotely-tutorial.md +++ b//chatbot/latest/adminguide/chatbot-run-lambda-function-remotely-tutorial.md @@ -5 +5 @@ -Prerequisites Step 1: Create a Lambda functionStep 2: Create an SNS topicStep 3: Configure a CloudWatch alarm Step 4: Configure a Slack client for Amazon Q Developer in chat channelsStep 5: Invoke a Lambda function from SlackStep 6: Test the CloudWatch alarmStep 7: Clean up resources +Prerequisites Step 1: Create a Lambda functionStep 2: Create an SNS topicStep 3: Configure a CloudWatch alarm Step 4: Configure a Slack client for Amazon Q Developer in chat applicationsStep 5: Invoke a Lambda function from SlackStep 6: Test the CloudWatch alarmStep 7: Clean up resources @@ -9 +9 @@ AWS Chatbot is now Amazon Q Developer. [Learn more](./service-rename.html) -# Tutorial: Using Amazon Q Developer in chat channels to run an AWS Lambda function remotely +# Tutorial: Using Amazon Q Developer in chat applications to run an AWS Lambda function remotely @@ -11 +11 @@ AWS Chatbot is now Amazon Q Developer. [Learn more](./service-rename.html) -In this tutorial you use Amazon Q Developer in chat channels to run a Lambda function remotely and check the status of the Lambda function using Amazon CloudWatch. A Lambda function is a self contained block of organized resuable code that you write. Lambda functions are useful because they are run without provisioning or managing servers. Additionally, they are only invoked when needed based on your specifications. There are steps at the end of this tutorial to delete the resources you created. +In this tutorial you use Amazon Q Developer in chat applications to run a Lambda function remotely and check the status of the Lambda function using Amazon CloudWatch. A Lambda function is a self contained block of organized resuable code that you write. Lambda functions are useful because they are run without provisioning or managing servers. Additionally, they are only invoked when needed based on your specifications. There are steps at the end of this tutorial to delete the resources you created. @@ -23 +23 @@ In this tutorial you use Amazon Q Developer in chat channels to run a Lambda fun - * Step 4: Configure a Slack client for Amazon Q Developer in chat channels + * Step 4: Configure a Slack client for Amazon Q Developer in chat applications @@ -36 +36 @@ In this tutorial you use Amazon Q Developer in chat channels to run a Lambda fun -This tutorial assumes that you have some familiarity with the Lambda, Amazon Q Developer in chat channels, and CloudWatch consoles. +This tutorial assumes that you have some familiarity with the Lambda, Amazon Q Developer in chat applications, and CloudWatch consoles. @@ -42 +42,3 @@ For more information, see the following topics: - * [Setting up Amazon Q Developer in chat channels](https://docs.aws.amazon.com/chatbot/latest/adminguide/setting-up.html) in the _Amazon Q Developer in chat channels Administrator Guide._ + * [Setting up Amazon Q Developer in chat applications](https://docs.aws.amazon.com/chatbot/latest/adminguide/setting-up.html) in the _Amazon Q Developer in chat applications Administrator Guide._ + + * [Understanding Amazon Q Developer in chat applications permissions](https://docs.aws.amazon.com/chatbot/latest/adminguide/understanding-permissions.htm) in the _Amazon Q Developer in chat applications Administrator Guide._ @@ -91 +93 @@ In this procedure you create a Lambda function in the console and test it. -CloudWatch uses Amazon SNS to send notifications. First, you create an SNS topic and subscribe to it using your email. Later in the tutorial you use this SNS topic to configure Amazon Q Developer in chat channels. +CloudWatch uses Amazon SNS to send notifications. First, you create an SNS topic and subscribe to it using your email. Later in the tutorial you use this SNS topic to configure Amazon Q Developer in chat applications. @@ -161 +163 @@ A CloudWatch alarm monitors your Lambda function and sends a notification if an -## Step 4: Configure a Slack client for Amazon Q Developer in chat channels +## Step 4: Configure a Slack client for Amazon Q Developer in chat applications @@ -163 +165 @@ A CloudWatch alarm monitors your Lambda function and sends a notification if an -You can configure a Slack client using Amazon Q Developer in chat channels to to run different commands in Slack using the AWS CLI. In this tutorial you use AWS CLI to invoke your Lambda function from Slack. +You can configure a Slack client using Amazon Q Developer in chat applications to to run different commands in Slack using the AWS CLI. In this tutorial you use AWS CLI to invoke your Lambda function from Slack. @@ -167 +169 @@ You can configure a Slack client using Amazon Q Developer in chat channels to to - 1. Open the [Amazon Q Developer in chat channels console](https://console.aws.amazon.com/chatbot/). + 1. Open the [Amazon Q Developer in chat applications console](https://console.aws.amazon.com/chatbot/). @@ -173 +175 @@ You can configure a Slack client using Amazon Q Developer in chat channels to to -When you choose **Configure** , you are momentarily navigated away from the Amazon Q Developer in chat channels console. +When you choose **Configure** , you are momentarily navigated away from the Amazon Q Developer in chat applications console. @@ -175 +177 @@ When you choose **Configure** , you are momentarily navigated away from the Amaz - 3. In the upper right corner, choose the dropdown list, and then choose the Slack workspace that you want to use with Amazon Q Developer in chat channels. + 3. In the upper right corner, choose the dropdown list, and then choose the Slack workspace that you want to use with Amazon Q Developer in chat applications. @@ -179 +181 @@ When you choose **Configure** , you are momentarily navigated away from the Amaz -There's no limit to the number of workspaces that you can set up for Amazon Q Developer in chat channels, but you must set up each workspace one at a time. +There's no limit to the number of workspaces that you can set up for Amazon Q Developer in chat applications, but you must set up each workspace one at a time. @@ -201 +203,7 @@ There's no limit to the number of workspaces that you can set up for Amazon Q De - 7. Navigate back to the Amazon Q Developer in chat channels console and enter the private channel ID. + 7. Navigate back to the Amazon Q Developer in chat applications console and enter the private channel ID. + + 8. Define the **Permissions** that the chatbot uses for messaging your Slack chat room as shown following: + + 1. For **Role settings** , choose **Channel role**. + + 2. For **Channel role** , choose **Create an IAM role using a template**. @@ -203 +211 @@ There's no limit to the number of workspaces that you can set up for Amazon Q De - 8. Define the **IAM permissions** that the chatbot uses for messaging your Slack chat room as shown following: + 3. For **Role name** , enter `myHelloWorldRole`. @@ -205 +213 @@ There's no limit to the number of workspaces that you can set up for Amazon Q De - 1. For **Role name** , enter `myHelloWorldRole`. + 4. For **Policy Templates** , select **Read-only command permissions** and **Lambda-invoke command permissions.** @@ -207 +215 @@ There's no limit to the number of workspaces that you can set up for Amazon Q De - 2. For **Policy Templates** , select **Read-only command permissions** and **Lambda-invoke command permissions.** + 5. For **Channel guardrail policies** , select **AWS-Chatbot-LambdaInvoke-Policy-e4aef1dc-0da7-4ac5-b506-d282beac41ae**. @@ -220 +228 @@ There's no limit to the number of workspaces that you can set up for Amazon Q De -After you configure a chatbot in Amazon Q Developer in chat channels, you can invoke Lambda functions from Slack using AWS CLI syntax. To interact with Amazon Q Developer in chat channels in Slack, enter `@Amazon Q` followed by an AWS CLI command. For more information, see [Running AWS CLI commands from chat channels using Amazon Q Developer in chat channels](./chatbot-cli-commands.html) in the _Amazon Q Developer in chat channels Administrator Guide._ +After you configure a chatbot in Amazon Q Developer in chat applications, you can invoke Lambda functions from Slack using AWS CLI syntax. To interact with Amazon Q Developer in chat applications in Slack, enter `@Amazon Q` followed by an AWS CLI command. For more information, see [Running AWS CLI commands from chat channels using Amazon Q Developer in chat applications](./chatbot-cli-commands.html) in the _Amazon Q Developer in chat applications Administrator Guide._ @@ -224 +232 @@ After you configure a chatbot in Amazon Q Developer in chat channels, you can in - 1. Invite Amazon Q Developer in chat channels to your channel by doing the following in Slack: + 1. Invite Amazon Q Developer in chat applications to your channel by doing the following in Slack: @@ -232 +240 @@ After you configure a chatbot in Amazon Q Developer in chat channels, you can in -You only have to invite Amazon Q Developer in chat channels to the channel once. +You only have to invite Amazon Q Developer in chat applications to the channel once. @@ -234 +242 @@ You only have to invite Amazon Q Developer in chat channels to the channel once. -If AWS is not listed as a valid member of the channel, you need to add the Amazon Q Developer in chat channels app to the Slack workspace. For more information, see the [Getting started guide for Amazon Q Developer in chat channels](./getting-started.html). +If AWS is not listed as a valid member of the channel, you need to add the Amazon Q Developer in chat applications app to the Slack workspace. For more information, see the [Getting started guide for Amazon Q Developer in chat applications](./getting-started.html). @@ -242 +250 @@ If AWS is not listed as a valid member of the channel, you need to add the Amazo -Replace `<your region>` with the same AWS Region you set while using the Lambda, CloudWatch, and Amazon Q Developer in chat channels consoles. You only need to specify the AWS Region in the channel once when you type your first AWS CLI command in Slack. +Replace `<your region>` with the same AWS Region you set while using the Lambda, CloudWatch, and Amazon Q Developer in chat applications consoles. You only need to specify the AWS Region in the channel once when you type your first AWS CLI command in Slack. @@ -246 +254 @@ Replace `<your region>` with the same AWS Region you set while using the Lambda, -Amazon Q Developer in chat channels also supports certain simplified AWS CLI syntaxes. For example, the simplified version of the previous command is shown following: +Amazon Q Developer in chat applications also supports certain simplified AWS CLI syntaxes. For example, the simplified version of the previous command is shown following: @@ -263 +271 @@ Amazon Q Developer in chat channels also supports certain simplified AWS CLI syn -If you try to run your Lambda function in Slack and you encounter errors referring to the following permissions, revisit step 8 of the Step 4: Configure a Slack client for Amazon Q Developer in chat channels procedure and verify that you have the correct permissions assigned to your role: +If you try to run your Lambda function in Slack and you encounter errors referring to the following permissions, revisit step 8 of the Step 4: Configure a Slack client for Amazon Q Developer in chat applications procedure and verify that you have the correct permissions assigned to your role: @@ -333 +341 @@ You can remove any resources created for this tutorial that you don't want to ke -###### To delete the Amazon Q Developer in chat channels configuration +###### To delete the Amazon Q Developer in chat applications configuration @@ -335 +343 @@ You can remove any resources created for this tutorial that you don't want to ke - 1. Open the [Amazon Q Developer in chat channels console](https://console.aws.amazon.com/chatbot/). + 1. Open the [Amazon Q Developer in chat applications console](https://console.aws.amazon.com/chatbot/).