AWS amazonq documentation change
Summary
Removed a detailed IAM policy example for Amazon Q Business web experience permissions
Security assessment
The change removes an example IAM policy but does not explicitly reference a security vulnerability or incident. This appears to be a documentation simplification rather than a direct security fix. However, removing granular permissions examples could impact users' ability to configure least-privilege access if not replaced elsewhere.
Diff
diff --git a/amazonq/latest/qbusiness-ug/web-experience-iam-role-idc.md b/amazonq/latest/qbusiness-ug/web-experience-iam-role-idc.md index 97ab0c4cb..ce867a6bf 100644 --- a//amazonq/latest/qbusiness-ug/web-experience-iam-role-idc.md +++ b//amazonq/latest/qbusiness-ug/web-experience-iam-role-idc.md @@ -36,173 +35,0 @@ To allow an Amazon Q Business web experience to invoke the API operations requir -JSON - - -**** - - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "QBusinessConversationPermissions", - "Effect": "Allow", - "Action": [ - "qbusiness:Chat", - "qbusiness:ChatSync", - "qbusiness:ListMessages", - "qbusiness:ListConversations", - "qbusiness:PutFeedback", - "qbusiness:DeleteConversation", - "qbusiness:GetWebExperience", - "qbusiness:GetApplication", - "qbusiness:ListPlugins", - "qbusiness:ListPluginActions", - "qbusiness:GetChatControlsConfiguration", - "qbusiness:ListRetrievers", - "qbusiness:ListAttachments", - "qbusiness:DeleteAttachment", - "qbusiness:GetMedia" - ], - "Resource": "arn:aws:qbusiness:us-east-1:111122223333:application/application-id" - }, - { - "Sid": "QBusinessPluginDiscoveryPermissions", - "Effect": "Allow", - "Action": [ - "qbusiness:ListPluginTypeMetadata", - "qbusiness:ListPluginTypeActions" - ], - "Resource": "*" - }, - { - "Sid": "QBusinessRetrieverPermission", - "Effect": "Allow", - "Action": [ - "qbusiness:GetRetriever" - ], - "Resource": [ - "arn:aws:qbusiness:us-east-1:111122223333:application/application-id", - "arn:aws:qbusiness:us-east-1:111122223333:application/application-id/retriever/*" - ] - }, - { - "Sid": "QAppsResourceAgnosticPermissions", - "Effect": "Allow", - "Action": [ - "qapps:CreateQApp", - "qapps:PredictQApp", - "qapps:PredictProblemStatementFromConversation", - "qapps:PredictQAppFromProblemStatement", - "qapps:ListQApps", - "qapps:ListLibraryItems", - "qapps:CreateSubscriptionToken", - "qapps:ListCategories" - ], - "Resource": "arn:aws:qbusiness:us-east-1:111122223333:application/application-id" - }, - { - "Sid": "QAppsAppUniversalPermissions", - "Effect": "Allow", - "Action": [ - "qapps:DisassociateQAppFromUser" - ], - "Resource": "arn:aws:qapps:us-east-1:111122223333:application/application-id/qapp/*" - }, - { - "Sid": "QAppsAppOwnerPermissions", - "Effect": "Allow", - "Action": [ - "qapps:GetQApp", - "qapps:CopyQApp", - "qapps:UpdateQApp", - "qapps:DeleteQApp", - "qapps:ImportDocument", - "qapps:ImportDocumentToQApp", - "qapps:CreateLibraryItem", - "qapps:UpdateLibraryItem", - "qapps:StartQAppSession", - "qapps:DescribeQAppPermissions", - "qapps:UpdateQAppPermissions", - "qapps:CreatePresignedUrl" - ], - "Resource": "arn:aws:qapps:us-east-1:111122223333:application/application-id/qapp/*", - "Condition": { - "StringEqualsIgnoreCase": { - "qapps:UserIsAppOwner": "true" - } - } - }, - { - "Sid": "QAppsPublishedAppPermissions", - "Effect": "Allow", - "Action": [ - "qapps:GetQApp", - "qapps:CopyQApp", - "qapps:AssociateQAppWithUser", - "qapps:GetLibraryItem", - "qapps:CreateLibraryItemReview", - "qapps:AssociateLibraryItemReview", - "qapps:DisassociateLibraryItemReview", - "qapps:StartQAppSession", - "qapps:DescribeQAppPermissions" - ], - "Resource": "arn:aws:qapps:us-east-1:111122223333:application/application-id/qapp/*", - "Condition": { - "StringEqualsIgnoreCase": { - "qapps:AppIsPublished": "true" - } - } - }, - { - "Sid": "QAppsAppSessionModeratorPermissions", - "Effect": "Allow", - "Action": [ - "qapps:ImportDocument", - "qapps:ImportDocumentToQAppSession", - "qapps:GetQAppSession", - "qapps:GetQAppSessionMetadata", - "qapps:UpdateQAppSession", - "qapps:UpdateQAppSessionMetadata", - "qapps:StopQAppSession", - "qapps:ListQAppSessionData", - "qapps:ExportQAppSessionData", - "qapps:CreatePresignedUrl" - ], - "Resource": "arn:aws:qapps:us-east-1:111122223333:application/application-id/qapp/*/session/*", - "Condition": { - "StringEqualsIgnoreCase": { - "qapps:UserIsSessionModerator": "true" - } - } - }, - { - "Sid": "QAppsSharedAppSessionPermissions", - "Effect": "Allow", - "Action": [ - "qapps:ImportDocument", - "qapps:ImportDocumentToQAppSession", - "qapps:GetQAppSession", - "qapps:GetQAppSessionMetadata", - "qapps:UpdateQAppSession", - "qapps:ListQAppSessionData", - "qapps:CreatePresignedUrl" - ], - "Resource": "arn:aws:qapps:us-east-1:111122223333:application/application-id/qapp/*/session/*", - "Condition": { - "StringEqualsIgnoreCase": { - "qapps:SessionIsShared": "true" - } - } - }, - { - "Sid": "QBusinessToQuickSightGenerateEmbedUrlInvocation", - "Effect": "Allow", - "Action": [ - "quicksight:GenerateEmbedUrlForRegisteredUserWithIdentity" - ], - "Resource": "*" - } - ] - } - -