AWS solutions medium security documentation change
Summary
Added requirement to register Alexa Skill IDs via CloudFormation parameter for Alexa integration. New deployments default to Alexa off; existing users must provide Skill IDs during update.
Security assessment
Introduces explicit authorization control for Alexa skills by requiring Skill ID registration. This prevents unauthorized skills from accessing the chatbot, addressing potential unauthorized access vulnerabilities. The change explicitly states it's for maintaining functionality after update, indicating a security enhancement.
Diff
diff --git a/solutions/latest/qnabot-on-aws/step-4-interact-with-the-chatbot.md b/solutions/latest/qnabot-on-aws/step-4-interact-with-the-chatbot.md index cc7acf7b6..479fc907b 100644 --- a//solutions/latest/qnabot-on-aws/step-4-interact-with-the-chatbot.md +++ b//solutions/latest/qnabot-on-aws/step-4-interact-with-the-chatbot.md @@ -39,0 +40,4 @@ To integrate with Amazon Alexa, you must first use the Amazon Developer Console +Starting in v7.4.0, Alexa integration requires you to register your Alexa Skill IDs using the `AlexaSkillIds` AWS CloudFormation stack parameter. New deployments have Alexa integration turned off by default. To turn it on, provide your Alexa Skill IDs when launching or updating the stack. **If you currently use Alexa, you must provide your Alexa Skill IDs during stack update to maintain Alexa functionality.** + +To find your Alexa Skill ID, sign in to the Amazon Developer Console, open your skill, and copy the Skill ID (format: `amzn1.ask.skill.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx`). You can register up to 30 skill IDs as a comma-separated list with no spaces (for example, `amzn1.ask.skill.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx,amzn1.ask.skill.yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy`). +