AWS amazonq medium security documentation change
Summary
Updated documentation to clarify differences in ACL crawling behavior between latest and legacy Gmail connectors, added notes about attachment crawling limitations in latest connector version, and restructured permission inheritance details
Security assessment
The changes explicitly detail how ACL (Access Control List) crawling works across connector versions, which directly impacts document security permissions. The clarification that the latest connector doesn't support attachment crawling (and thus attachments won't inherit permissions) has security implications for access control. The documentation now warns users that legacy connector must be used for attachment indexing with proper permission inheritance, which is a security-related configuration decision.
Diff
diff --git a/amazonq/latest/qbusiness-ug/gmail-user-management.md b/amazonq/latest/qbusiness-ug/gmail-user-management.md index 92326a568..44f50c93c 100644 --- a//amazonq/latest/qbusiness-ug/gmail-user-management.md +++ b//amazonq/latest/qbusiness-ug/gmail-user-management.md @@ -11 +11 @@ Amazon Q Business supports crawling ACLs for document security by default. -When you connect an Gmail data source to Amazon Q Business, Amazon Q Business crawls ACL information attached to a document (user and group information) from your Gmail instance. If you choose to activate ACL crawling, the information can be used to filter chat responses to your end user's document access level. +When you connect an Gmail data source to Amazon Q Business, Amazon Q Business crawls ACL information attached to a document (user and group information) from your Gmail instance. ACL crawling behavior differs between the two Gmail connector versions. @@ -13 +13 @@ When you connect an Gmail data source to Amazon Q Business, Amazon Q Business cr -The Gmail connector for Amazon Q Business crawls 2 primary content types: messages (email along with metadata such as subject, from, or to) and attachments. Each email messsage (in sent and inbox) and its respective attachments is considered as a separate documents with distinct document IDs. Currently, the connector cannot associate an attachment with its parent message, even though attachments inherit permissions from parent messages. +###### Note @@ -15 +15,16 @@ The Gmail connector for Amazon Q Business crawls 2 primary content types: messag -**Permission Inheritance** : ACLs for messages are set based on user email addresses. Attachments automatically inherit permissions from parent email message. +**ACL behavior by connector version:** + + * **Latest connector:** ACL and identity crawling is automatically enabled and cannot be disabled. Only applies to email messages and draft emails - attachments are not supported. + + * **Legacy connector:** ACL and identity crawling can be manually configured during setup. Applies to both messages and attachments when attachment crawling is enabled. + + + + +The legacy Gmail connector for Amazon Q Business crawls 2 primary content types: messages (email along with metadata such as subject, from, or to) and attachments. Each email message (in sent and inbox) and its respective attachments is considered as a separate document with distinct document IDs. Currently, the connector cannot associate an attachment with its parent message, even though attachments inherit permissions from parent messages. + +###### Note + +**Latest connector limitations:** The latest Gmail connector does not support attachment crawling. The latest Gmail connector does not support attachment crawling. If your organization requires attachment indexing, use the legacy connector instead. + +**Permission Inheritance** : ACLs for messages are set based on user email addresses. **Legacy connector only:** Attachments automatically inherit permissions from parent email messages when attachment crawling is enabled. @@ -19 +34 @@ The Gmail connector for Amazon Q Business crawls 2 primary content types: messag -**Change Management** : ACL changes are supported in both Full Crawl and Incremental or Change Log modes +**Change Management** : ACL changes are supported in both Full Crawl and Incremental or Change Log modes. @@ -40 +55 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Using the API +Using the original connector (API)