AWS amazonq high security documentation change
Summary
Removed documentation about requiring signed API requests using IAM access keys or AWS STS temporary security credentials
Security assessment
The removed content described fundamental security controls (request signing with IAM credentials or STS tokens) that enforce authentication and integrity of API requests. Removing this documentation could mislead users into thinking these security measures are no longer required, potentially leading to insecure implementations where requests are not properly authenticated.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/infrastructure-security.md b/amazonq/latest/qdeveloper-ug/infrastructure-security.md index b7305c901..86f961097 100644 --- a//amazonq/latest/qdeveloper-ug/infrastructure-security.md +++ b//amazonq/latest/qdeveloper-ug/infrastructure-security.md @@ -18,2 +17,0 @@ You use AWS published API calls to access Amazon Q Developer through the network -Additionally, requests must be signed by using an access key ID and a secret access key that is associated with an IAM principal. Or you can use the [AWS Security Token Service](https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html) (AWS STS) to generate temporary security credentials to sign requests. -