AWS amazonq documentation change
Summary
Added detailed documentation for creating new QuickSight accounts and linking existing ones, including IAM role configuration steps and API integration instructions
Security assessment
The changes document proper security practices for role assignment (QuickSight Admin Pro role via IAM Identity Center groups) and service role configuration for authorization between services. However, there's no indication these changes address a specific security vulnerability or incident.
Diff
diff --git a/amazonq/latest/qbusiness-ug/quicksight-plugin-configuring-application.md b/amazonq/latest/qbusiness-ug/quicksight-plugin-configuring-application.md index 148067a2a..91805029e 100644 --- a//amazonq/latest/qbusiness-ug/quicksight-plugin-configuring-application.md +++ b//amazonq/latest/qbusiness-ug/quicksight-plugin-configuring-application.md @@ -4,0 +5,2 @@ +Creating a new QuickSight accountLinking an existing QuickSight account + @@ -29 +31,62 @@ After you configure your application, you create QuickSight datasets, and create - * [Creating a new Amazon Quick Suite account in the Amazon Q Business console](./quicksight-plugin-creating-new-qs-account.html) + * Creating a new Amazon Quick Suite account in the Amazon Q Business console + + * Linking an existing QuickSight account + + + + +## Creating a new Amazon Quick Suite account in the Amazon Q Business console + +If you don't have an existing QuickSight account, you can use the Amazon Q Business console to create one and link the two accounts. Then you configure your QuickSight resources to start getting insights. + +###### To link a new QuickSight account + + 1. Log in to the Amazon Q Business console. + + 2. In **Applications** , choose the name of your application from the list of applications. + + 3. In the navigation pane, choose **Amazon Quick Suite**. + + 4. Choose **Create QuickSight Account**. + + 5. Give your new account a name, and specify the email address to use for account notifications. + + 6. Optionally, specify an email for product updates. + + 7. In **Assign QuickSight Admin Pro role** , choose the IAM Identity Center groups to assign the QuickSight Admin Pro role, and choose **Next**. + + 8. In **Service access** , create a new service role or use an existing one. This role authorizes Amazon Q Business to communicate with Amazon Quick Suite. For more information, see [Service access role](./quicksight-plugin.html#quicksight-plugin-service-access-role). + + 9. Choose **Authorize**. + + 10. Choose **Go to QuickSight** to go to your QuickSight account. There you create datasets, create and share QuickSight topics, and optionally create, publish, and share dashboards. After you configure these resources, end users start getting insights with QuickSight answers. + + + + +## Linking an existing QuickSight account + +If you have an existing QuickSight account that uses AWS IAM Identity Center for authentication, you can authorize Amazon Q Business to communicate with Amazon Quick Suite in the console or with the Amazon Q Business API. Then end users can start getting insights from new and existing Quick Suite topics and dashboards. + +If you have an existing QuickSight account that uses AWS IAM Identity Center for authentication, you can start getting insights after you authorize Amazon Q Business to communicate with Amazon Quick Suite. To authorize Amazon Q Business, you use the Amazon Q Business console to assign IAM Identity Center groups the Admin Pro role. Then you specify a service role that grants Amazon Q Business access. + +###### To link an existing QuickSight account + + 1. Log in to the Amazon Q Business console. + + 2. Choose your application. + + 3. In the navigation pane, choose **Amazon Quick Suite**. + + 4. Choose **Authorize QuickSight answers**. + + 5. In **Assign QuickSight Admin Pro role** , choose the IAM Identity Center groups to assign the Admin Pro role. The QuickSight Admin Pro role includes additional costs. For more information, see Amazon Quick Suite pricing. + + 6. In **Service access** , create a new service role or use an existing one. This role authorizes Amazon Q Business to communicate with Amazon Quick Suite. For more information, see [Service access role](./quicksight-plugin.html#quicksight-plugin-service-access-role). + + 7. Choose **Authorize**. After you authorize the connection, end users start getting insights from existing QuickSight resources. + + 8. To get insights from additional structured data resources, choose **Go to QuickSight** to go to your QuickSight account. There you can create additional datasets, topics, and dashboards. + + + @@ -31 +94 @@ After you configure your application, you create QuickSight datasets, and create - * [Linking an existing QuickSight account](./quicksight-plugin-linking-existing-account.html) +To authorize Amazon Q Business with the API, you first use IAM Identity Center to assign groups the Admin Pro role. Also, if your QuickSight account was created before November 25, 2024 and uses IdC authentication, use the [UpdateApplicationWithTokenExchangeGrant](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateApplicationWithTokenExchangeGrant.html) API to update your subscription to allow integration with Amazon Q Business Then you use the [CreatePlugin](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_CreatePlugin.html) API operation to create a QuickSight plugin for an Amazon Q Business application. @@ -32,0 +96 @@ After you configure your application, you create QuickSight datasets, and create +The following code shows how to create a QuickSight plugin. For `idcApplicationArn`, specify the Amazon Resource Name (ARN) of your application in IAM Identity Center. For `roleArn`, specify an AWS Identity and Access Management (IAM) role that authorizes Amazon Q Business to communicate with Amazon Quick Suite. For more information about this role, see [Service access role](./quicksight-plugin.html#quicksight-plugin-service-access-role). @@ -34,0 +99,5 @@ After you configure your application, you create QuickSight datasets, and create + aws qbusiness create-plugin \ + --application-id application-id \ + --display-name display-name \ + --type QUICKSIGHT \ + --auth-configuration idcAuthConfiguration="{idcApplicationArn=arn:aws:sso::<account-id>:application/<application-id>,roleArn=arn:aws:iam::<account-id>:role/AmazonQServiceRole}" @@ -44 +113 @@ QuickSight plugin -Creating a new QuickSight account +Getting data insights from Amazon Quick Suite answers