AWS amazonq documentation change

Service: amazonq · 2025-09-19 · Documentation low

File: amazonq/latest/qbusiness-ug/troubleshooting-data-sources.md

Summary

Added troubleshooting section for missing CloudWatch logs with connector setup requirements and CLI examples.

Security assessment

While logging is important for operational visibility, this change addresses diagnostic capabilities rather than directly addressing security vulnerabilities or introducing security features. No evidence of a specific security issue being resolved.

Diff

diff --git a/amazonq/latest/qbusiness-ug/troubleshooting-data-sources.md b/amazonq/latest/qbusiness-ug/troubleshooting-data-sources.md
index a3dbc1c53..1baf15155 100644
--- a//amazonq/latest/qbusiness-ug/troubleshooting-data-sources.md
+++ b//amazonq/latest/qbusiness-ug/troubleshooting-data-sources.md
@@ -5 +5 @@
-My documents were not indexedMy synchronization job failedMy synchronization job is incompleteMy synchronization job succeeded but there are no indexed documentsI am running into file format issues while syncing my data sourceI am getting an AccessDenied When Using SSL Certificate File error message
+My documents were not indexedMy synchronization job failedMy synchronization job is incompleteMy synchronization job succeeded but there are no indexed documentsI am running into file format issues while syncing my data sourceI am getting an AccessDenied When Using SSL Certificate File error messageNo CloudWatch Logs for Application Using New Connector
@@ -24,0 +25,2 @@ This section can help you fix issues with Amazon Q Business data source connecto
+  * No CloudWatch Logs for Application Using New Connector
+
@@ -121,0 +124,57 @@ If you're getting an access denied error when using an SSL certificate with your
+## No CloudWatch Logs for Application Using New Connector
+
+I'm not seeing any CloudWatch logs for an application using a new connector.
+
+To get the logs to display, you must call four operations before creating the connector:
+
+  1. `CreateLogGroup`: Create a log group with the name `/aws/qbusiness/${applicationId}` to be consistent with the sync run report link in the sync run history table.
+
+  2. `PutDeliverySource`: Create a delivery source with log-type set to `SYNC_JOB_LOGS`.
+
+  3. `PutDeliveryDestination`: Create a delivery destination using the log group ARN from step 1.
+
+  4. `CreateDelivery`: Create the delivery configuration linking the source and destination.
+
+
+
+
+**CLI Example**
+
+Replace `YOUR_APPLICATION_ID` with your actual application ID:
+
+**Step 1: Create the log group**
+    
+    
+    aws logs create-log-group \
+        --log-group-name "/aws/qbusiness/YOUR_APPLICATION_ID"
+
+**Step 2: Create delivery source**
+    
+    
+    aws logs put-delivery-source \
+        --name "qbusiness-sync-logs-source" \
+        --log-type "SYNC_JOB_LOGS"
+        --resource-arn "arn:aws:qbusiness:REGION:012345678910:application/${APP_ID}"
+
+**Step 3: Create delivery destination**
+    
+    
+    aws logs put-delivery-destination \
+        --name "qbusiness-sync-logs-destination" \
+        --delivery-destination-configuration '{"destinationResourceArn":"arn:aws:logs:REGION:ACCOUNT_ID:log-group:/aws/qbusiness/01a2c3d4-a1b2-a1b2-a1b2-01a2c3b4d5}' 
+        --region "region-name"
+
+**Step 4: Create delivery**
+    
+    
+    aws logs create-delivery \
+        --delivery-source-name "qbusiness-sync-logs-source" \
+        "arn:aws:logs:region-name:012345678910:delivery-destination:qbusiness-sync-logs-destination" 
+        --region "region-name"
+
+**Note:** Update `REGION` and `ACCOUNT_ID` with your AWS region and account ID.
+
+**Verification**
+
+After completing these steps, create your connector, and run the sync job. The CloudWatch logs should now appear in the specified log group.
+