AWS amazonq high security documentation change
Summary
Updated permissions requirements to mandate application-level permissions for new connector and removed several legacy permission requirements
Security assessment
The change requiring application-level permissions instead of delegated permissions improves security by enforcing least-privilege access. The removal of excessive permissions (e.g., ChatMessage.Read.All, Files.Read.All) reduces potential attack surface area and follows security best practices.
Diff
diff --git a/amazonq/latest/qbusiness-ug/teams-prereqs.md b/amazonq/latest/qbusiness-ug/teams-prereqs.md index 2f712e637..eb012f3d2 100644 --- a//amazonq/latest/qbusiness-ug/teams-prereqs.md +++ b//amazonq/latest/qbusiness-ug/teams-prereqs.md @@ -17 +17 @@ Before you begin, make sure that you have completed the following prerequisites. - * Added the necessary permissions. You can choose to add all permissions, or you can limit the scope by selecting fewer permissions based on which entities you want to crawl. The following table shows permissions by corresponding entity. + * Added the necessary permissions. You can choose to add all permissions, or you can limit the scope by selecting fewer permissions based on which entities you want to crawl. _(Application level permissions required for new connector)_ All permissions must be at _application_ level, not delegated. The following table shows permissions by corresponding entity. @@ -27,11 +26,0 @@ Channel Post | -Channel Attachment | - * ChannelMessage.Read.All - * Group.Read.All - * User.Read - * User.Read.All -| TeamMember.Read.All -Channel Wiki | - * Group.Read.All - * User.Read - * User.Read.All -| TeamMember.Read.All @@ -46,25 +34,0 @@ Chat Message | -Meeting Chat | - * Chat.Read.All - * ChatMessage.Read - * ChatMember.Read.All - * User.Read - * User.Read.All - * Group.Read.All -| TeamMember.Read.All -Chat Attachment | - * Chat.Read.All - * ChatMessage.Read - * ChatMember.Read.All - * User.Read - * User.Read.All - * Group.Read.All -| TeamMember.Read.All -Meeting File | - * Chat.Read.All - * ChatMessage.Read.All - * ChatMember.Read.All - * User.Read - * User.Read.All - * Group.Read.All - * Files.Read.All -| TeamMember.Read.All @@ -87 +51 @@ Meeting Notes | - * Generated Microsoft Teams OAuth 2.0 credentials containing a client id, client secret, username, and password. You need these credentials to authenticate Amazon Q to access Microsoft Teams. + * Generated Microsoft Teams OAuth 2.0 credentials containing a client ID, client secret, username, and password. You need these credentials to authenticate Amazon Q to access Microsoft Teams. @@ -119 +83 @@ Overview -Using the console +Using the latest connector (Console)