AWS amazonq documentation change
Summary
Added detailed prerequisites, integration steps, and activation/deployment procedures for the Amazon Q browser extension. Expanded documentation on configuring IdP allow-listing, MDM policy settings, and user installation guidance.
Security assessment
The changes include security-related configuration steps such as enabling LLM query controls, updating IAM roles, and configuring IdP allow-listing for browser extension URLs. While these are security best practices, there's no evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/amazonq/latest/qbusiness-ug/configuring-browser-extension.md b/amazonq/latest/qbusiness-ug/configuring-browser-extension.md index 9a95aeab3..81fa9558a 100644 --- a//amazonq/latest/qbusiness-ug/configuring-browser-extension.md +++ b//amazonq/latest/qbusiness-ug/configuring-browser-extension.md @@ -4,0 +5,2 @@ +Prerequisites IntegratingActivating and deploying + @@ -24 +26,81 @@ After installation and authentication, your users can access Amazon Q while brow - * [Prerequisites for integrating the Amazon Q browser extension ](./browser-extensions-prerequisites.html) + * Prerequisites for integrating the Amazon Q browser extension + + * Integrating the browser extension with Amazon Q Business + + * Activating and deploying the browser extension + + + + +## Prerequisites for integrating the Amazon Q browser extension + +As admins, before you can integrate the Amazon Q Business browser extension, you must complete the following steps. + + 1. [Get started with Amazon Q Business](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/getting-started.html) + + 2. [Create an IAM Identity Center-integrated application](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/create-application.html) or [Create an IAM federated application environment](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/create-application-iam.html) and create your Amazon Q Business web experience. + + 3. To use this feature, do the following + + * Enable **Allow end users to send queries directly to the LLM** in your Admin controls and guardrails. For more information, see the [Response settings](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/guardrails-global-controls.html#guardrails-global-response) topic in [Admin controls and guardrails](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/guardrails.html) and [`chatMode`](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_ChatSync.html#qbusiness-ChatSync-request-chatMode) if you are configuring programmatically. + + * If you are using the IAM Identity Center or OpenID Connect (OIDC) provider in IAM, make sure your IAM role for an Amazon Q Business web experience using IAM Federation is up to date. For more information, see [IAM role for an Amazon Q Business web experience using IAM Federation](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/web-experience-iam-role-iam.html). + + + + +## Integrating the browser extension with Amazon Q Business + +To use the Amazon Q Business browser extension, you must allow it to connect to your Amazon Q Business application environment and web experience. To do this, admins can use the Amazon Q console, API, SDK, or AWS CLI. + +###### Topics + + * Using the console + + * Using the AWS API + + + + +### Using the console + + 1. Sign in to the Amazon Q console. + + 2. Choose **Applications** , then select the name of your application environment from the list. + + 3. Choose **Integrations** under **Enhancements**. + + 4. Choose **Edit** in the **Browser extensions** section on the main page. + + 5. Choose the **Browser extensions** your want integrate with. + + + + +### Using the AWS API + +Admin users can enable your browser extensions using the [`UpdateWebExperience`](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_UpdateWebExperience.html) and [`CreateWebExperience`](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_CreateWebExperience.html) operations. + +## Activating and deploying the browser extension + +After enabling the browser extension, complete these steps to activate and deploy it: + + 1. Allow-list URLs. If you are using + + 1. An OIDC provider like Okta: you must configure your identity provider (IdP) to support browser extension as follows. You will need to consult your provider on how to do this. + + 1. Make sure you enable refresh grants + + 2. Allow-list the following URLs with the IdP + + 1. Mozilla based browsers — `https://ba6e8e6e4fa44c1057cf5f26fba9b2e788dfc34f.extensions.allizom.org` + + 2. Chromium based browsers — `https://feihpdljijcgnokhfoibicengfiellbp.chromiumapp.org` + + 2. IAM Identity Center, the above is not required and you can move to the next step of installing the browser extension for your users. + + 2. Install the browser extension for all users using the software deployment processes of your organization. The following is some information about policy settings from the browser vendors using mobile device management (MDM) software that may be helpful: + + 1. Firefox policy settings: [https://mozilla.github.io/policy-templates/#extensionsettings](https://mozilla.github.io/policy-templates/#extensionsettings) + + 2. Chrome policy settings: [https://chromeenterprise.google/policies/#ExtensionSettings](https://chromeenterprise.google/policies/#ExtensionSettings) @@ -26 +108 @@ After installation and authentication, your users can access Amazon Q while brow - * [Integrating the browser extension with Amazon Q Business](./integrating-browser-extension.html) + 3. Edge policy settings: [https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#extensionsettings](https://learn.microsoft.com/en-us/DeployEdge/microsoft-edge-policies#extensionsettings) and guide: [https://learn.microsoft.com/en-us/deployedge/microsoft-edge-manage-extensions-ref-guide](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-manage-extensions-ref-guide) @@ -28 +110 @@ After installation and authentication, your users can access Amazon Q while brow - * [Activating and deploying the browser extension](./activating-deploying-extension.html) + 3. Provide your selected users the browser store URL + Web experience URL so they can download and install the browser extension and connect to Amazon Q. @@ -41 +123 @@ Browser extensions -Prerequisites +Disabling, removing and blocking