AWS chatbot documentation change
Summary
Updated terminology from 'chat channels' to 'chat applications' throughout the document, including console references and service interactions. Added an example IAM policy illustrating region-specific access restrictions.
Security assessment
The changes primarily involve rebranding and terminology updates (e.g., 'chat channels' to 'chat applications') without introducing new security content. The added IAM policy example demonstrates region access configuration but does not address a specific vulnerability or introduce new security features. Existing security guidance (e.g., avoiding raw message delivery in SNS) remains unchanged except for terminology.
Diff
diff --git a/chatbot/latest/adminguide/chatbot-troubleshooting.md b/chatbot/latest/adminguide/chatbot-troubleshooting.md index e8315342f..06a0aad30 100644 --- a//chatbot/latest/adminguide/chatbot-troubleshooting.md +++ b//chatbot/latest/adminguide/chatbot-troubleshooting.md @@ -9 +9 @@ AWS Chatbot is now Amazon Q Developer. [Learn more](./service-rename.html) -# Troubleshooting Amazon Q Developer in chat channels +# Troubleshooting Amazon Q Developer in chat applications @@ -11 +11 @@ AWS Chatbot is now Amazon Q Developer. [Learn more](./service-rename.html) -Amazon Q Developer in chat channels operates with multiple AWS services, including Amazon CloudWatch, Amazon GuardDuty, and AWS CloudFormation. If you encounter issues when trying to receive notifications, see the following topic for troubleshooting help. +Amazon Q Developer in chat applications operates with multiple AWS services, including Amazon CloudWatch, Amazon GuardDuty, and AWS CloudFormation. If you encounter issues when trying to receive notifications, see the following topic for troubleshooting help. @@ -13 +13 @@ Amazon Q Developer in chat channels operates with multiple AWS services, includi -If you configured your AWS service to send notifications to the Amazon Simple Notification Service (Amazon SNS) topics mapped to Amazon Q Developer in chat channels, but the notifications aren't appearing in the chat rooms or channels, try the steps below. +If you configured your AWS service to send notifications to the Amazon Simple Notification Service (Amazon SNS) topics mapped to Amazon Q Developer in chat applications, but the notifications aren't appearing in the chat rooms or channels, try the steps below. @@ -19 +19 @@ If you configured your AWS service to send notifications to the Amazon Simple No -Test your connectivity and your Amazon Q Developer in chat channels configuration by using the **Send test message button** in the [Amazon Q Developer in chat channels console](https://console.aws.amazon.com/chatbot/). For more information, see [Test notifications from AWS services to Amazon Chime](./chime-setup.html#test-notifications), [Test notifications from AWS services to Microsoft Teams](./teams-setup.html#test-notifications-teams), or [Test notifications from AWS services to Slack](./slack-setup.html#test-notifications-slack). +Test your connectivity and your Amazon Q Developer in chat applications configuration by using the **Send test message button** in the [Amazon Q Developer in chat applications console](https://console.aws.amazon.com/chatbot/). For more information, see [Test notifications from AWS services to Amazon Chime](./chime-setup.html#test-notifications), [Test notifications from AWS services to Microsoft Teams](./teams-setup.html#test-notifications-teams), or [Test notifications from AWS services to Slack](./slack-setup.html#test-notifications-slack). @@ -23 +23 @@ Test your connectivity and your Amazon Q Developer in chat channels configuratio -Ensure that the Amazon Q Developer in chat channels app ("@Amazon Q") is added to the chat channel. If it hasn't, in Microsoft Teams or Slack, add the Amazon Q Developer in chat channels app by choosing **Add apps** from the channel's **Details** screen. +Ensure that the Amazon Q Developer in chat applications app ("@Amazon Q") is added to the chat channel. If it hasn't, in Microsoft Teams or Slack, add the Amazon Q Developer in chat applications app by choosing **Add apps** from the channel's **Details** screen. @@ -25 +25 @@ Ensure that the Amazon Q Developer in chat channels app ("@Amazon Q") is added t - * **The notification's originating service is not supported by Amazon Q Developer in chat channels.** + * **The notification's originating service is not supported by Amazon Q Developer in chat applications.** @@ -27 +27 @@ Ensure that the Amazon Q Developer in chat channels app ("@Amazon Q") is added t -For a list of supported services, see [Using Amazon Q Developer in chat channels with Other AWS Services](./related-services.html). +For a list of supported services, see [Using Amazon Q Developer in chat applications with Other AWS Services](./related-services.html). @@ -29 +29 @@ For a list of supported services, see [Using Amazon Q Developer in chat channels - * **The SNS topic doesn't have a subscription to Amazon Q Developer in chat channels.** + * **The SNS topic doesn't have a subscription to Amazon Q Developer in chat applications.** @@ -31 +31 @@ For a list of supported services, see [Using Amazon Q Developer in chat channels -In the Amazon SNS console, go to the **Topics** page, choose the **Subscriptions** tab, and then verify that the topic has a subscription. If the topic doesn't, open the Amazon Q Developer in chat channels console, open your authorized client, and then look at the **Configured channels** or **Configured webhooks** list. Add a new channel or webhook configuration, and then add the SNS topic. Without this configuration, event notifications can't reach the chat rooms. +In the Amazon SNS console, go to the **Topics** page, choose the **Subscriptions** tab, and then verify that the topic has a subscription. If the topic doesn't, open the Amazon Q Developer in chat applications console, open your authorized client, and then look at the **Configured channels** or **Configured webhooks** list. Add a new channel or webhook configuration, and then add the SNS topic. Without this configuration, event notifications can't reach the chat rooms. @@ -54 +54 @@ AWS managed service keys don’t allow you to modify access policies, so you wil - * **Your SNS topic subscription to the Amazon Q Developer in chat channels has the Enable raw message delivery setting enabled.** + * **Your SNS topic subscription to the Amazon Q Developer in chat applications has the Enable raw message delivery setting enabled.** @@ -56 +56 @@ AWS managed service keys don’t allow you to modify access policies, so you wil -Don't enable the **Enable raw message delivery** feature for any SNS topic subscriptions to Amazon Q Developer in chat channels. +Don't enable the **Enable raw message delivery** feature for any SNS topic subscriptions to Amazon Q Developer in chat applications. @@ -64 +64 @@ Events can be throttled for the following reasons: - * Amazon Q Developer in chat channels allows for 10 events per second. If more than 10 events per second are received, any event above 10 is throttled. + * Amazon Q Developer in chat applications allows for 10 events per second. If more than 10 events per second are received, any event above 10 is throttled. @@ -71 +71 @@ Even if Amazon Q Developer doesn't throttle the event while posting a message to -To unsubscribe a channel or chat room from all Amazon Q Developer in chat channels notifications, remove the respective configuration from the Amazon Q Developer in chat channels console. Otherwise, to identify certain service and notification-types to unsubscribe from, see I don't want to receive notifications from certain services anymore. +To unsubscribe a channel or chat room from all Amazon Q Developer in chat applications notifications, remove the respective configuration from the Amazon Q Developer in chat applications console. Otherwise, to identify certain service and notification-types to unsubscribe from, see I don't want to receive notifications from certain services anymore. @@ -73 +73 @@ To unsubscribe a channel or chat room from all Amazon Q Developer in chat channe -If you want to unsubscribe only some notifications from the channel or chatroom, you can remove specific SNS topics from the Amazon Q Developer in chat channels configuration. Alternatively, you can remove the specific SNS topics as the event and alarm notification targets from the respective service configurations. You should also check if you have Amazon EventBridge rules configured for the service event types and remove the specific SNS topics as the rule triggers targets. +If you want to unsubscribe only some notifications from the channel or chatroom, you can remove specific SNS topics from the Amazon Q Developer in chat applications configuration. Alternatively, you can remove the specific SNS topics as the event and alarm notification targets from the respective service configurations. You should also check if you have Amazon EventBridge rules configured for the service event types and remove the specific SNS topics as the rule triggers targets. @@ -79 +79 @@ If you want to unsubscribe only some notifications from the channel or chatroom, -In the Amazon Q Developer in chat channels console, create a new role. This role requires the Notifications permissions policy from the Amazon Q Developer in chat channels console when you configure a new webhook or Slack channel. You can also edit your IAM role to [add the CloudWatchRead permissions](./editing-iam-roles-for-chatbot.html) for Amazon Q Developer in chat channels. +In the Amazon Q Developer in chat applications console, create a new role. This role requires the Notifications permissions policy from the Amazon Q Developer in chat applications console when you configure a new webhook or Slack channel. You can also edit your IAM role to [add the CloudWatchRead permissions](./editing-iam-roles-for-chatbot.html) for Amazon Q Developer in chat applications. @@ -81 +81 @@ In the Amazon Q Developer in chat channels console, create a new role. This role - * **Amazon Q Developer in chat channels doesn't have access to all AWS Regions.** + * **Amazon Q Developer in chat applications doesn't have access to all AWS Regions.** @@ -83 +83 @@ In the Amazon Q Developer in chat channels console, create a new role. This role -Amazon Q Developer in chat channels may execute API calls from any nearby AWS Region. If any Region is disabled, you may experience problems with CloudWatch metrics graphs, among other issues. For more information, see I get AccessDenied or permissions errors. +Amazon Q Developer in chat applications may execute API calls from any nearby AWS Region. If any Region is disabled, you may experience problems with CloudWatch metrics graphs, among other issues. For more information, see I get AccessDenied or permissions errors. @@ -90 +90 @@ If the AWS Billing and Cost Management console displays an error message for the -Do this if you have already configured an SNS topic that has a subscription to Amazon Q Developer in chat channels or you've configured a new SNS topic. It is not needed if you want to use an Amazon SNS topic that is already configured and working with AWS Billing and Cost Management. [You can then set up that topic with a subscription to Amazon Q Developer in chat channels](./subscribe-sns-topic.html). +Do this if you have already configured an SNS topic that has a subscription to Amazon Q Developer in chat applications or you've configured a new SNS topic. It is not needed if you want to use an Amazon SNS topic that is already configured and working with AWS Billing and Cost Management. [You can then set up that topic with a subscription to Amazon Q Developer in chat applications](./subscribe-sns-topic.html). @@ -100 +100 @@ Make sure you have the correct policies set up by following the instructions fou - * **Amazon Q Developer in chat channels doesn't have access to all AWS Regions.** + * **Amazon Q Developer in chat applications doesn't have access to all AWS Regions.** @@ -102 +102 @@ Make sure you have the correct policies set up by following the instructions fou -Amazon Q Developer in chat channels is a global service and may execute API calls from any nearby AWS Region. If any Region is disabled, you may experience errors. Make sure the IAM role you set up for Amazon Q Developer in chat channels to assume has access to all Regions. +Amazon Q Developer in chat applications is a global service and may execute API calls from any nearby AWS Region. If any Region is disabled, you may experience errors. Make sure the IAM role you set up for Amazon Q Developer in chat applications to assume has access to all Regions. @@ -104 +104 @@ Amazon Q Developer in chat channels is a global service and may execute API call -[Other policy types](./security-iam.html#security-iam-other-policies) can limit how IAM roles can be assumed. If you have set up your Amazon Q Developer in chat channels IAM role to have global access but you're still getting errors, one of these policy types may be the culprit: +[Other policy types](./security-iam.html#security-iam-other-policies) can limit how IAM roles can be assumed. If you have set up your Amazon Q Developer in chat applications IAM role to have global access but you're still getting errors, one of these policy types may be the culprit: @@ -106 +106 @@ Amazon Q Developer in chat channels is a global service and may execute API call - * **AWS Organizations service control policies (SCPs)** \- SCPs are JSON policies that specify the maximum permissions for an organization or organizational unit (OU) in AWS Organizations. A service control policy could be overriding the policies you put in place for Amazon Q Developer in chat channels. See [How SCPs Work](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_about-scps.html) in the _AWS Organizations User Guide_. + * **AWS Organizations service control policies (SCPs)** \- SCPs are JSON policies that specify the maximum permissions for an organization or organizational unit (OU) in AWS Organizations. A service control policy could be overriding the policies you put in place for Amazon Q Developer in chat applications. See [How SCPs Work](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_about-scps.html) in the _AWS Organizations User Guide_. @@ -115 +115,8 @@ With IAM, you can use AWS Security Token Service (AWS STS) to create and provide -If there is a policy in place that prevents access to services in certain Regions, you must change the policy to allow global Amazon Q Developer in chat channels access. +If there is a policy in place that prevents access to services in certain Regions, you must change the policy to allow global Amazon Q Developer in chat applications access. + +For example, the policy below allows Amazon Q Developer in chat applications in **us-east-2** but denies other services by using a [NotAction](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html) element. + +JSON + + +**** @@ -117 +123,0 @@ If there is a policy in place that prevents access to services in certain Region -For example, the policy below allows Amazon Q Developer in chat channels in **us-east-2** but denies other services by using a [NotAction](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_notaction.html) element. @@ -145 +152 @@ For example, the policy below allows Amazon Q Developer in chat channels in **us - * **The notification's originating service is not supported by Amazon Q Developer in chat channels.** + * **The notification's originating service is not supported by Amazon Q Developer in chat applications.** @@ -151 +158 @@ For a list of supported services, see [Monitoring AWS services](./related-servic -Amazon Q Developer in chat channels only supports default service events. If you need to modify a service event or send custom notifications, send the message using the custom notifications event schema. For more information, see [Custom notifications using Amazon Q Developer in chat applications](./custom-notifs.html). +Amazon Q Developer in chat applications only supports default service events. If you need to modify a service event or send custom notifications, send the message using the custom notifications event schema. For more information, see [Custom notifications using Amazon Q Developer in chat applications](./custom-notifs.html). @@ -158 +165 @@ Amazon Q Developer in chat channels only supports default service events. If you - * **The Amazon Q Developer in chat channels app is not added to the Slack workspace.** + * **The Amazon Q Developer in chat applications app is not added to the Slack workspace.** @@ -160 +167 @@ Amazon Q Developer in chat channels only supports default service events. If you -Add the Amazon Q Developer in chat channels app to the Slack workspace. For more information, see the [Getting started guide for Amazon Q Developer in chat channels](./getting-started.html). +Add the Amazon Q Developer in chat applications app to the Slack workspace. For more information, see the [Getting started guide for Amazon Q Developer in chat applications](./getting-started.html). @@ -169 +176 @@ Add the Amazon Q Developer in chat channels app to the Slack workspace. For more -There may be a new scope added to the Amazon Q Developer in chat channels Slack application that requires approval by an administrator. If Amazon Q Developer in chat channels has released a new scope, administrators need to re-approve the Amazon Q Developer in chat channels Slack application. Note that the approval is only required for Slack workspaces with an app approval policy. +There may be a new scope added to the Amazon Q Developer in chat applications Slack application that requires approval by an administrator. If Amazon Q Developer in chat applications has released a new scope, administrators need to re-approve the Amazon Q Developer in chat applications Slack application. Note that the approval is only required for Slack workspaces with an app approval policy. @@ -171 +178 @@ There may be a new scope added to the Amazon Q Developer in chat channels Slack -Workspace administrators can check their workspace settings to review and approve new scopes for Amazon Q Developer in chat channels. For more information about how to approve an app, see [Approve or restrict an app at the org level](https://slack.com/help/articles/360000281563-Manage-apps-on-Enterprise-Grid#approve-or-restrict-an-app) in the Slack Help Center. +Workspace administrators can check their workspace settings to review and approve new scopes for Amazon Q Developer in chat applications. For more information about how to approve an app, see [Approve or restrict an app at the org level](https://slack.com/help/articles/360000281563-Manage-apps-on-Enterprise-Grid#approve-or-restrict-an-app) in the Slack Help Center. @@ -173 +180 @@ Workspace administrators can check their workspace settings to review and approv - * **Installation of the Amazon Q Developer in chat channels Slack app is restricted for your workspace.** + * **Installation of the Amazon Q Developer in chat applications Slack app is restricted for your workspace.** @@ -175 +182 @@ Workspace administrators can check their workspace settings to review and approv -This error may appear if the workspace administrator has explicitly restricted the installation of the Amazon Q Developer in chat channels Slack app. +This error may appear if the workspace administrator has explicitly restricted the installation of the Amazon Q Developer in chat applications Slack app. @@ -180 +187 @@ This error may appear if the workspace administrator has explicitly restricted t -Microsoft Teams doesn't currently support Amazon Q Developer in chat channels in private channels. For more information, see [Private channel limitations](https://learn.microsoft.com/en-us/microsoftteams/private-channels#private-channel-limitations). +Microsoft Teams doesn't currently support Amazon Q Developer in chat applications in private channels. For more information, see [Private channel limitations](https://learn.microsoft.com/en-us/microsoftteams/private-channels#private-channel-limitations). @@ -184 +191 @@ Microsoft Teams doesn't currently support Amazon Q Developer in chat channels in -You can provide feedback about Amazon Q Developer in chat channels directly from your Amazon Chime chat room, chat channels, or from the Amazon Q Developer in chat channels console. To leave feedback from your Amazon Chime chat room or chat channel, type the following command and replace `comments` with your own information. +You can provide feedback about Amazon Q Developer in chat applications directly from your Amazon Chime chat room, chat channels, or from the Amazon Q Developer in chat applications console. To leave feedback from your Amazon Chime chat room or chat channel, type the following command and replace `comments` with your own information. @@ -189 +196 @@ You can provide feedback about Amazon Q Developer in chat channels directly from -To leave feedback from the Amazon Q Developer in chat channels console, navigate to the [Amazon Q Developer in chat channels console](https://console.aws.amazon.com/chatbot/) and choose the **Feedback** link at the bottom of the console. All feedback is sent directly to and reviewed by the Amazon Q Developer in chat channels team. +To leave feedback from the Amazon Q Developer in chat applications console, navigate to the [Amazon Q Developer in chat applications console](https://console.aws.amazon.com/chatbot/) and choose the **Feedback** link at the bottom of the console. All feedback is sent directly to and reviewed by the Amazon Q Developer in chat applications team.