AWS quick documentation change
Summary
Added service principal requirements for CMK access and maximum sync duration documentation
Security assessment
Adds critical security documentation about required KMS permissions ('qbusiness.amazonaws.com' and 'quicksight.amazonaws.com' principals) for encryption key access. Prevents misconfiguration that could expose data.
Diff
diff --git a/quick/latest/userguide/knowledge-base-integrations.md b/quick/latest/userguide/knowledge-base-integrations.md index 54e875288..5c7c0f3e9 100644 --- a//quick/latest/userguide/knowledge-base-integrations.md +++ b//quick/latest/userguide/knowledge-base-integrations.md @@ -75,0 +76,8 @@ While these configuration options are available across most integrations, specif +### Service principal for knowledge base operations + +If you use a customer-managed key (CMK) as your default CMK and Q data key (see [Encrypting your Amazon Quick data with AWS Key Management Service customer-managed keys](./customer-managed-keys.html)), Amazon Quick accesses your AWS KMS key using the `qbusiness.amazonaws.com` and `quicksight.amazonaws.com` service principals during knowledge base sync operations. + +###### Note + +Ensure that any policies governing access to your CMK permit both the `qbusiness.amazonaws.com` and `quicksight.amazonaws.com` service principals. + @@ -128,0 +137,6 @@ This safeguard protects against temporary network issues, permission changes, or +#### Maximum sync duration + +Each sync run has a maximum runtime of 14 days. If a sync run is still in progress after 14 days, Amazon Quick ends the run with a status of **FAILED** and the following error message: + +If your sync run reaches this limit, edit your knowledge base to narrow the sync scope. For example, apply include or exclude filters, restrict the file types or folders being crawled, or split the content across multiple knowledge bases. For web crawler data sources, consider using the Web Search feature instead when your goal is to chat with large public websites. +