AWS amazonq documentation change
Summary
Updated prerequisites and S3 bucket requirements for prompt logging, removed JSON policy example, and clarified support limitations for AWS Organizations member accounts.
Security assessment
Changes clarify account support and S3 bucket configuration but do not address a specific security vulnerability. Removal of JSON policy example may impact clarity but lacks evidence of security implications.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/q-admin-prompt-logging.md b/amazonq/latest/qdeveloper-ug/q-admin-prompt-logging.md index 8fb0b9d82..b75ac5ffa 100644 --- a//amazonq/latest/qdeveloper-ug/q-admin-prompt-logging.md +++ b//amazonq/latest/qdeveloper-ug/q-admin-prompt-logging.md @@ -32 +32 @@ Use the following instructions to enable prompt logging. -**Prerequisite** +**Prerequisites** @@ -34 +34,3 @@ Use the following instructions to enable prompt logging. -Create an Amazon S3 bucket to hold the prompt logs. The bucket must: + * Make sure users are subscribed in a standalone account or, if you're using [AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html), a management account. Currently, Q Developer does not support logging the prompts of users who are subscribed in member accounts in AWS Organizations. + + * Create an Amazon S3 bucket to hold the prompt logs. The bucket must: @@ -38 +40 @@ Create an Amazon S3 bucket to hold the prompt logs. The bucket must: - * Be in the AWS account where users are subscribed. If users are subscribed in multiple AWS accounts, then you must create a bucket in each account. Cross-account buckets are not supported. + * Be in the AWS account where users are subscribed. @@ -42,34 +43,0 @@ Create an Amazon S3 bucket to hold the prompt logs. The bucket must: -JSON - - -**** - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "QDeveloperLogsWrite", - "Effect": "Allow", - "Principal": { - "Service": "q.amazonaws.com" - }, - "Action": [ - "s3:PutObject" - ], - "Resource": [ - "arn:aws:s3:::bucketName/prefix/*" - ], - "Condition": { - "StringEquals": { - "aws:SourceAccount": "accountId" - }, - "ArnLike": { - "aws:SourceArn": "arn:aws:codewhisperer:us-east-1:accountId:*" - } - } - } - ] - } - - @@ -108 +76 @@ To use the Amazon Q Developer console, you must have the permissions defined in -You must sign in as a standalone account administrator, or management account administrator. Member account administrators cannot enable prompt logging. +You must sign in as a standalone account administrator, or management account administrator. Member account administrators cannot enable prompt logging because prompt logging is not supported for users subscribed in member accounts.