AWS amazonq: Remove Amazon Q artifacts example policy with broad IAM permissions
Summary
Deletes the 'Allow users to use Q artifacts in Amazon Q (preview)' section, including an example policy that granted unrestricted IAM actions (iam:CreateRole, iam:CreatePolicy, iam:AttachRolePolicy, iam:PutRolePolicy) and CloudFormation resource actions on Resource '*'. The TOC entry for the section is also removed.
Security assessment
The removed content documented an example policy granting broad, unrestricted IAM role/policy creation permissions (Resource '*'). Removing it reduces exposure of a permissive example, but there is no evidence it addresses a specific vulnerability or incident; it appears to be a feature/preview removal.
Evidence
- "iam:CreateRole",
Diff
diff --git a/amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md b/amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md index 8faa9c784..61bdfbc65 100644 --- a//amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md +++ b//amazonq/latest/qdeveloper-ug/id-based-policy-examples-users.md @@ -7 +7 @@ -Allow users to access Amazon Q with an Amazon Q Developer Pro subscriptionAllow Amazon Q access to customer managed keysAllow users to chat with Amazon QAllow users to use Amazon Q CLI with AWS CloudShellAllow users to run transformations on the command lineAllow users to diagnose console errors with Amazon QAllow users to generate code from CLI commands with Amazon QAllow users to chat about resources with Amazon QAllow Amazon Q to perform actions on your behalf in chatAllow users to use Q artifacts in Amazon Q (preview)Allow Amazon Q to access cost data and provide cost optimization recommendationsDeny Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform actions on your behalf in specific regionsDeny Amazon Q permission to perform actions on your behalfAllow users to chat with plugins from one providerAllow users to chat with a specific pluginDeny access to Amazon QAllow users to view their permissions +Allow users to access Amazon Q with an Amazon Q Developer Pro subscriptionAllow Amazon Q access to customer managed keysAllow users to chat with Amazon QAllow users to use Amazon Q CLI with AWS CloudShellAllow users to run transformations on the command lineAllow users to diagnose console errors with Amazon QAllow users to generate code from CLI commands with Amazon QAllow users to chat about resources with Amazon QAllow Amazon Q to perform actions on your behalf in chatAllow Amazon Q to access cost data and provide cost optimization recommendationsDeny Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform specific actions on your behalfAllow Amazon Q permission to perform actions on your behalf in specific regionsDeny Amazon Q permission to perform actions on your behalfAllow users to chat with plugins from one providerAllow users to chat with a specific pluginDeny access to Amazon QAllow users to view their permissions @@ -317,53 +316,0 @@ JSON -## Allow users to use Q artifacts in Amazon Q (preview) - -The following example policy grants permission to use Amazon Q artifacts, which enables you to complete multi-service jobs in Amazon Q. This policy includes permissions for Amazon Q, IAM, and CloudFormation. - -In addition to these permissions, you must have access to the resources you ask about. Amazon Q will never access resources that your IAM identity doesn't have access to. - -###### Important - -This example policy includes IAM actions (`iam:CreateRole`, `iam:CreatePolicy`, `iam:AttachRolePolicy`, and `iam:PutRolePolicy`) with unrestricted resources. Some Amazon Q workflows include steps that create or configure IAM roles as part of connecting AWS services (for example, creating a role that grants an EC2 instance access to S3). These permissions are required for those steps to execute successfully. If your identity already has administrator access, these permissions are already granted. For non-administrator identities, only grant this policy to trusted users in your account. If you do not need workflows that create or modify IAM roles, you can remove the IAM actions from this policy — steps that require IAM permissions will display a permissions error. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "AllowAmazonQPassRequest", - "Effect": "Allow", - "Action": [ - "q:StartConversation", - "q:SendMessage", - "q:GetConversation", - "q:ListConversations", - "q:UpdateConversation", - "q:DeleteConversation", - "q:PassRequest" - ], - "Resource": "*" - }, - { - "Sid": "AllowQArtifactsAccess", - "Effect": "Allow", - "Action": [ - "q:GetArtifact", - "q:CreateArtifact", - "q:GetArtifactActionResult", - "q:PerformArtifactAction", - "iam:CreateRole", - "iam:CreatePolicy", - "iam:AttachRolePolicy", - "iam:PutRolePolicy", - "cloudformation:GetResource", - "cloudformation:ListResources", - "cloudformation:CancelResourceRequest", - "cloudformation:CreateResource", - "cloudformation:GetResourceRequestStatus", - "cloudformation:ListResourceRequests", - "cloudformation:UpdateResource" - ], - "Resource": "*" - } - ] - } -