AWS kendra high security documentation change
Summary
Updated Zendesk OAuth 2.0 authentication flow from implicit grant to authorization code grant, added detailed steps for token exchange, and emphasized secure storage of credentials
Security assessment
The change replaces the insecure implicit grant flow with the more secure authorization code grant flow, which prevents access token exposure in URL fragments. Added instructions for proper secret storage and a required secret naming convention improve security practices.
Diff
diff --git a/kendra/latest/dg/data-source-zendesk.md b/kendra/latest/dg/data-source-zendesk.md index 66a8d21fb..e820c23fd 100644 --- a//kendra/latest/dg/data-source-zendesk.md +++ b//kendra/latest/dg/data-source-zendesk.md @@ -63 +63 @@ Before you can use Amazon Kendra to index your Zendesk data source, make these c - * Set up 0Auth 2.0 Authentication : + * Set up OAuth 2.0 Authentication using the authorization code grant flow: @@ -69 +69 @@ Before you can use Amazon Kendra to index your Zendesk data source, make these c - 3. Configure the folllwing OAuth client details: Set Client Name and Description, Set Client Kind to "Confidential", Add appropriate Redirect URLs, Save and securely store the generated Client Secret. + 3. Configure the OAuth client details: Set Client Name and Description, Set Client Kind to "Confidential", Add appropriate Redirect URLs (e.g., https://localhost/callback for testing), Save and securely store the generated Client ID and Client Secret. @@ -73 +73 @@ Before you can use Amazon Kendra to index your Zendesk data source, make these c - 5. Generate an Access Token using the implicit grant flow: + 5. Generate an Access Token using the authorization code grant flow: @@ -75 +75 @@ Before you can use Amazon Kendra to index your Zendesk data source, make these c - * In a browser, navigate to: `https://{subdomain}.zendesk.com/oauth/authorizations/new?response_type=token&client_id=<your_client_id>&scope=read` + * In a browser, navigate to: `https://{subdomain}.zendesk.com/oauth/authorizations/new?response_type=code&client_id={your_client_id}&redirect_uri={your_redirect_uri}&scope=read` @@ -79 +79 @@ Before you can use Amazon Kendra to index your Zendesk data source, make these c - * After authorization, you'll be redirected to a URL containing the access token in the fragment (after the #). Extract this token. + * After authorization, Zendesk redirects to the redirect_uri with a code parameter (e.g., https://localhost/callback?code={authorization_code}). Copy the authorization code. @@ -81 +81,9 @@ Before you can use Amazon Kendra to index your Zendesk data source, make these c - 6. Store the generated access token securely. This is the "Implicit grant token" you'll use for Kendra integration. + * Exchange the authorization code for an access token by sending a POST request to Zendesk's token endpoint: + + curl -X POST https://{subdomain}.zendesk.com/oauth/tokens \ + -H "Content-Type: application/x-www-form-urlencoded" \ + -d "grant_type=authorization_code&code={authorization_code}&client_id={your_client_id}&client_secret={your_client_secret}&redirect_uri={your_redirect_uri}&scope=read" + + * Zendesk responds with a JSON object containing the access_token. Extract and securely store this access token. + + 6. Store the generated access token securely. This access token will be used for Kendra integration. @@ -160 +168 @@ You can choose to configure or edit your **User access control** settings under - "accessToken": "your_implicit_grant_access_token" + "accessToken": "your_access_token" @@ -162,0 +171,4 @@ You can choose to configure or edit your **User access control** settings under +###### Note + +For Kendra integration, the secret name should start with 'AmazonKendra-Zendesk-' followed by your chosen identifier (e.g., 'AmazonKendra-Zendesk-MyConnector'). +