AWS chatbot documentation change
Summary
Updated terminology from 'chat channels' to 'chat applications' throughout the document and modified JSON policy example structure
Security assessment
Changes primarily involve rebranding/terminology updates (channels→applications) and example formatting. No evidence of addressing vulnerabilities or security incidents. The policy example modification removes a specific resource ARN but maintains equivalent security documentation about IAM resource-based permissions.
Diff
diff --git a/chatbot/latest/adminguide/security_iam_service-with-iam-resource-based-policies.md b/chatbot/latest/adminguide/security_iam_service-with-iam-resource-based-policies.md index e7e86f83a..26fa5b17d 100644 --- a//chatbot/latest/adminguide/security_iam_service-with-iam-resource-based-policies.md +++ b//chatbot/latest/adminguide/security_iam_service-with-iam-resource-based-policies.md @@ -5 +5 @@ -Using the Amazon Q Developer in chat channels resource in a policyExample: Amazon Q Developer in chat applications resource-level permission +Using the Amazon Q Developer in chat applications resource in a policyExample: Amazon Q Developer in chat applications resource-level permission @@ -15 +15 @@ _Resource-level permissions_ define the AWS resources on which you allow assigne -Amazon Q Developer in chat channels doesn't support _resource-based policies_ , which are directly attached to AWS resources. For more information about the differences between policies and permissions, see [Identity-Based Policies and Resource-Based Policies ](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html)in the _IAM User Guide_. +Amazon Q Developer in chat applications doesn't support _resource-based policies_ , which are directly attached to AWS resources. For more information about the differences between policies and permissions, see [Identity-Based Policies and Resource-Based Policies ](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html)in the _IAM User Guide_. @@ -17 +17 @@ Amazon Q Developer in chat channels doesn't support _resource-based policies_ , -For more information about the differences between IAM policies and permissions, see [Identity-Based Policies and Resource-Based Policies ](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html)in the _IAM User Guide_. The following sections describe how resource-level permissions work with Amazon Q Developer in chat channels. +For more information about the differences between IAM policies and permissions, see [Identity-Based Policies and Resource-Based Policies ](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html)in the _IAM User Guide_. The following sections describe how resource-level permissions work with Amazon Q Developer in chat applications. @@ -21 +21 @@ For more information about the differences between IAM policies and permissions, - * Using the Amazon Q Developer in chat channels resource in a policy + * Using the Amazon Q Developer in chat applications resource in a policy @@ -28 +28 @@ For more information about the differences between IAM policies and permissions, -## Using the Amazon Q Developer in chat channels resource in a policy +## Using the Amazon Q Developer in chat applications resource in a policy @@ -30 +30 @@ For more information about the differences between IAM policies and permissions, -You can set up an IAM policy that defines _who_ (users, groups and roles) can perform actions on Amazon Q Developer in chat channels resources. The policy uses _resource-level permissions_ to determine _which_ Amazon Q Developer in chat channels resources that users of the IAM policy can work with. The policy also defines _how_ they can work with them (through Actions and Conditions). +You can set up an IAM policy that defines _who_ (users, groups and roles) can perform actions on Amazon Q Developer in chat applications resources. The policy uses _resource-level permissions_ to determine _which_ Amazon Q Developer in chat applications resources that users of the IAM policy can work with. The policy also defines _how_ they can work with them (through Actions and Conditions). @@ -32 +32 @@ You can set up an IAM policy that defines _who_ (users, groups and roles) can pe -When creating an IAM policy, you refer to the **chat-configuration** resource by its Amazon Resource Name (ARN). An Amazon Q Developer in chat channels resource ARN consists of three objects: +When creating an IAM policy, you refer to the **chat-configuration** resource by its Amazon Resource Name (ARN). An Amazon Q Developer in chat applications resource ARN consists of three objects: @@ -38 +38 @@ When creating an IAM policy, you refer to the **chat-configuration** resource by -Amazon Q Developer in chat channels assumes the IAM role in the customer's account and makes API calls to other AWS services to get necessary information. For example, for an Amazon CloudWatch alarm notification, Amazon Q Developer in chat channels requires the metric graphic image displayed with the CloudWatch alarm notification. For that, Amazon Q Developer in chat channels calls a CloudWatch API with the customer's credentials. +Amazon Q Developer in chat applications assumes the IAM role in the customer's account and makes API calls to other AWS services to get necessary information. For example, for an Amazon CloudWatch alarm notification, Amazon Q Developer in chat applications requires the metric graphic image displayed with the CloudWatch alarm notification. For that, Amazon Q Developer in chat applications calls a CloudWatch API with the customer's credentials. @@ -49 +49 @@ The `configuration-name` field is the name for the Slack channel or Amazon Chime -The Amazon Q Developer in chat channels resource ARN has the following format: +The Amazon Q Developer in chat applications resource ARN has the following format: @@ -71 +71 @@ When you create the permissions, ensure that any Actions apply to the correct co -You can use resource-based permissions to allow or deny access to one or more Amazon Q Developer in chat channels resources in an IAM policy, or to all Amazon Q Developer in chat channels resources. +You can use resource-based permissions to allow or deny access to one or more Amazon Q Developer in chat applications resources in an IAM policy, or to all Amazon Q Developer in chat applications resources. @@ -74,0 +75,6 @@ To add a resource-level permission to a policy, include the channel's ARN in a n +JSON + + +**** + + @@ -106 +111,0 @@ To add a resource-level permission to a policy, include the channel's ARN in a n - "Resource":"arn:aws:chatbot::123456789021:chat-configuration/slack-channel/devops_private_channel" @@ -109 +113,0 @@ To add a resource-level permission to a policy, include the channel's ARN in a n - }