AWS quick documentation change
Summary
Updated Microsoft Word extension documentation from legacy to preview version, simplified deployment process, added security notes about AI execution in sandbox, and restructured content.
Security assessment
The change adds explicit security documentation about sandboxed AI execution risks and data usage policies, but doesn't reference any specific vulnerability or incident. The security additions are preventative best-practice disclosures rather than vulnerability fixes.
Diff
diff --git a/quick/latest/userguide/word-extension.md b/quick/latest/userguide/word-extension.md index dfeab0e4b..e80c82f3d 100644 --- a//quick/latest/userguide/word-extension.md +++ b//quick/latest/userguide/word-extension.md @@ -7 +7 @@ -Word prerequisitesConfigure Word extension +Word prerequisitesDeploy Word extensionWord permissions @@ -9 +9 @@ Word prerequisitesConfigure Word extension -# Amazon Quick Microsoft Word extension (Legacy) +# Amazon Quick Microsoft Word extension (Preview) @@ -13 +13 @@ Word prerequisitesConfigure Word extension -This is the legacy Microsoft Word extension. We recommend using the new [Amazon Quick Microsoft Word extension (Preview)](./word-extension-preview.html) for new deployments. +This extension is currently available as a preview. During the preview period, the extension is fully functional for end users and production workloads. Administrative features such as centralized deployment controls and usage monitoring are being developed and will be available when the extension becomes generally available. Functionality and features may change during the preview period. We recommend using this extension instead of the legacy Microsoft Word extension for new deployments. @@ -15 +15 @@ This is the legacy Microsoft Word extension. We recommend using the new [Amazon -The Quick extension for Microsoft Word integrates AI-powered assistance directly into your document creation and editing workflows. Users can access Quick capabilities within Word to enhance their document productivity and content quality without switching between applications. +The Quick extension for Microsoft Word integrates AI-powered assistance directly in your Word document. Users can leverage Quick within Word to draft content, make formatted edits, and perform reviews with track changes and comments enabled. @@ -19 +19 @@ The Word extension enables users to: - * Review, draft, and revise documents with AI assistance. + * Generate formatted documents using style guides and templates and Quick's enterprise data and apps. @@ -21 +21 @@ The Word extension enables users to: - * Summarize documents and get insights. + * Make small- or large-scale edits to your document while maintaining its writing style and structure. @@ -23 +23 @@ The Word extension enables users to: - * Simplify and improve writing quality. + * Format or restructure your documents. @@ -25 +25 @@ The Word extension enables users to: - * Use actions from action connectors configured in Amazon Quick. + * Redline your documents with track changes and/or comments enabled. @@ -27 +26,0 @@ The Word extension enables users to: - * Access any company knowledge sources added to your Amazon Quick instance from within Microsoft Word. @@ -30,0 +30 @@ The Word extension enables users to: +The Quick Word extension is available within Amazon Quick to all eligible users by default and requires no administrative setup for user access if users can access the Microsoft Word app store. Users can search for Amazon Quick in the Microsoft Word app store or visit the [Quick for Word Microsoft store page](https://marketplace.microsoft.com/en-us/product/WA200010615) to add the extension. @@ -34 +34 @@ The Word extension enables users to: - * The Amazon Quick customer integrating Microsoft Word must have a paid Word organization with an _M365 subscription for their organization_. + * The Amazon Quick Word extension uses generative AI to create and execute code within your Word application sandbox to help you perform tasks within Word. AI can make mistakes and perform inaccurate actions within your Word document. @@ -36 +36 @@ The Word extension enables users to: - * Amazon Quick does not use user data for service improvement or for training its underlying large language models (LLMs). + * Amazon Quick does not use your user data for service improvement or for training its underlying large language models (LLMs). @@ -41,49 +41 @@ The Word extension enables users to: -###### Topics - - * Prerequisites for Microsoft Word extension - - * Configure Microsoft Word extension access - - - - -## Prerequisites for Microsoft Word extension - -Before adding the Amazon Quick extension to Microsoft Word, administrators must complete the following steps: - - 1. Have a Microsoft 365 Business subscription and be a Global Admin or have administrative permissions (specifically `AppCatalog.ReadWrite.All`). - - 2. Have a Amazon Quick instance. - - 3. Your Microsoft 365 tenant ID. You can find this by going to the Azure portal > **Azure Active Directory** > **Properties** , or by using PowerShell. For detailed steps, see [How to find your tenant ID - Microsoft Entra](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant) in the Microsoft Learn portal. - - - - -If you configured the authentication to connect to Amazon Quick with IAM Identity Center, complete the following additional steps: - - 1. Ensure you have an IAM Identity Center instance enabled on your AWS account. - - 2. If you are connecting an external IAM provider to IAM Identity Center, ensure that every user under your IAM provider configuration has an email associated with them. - - 3. If you are using Entra ID, set up SCIM identity propagation between the Microsoft Entra ID instance and IAM Identity Center. For detailed steps, see [Configure SAML and SCIM with Microsoft Entra ID and IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/azure-ad-idp.html). - - - - -## Configure Microsoft Word extension access - -As an administrator, you must allow the Amazon Quick Microsoft Word Extension to connect to your Amazon Quick application environment and web experience. You can use the Amazon Quick console to manage extension access configurations. - -### User attribute mapping - -When you configure a Microsoft Word extension, user identity is mapped by default using the following attributes: - - * **Amazon Quick user attribute** \- Email address is used to map Amazon Quick users to their corresponding Microsoft 365 accounts. The system uses the email address to establish the connection between user identities. - - * **M365 Office add-in user attribute** \- User Principal Name (UPN) is used to match against Microsoft 365 user accounts. Users need to use the User Principal Name (UPN) to sign in to Microsoft 365. Email address that works on both cloud and on-premise systems. - - - - -These default mappings ensure secure and accurate user identification across both platforms without requiring additional configuration. +The following procedures are for IT administrators who want to automatically deploy the Amazon Quick Word extension across their organization on behalf of their users. @@ -93,32 +45 @@ These default mappings ensure secure and accurate user identification across bot - * Add Microsoft Word extension access for accounts using IAM Identity Center - - * Add Microsoft Word extension access for accounts using other authentication methods - - * Edit Microsoft Word extension access - - * Delete Microsoft Word extension access - - - - -### Add Microsoft Word extension access for accounts using IAM Identity Center - -Configuring extension access with IAM Identity Center requires completing steps specific to your identity provider (Entra ID or Okta) followed by common setup steps in AWS. - -#### Configure IAM Identity Center with Entra ID - -Follow these steps only if you are using IAM Identity Center with Entra ID to set up and configure an Azure tenant on your Microsoft Azure portal: - -###### To set up an Azure tenant - - 1. In the Azure account, create a new app registration. - - 1. Go to **App registrations**. - - 2. In the **App registrations** screen, choose **New registration**. Under the **Supported account types** option, choose **Accounts in this organizational directory only (Personal use only - Single tenant)**. Once finished, choose **Register**. - - 3. Note the client ID. You will need this later. - - 4. Create a client secret for the app registration and keep note of it. You will need this later. - - 2. Add callback URLs for each Region in which your Word extension will be installed. + * Prerequisites for deploying the Microsoft Word extension to your organization @@ -126 +47 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 1. Navigate to the app registration's **Authentication** tab. + * Deploying the Microsoft Word extension to your organization @@ -128 +49 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 2. Choose **Platform Configurations** , **Add a platform**. + * Microsoft Word extension permissions @@ -130 +50,0 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 3. Choose **Web**. @@ -132 +51,0 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 4. Compose a callback URL using the following format, replacing `your-region` with your Amazon Quick instance Region. The Word extension supports the following Regions: `ap-southeast-2`, `eu-west-1`, `us-west-2`, and `us-east-1`. @@ -134 +52,0 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - qbs-cell001.dp.appintegrations.your-region.prod.plato.ai.aws.dev/auth/idc-tti/callback @@ -136 +54 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se - 5. Insert the callback URL as the redirect URI and choose **Configure** when done. +## Prerequisites for deploying the Microsoft Word extension to your organization @@ -137,0 +56 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se +Before configuring access to the Amazon Quick extension to Microsoft Word, administrators must complete the following steps: @@ -138,0 +58 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se + 1. Have a Microsoft 365 Business subscription and be a Global Admin or have administrative permissions (specifically `AppCatalog.ReadWrite.All`). @@ -139,0 +60 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se + 2. Have an Amazon Quick instance. @@ -141,283 +61,0 @@ Follow these steps only if you are using IAM Identity Center with Entra ID to se -Follow these steps to configure a Trusted Token Issuer on your IAM Identity Center instance in your AWS Console: - -###### To configure a Trusted Token Issuer - - 1. Go to your AWS account and navigate to your IAM Identity Center instance. - - 2. Navigate to **Settings** , **Authentication**. - - 3. Choose **Create trusted token issuer**. - - 4. Add the issuer URL, which should follow this template, where `Tenant ID` refers to your Entra tenant ID: - - login.microsoftonline.com/Tenant ID/v2.0 - -###### Note - -The issuer URL should be the OIDC discovery endpoint of your identity without the well-known document URI path. If you include the well-known document URI path, this will not work. See Trusted token issuer configuration settings. - - 5. Choose **Email** as the Identity Provider attribute and IAM Identity Center attribute. - - 6. Note the trusted token issuer ARN. You will need this in a later step. - - - - -After completing these Entra ID-specific steps, proceed to the Complete AWS Configuration (all providers) section below. - -#### Configure IAM Identity Center with Okta - -Follow these steps only if you are using IAM Identity Center with Okta to set up and configure your App Integration in the Okta Admin console: - -###### To set up an Okta Application - - 1. In your Okta account, create a new Okta App Integration. - - 1. In your Okta Admin console, navigate to **Applications** > **Applications**. - - 2. Click on **Create App Integration**. - - 3. For the Sign-in method, select **OIDC - OpenID Connect**. - - 4. For the Application type, select **Web Application**. - - 5. Click on **Next**. - - 6. Provide an App integration name. - - 7. Under **Grant type** > **Core grants** , ensure **Authorization Code** and **Refresh Token** are selected. - - 8. Under **Grant type** > **Advanced** > **Other grants** , ensure **Implicit (hybrid)** is selected. - - 2. Add callback URIs for each Region in which your Word extension will be installed - - 1. Compose a callback URI using the following format, replacing `your-region` with your Amazon Quick instance Region for each region where you wish to configure the extension. The Word extension supports the following Regions: `ap-southeast-2`, `eu-west-1`, `us-west-2`, and `us-east-1`. -