AWS sagemaker-unified-studio documentation change
Summary
Documentation restructured to focus solely on disabling Amazon Q, removing sections about enabling Amazon Q Developer Pro and troubleshooting. The disable procedure now includes specific steps with updated policy references and mentions using AWS Systems Manager for configuration updates.
Security assessment
The changes are primarily structural and procedural, focusing on how to disable Amazon Q functionality. While disabling features can be part of security hardening, there's no evidence in the diff that this change addresses a specific security vulnerability, weakness, or incident. The changes appear to be routine documentation updates to streamline content and update procedures.
Diff
diff --git a/sagemaker-unified-studio/latest/adminguide/amazonq.md b/sagemaker-unified-studio/latest/adminguide/amazonq.md index ac6988fa7..5ab737a64 100644 --- a//sagemaker-unified-studio/latest/adminguide/amazonq.md +++ b//sagemaker-unified-studio/latest/adminguide/amazonq.md @@ -5 +5 @@ -Enable Amazon Q Developer ProDisable Amazon Q Developer ProTroubleshooting Amazon Q in Amazon SageMaker Unified Studio +Disable Amazon Q @@ -11 +11 @@ In the current release of Amazon SageMaker Unified Studio, by default, all users -Amazon Q Developer is an AI coding assistant that can chat about code, provide inline code completions, and generate net new code. For more information, see [What is Amazon Q Developer?](https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/what-is.html) in the Amazon Q Developer User Guide. +## Disable Amazon Q @@ -13 +13 @@ Amazon Q Developer is an AI coding assistant that can chat about code, provide i -###### Topics +To disable Amazon Q in your domain, you must update your permissions to use deny statements and update your domain level configuration. Do this by completing the following steps: @@ -15,51 +15 @@ Amazon Q Developer is an AI coding assistant that can chat about code, provide i - * Enable Amazon Q Developer Pro - - * Disable Amazon Q Developer Pro - - * Troubleshooting Amazon Q in Amazon SageMaker Unified Studio - - - - -## Enable Amazon Q Developer Pro - -To enable Amazon Q Developer Pro in Amazon SageMaker Unified Studio, you must do the following: - - * [Configure SSO user access to Amazon SageMaker Unified Studio for the users of your Amazon SageMaker unified domain](./user-management.html). - - * Subscribe to Amazon Q Developer Pro in the Amazon Q console in the same AWS Region and the same AWS account that you use for Amazon SageMaker Unified Studio. To do this, complete the following procedure: - - 1. Navigate to the [Amazon Q console](https://console.aws.amazon.com/amazonq). - - 2. Confirm that Amazon Q is connected to an instance of IAM Identity Center. This should be displayed on the Getting started page in the Connect to Identity Center section. If it is not connected, follow the steps in the Set up IAM Identity Center section in this guide. - - 3. On the **Subscriptions** page, choose **Subscribe**. - - 4. If you have not yet subscribed a user to Q, a popup window appears informing you that Amazon Q will create a managed application instance on your behalf. Choose **Create and subscribe to Q Developer Pro**. - - 5. A popup window appears inviting you to assign users and groups to Q for developer. Choose **Get started**. - - 6. In the search bar, type the first name of a user or the group name of a group you want to add to Q for developer. Then select the name of that user or group when it appears on the screen. - - 7. Repeat step 6 for all the users and groups that you want to have access to Q in Amazon SageMaker Unified Studio. - - 8. Choose **Assign**. - - * Enable Amazon Q Developer Pro in the Amazon SageMaker management console. To do this, complete the following procedure. - - 1. Navigate to the Amazon SageMaker management console at [https://console.aws.amazon.com/datazone](https://console.aws.amazon.com/datazone) and use the region selector in the top navigation bar to choose the appropriate AWS Region. - - 2. Choose a domain where you want to enable Amazon Q Developer Pro and then on the domain's details page, choose the **Amazon Q** tab. - - 3. In the **Amazon Q** tab, expand the **Actions** drop-down and choose **Edit**. - - 4. On the **Edit Amazon Q subscription** page, choose **Q Developer Pro** and then choose **Update**. - - - - -## Disable Amazon Q Developer Pro - -In order to disable Amazon Q in your domain, you must update your permissions to use deny statements and update your domain level configuration. Do this by completing the following steps: - - * Update your permissions in the [AWS policy: SageMakerStudioDomainExecutionRolePolicy](./security-iam-awsmanpol-SageMakerStudioDomainExecutionRolePolicy.html) to Deny “q:*”. + 1. Update your permissions in the [AWS policy: SageMakerStudioDomainExecutionRolePolicy](./security-iam-awsmanpol-SageMakerStudioDomainExecutionRolePolicy.html) to Deny “q:*”. @@ -89 +39 @@ JSON - * Update your permissions in the [AWS policy: SageMakerStudioProjectUserRolePolicy](./security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.html) to Deny “q:*”. + 2. Update your permissions in the [AWS policy: SageMakerStudioProjectUserRolePolicy](./security-iam-awsmanpol-SageMakerStudioProjectUserRolePolicy.html) to Deny “q:*”. @@ -109 +59 @@ JSON - * Update the Q setting in the domain level configuration. + 3. Update the Amazon Q parameter value through AWS Systems Manager. @@ -118,17 +67,0 @@ JSON -## Troubleshooting Amazon Q in Amazon SageMaker Unified Studio - -This section lists potential issues you may encounter when configuring Amazon Q for use. Follow the suggested steps to resolve the issues. - - * **Amazon Q Q &A chat failing** - -The Q&A chat may fail if you log-in using IAM Identity Center with an Amazon Q subscription in a standalone account. This is because Q&A chat only supports subscriptions in Organization accounts (management or member accounts). Only the free tier for Q&A is offered in standalone accounts. In cases where the Amazon Q profile is in a different account than the domain (e.g., Q in management, domain in member), you may need to provide the Q profile ARN explicitly. We recommend the following actions: - - * It is recommended to keep the Q profile in the same account as the domain. - - * If using a management account for the Q profile in an organizational setup, be prepared to provide the Q profile ARN. - - * Allow up to 10 minutes for Q services to fully initialize after creating a Q profile. - - - -