AWS amazonq: Replace Amazon Q plugins page with pointer to AWS assistant guide
Summary
Removed the detailed plugins documentation (including notes that third-party API calls are not logged in CloudTrail, that only Secrets Manager secret access appears in CloudTrail, the warning that third-party provider user permissions are not detected, and guidance to restrict plugins via IAM policies) and replaced it with a link to the AWS assistant User Guide.
Security assessment
The diff deletes security-relevant operational guidance (CloudTrail audit visibility for third-party API calls, Secrets Manager credential retrieval, and IAM-based restriction of plugin access) rather than adding it; the content is relocated to another guide, so there is no evidence of a specific vulnerability or incident being addressed, but the removal of audit/logging and authorization guidance is security-adjacent.
Evidence
-When Amazon Q calls a third party API, the API will not appear in AWS CloudTrail logs. The CloudTrail log will only show when an AWS Secrets Manager secret is accessed by Amazon Q to retrieve credentials to connect to the third party provider.
Diff
diff --git a/amazonq/latest/qdeveloper-ug/plugins.md b/amazonq/latest/qdeveloper-ug/plugins.md index 4329d08..faaf700 100644 --- a//amazonq/latest/qdeveloper-ug/plugins.md +++ b//amazonq/latest/qdeveloper-ug/plugins.md @@ -9 +9 @@ -Amazon Q Developer integrates with third party monitoring tools and security platforms so you can access your AWS application insights without leaving the AWS builder environment. In the AWS Management Console, you can chat about metrics provided by these tools to understand and address application performance, errors, or vulnerabilities. +Plugins are now part of the AWS assistant. @@ -11,17 +11 @@ Amazon Q Developer integrates with third party monitoring tools and security pla -After you configure a plugin, add the plugin alias to the beginning of your question when you chat with Amazon Q in the AWS console. Amazon Q calls the third party provider APIs to retrieve resources and generates a response with deep links to the external resources. - -When Amazon Q calls a third party API, the API will not appear in AWS CloudTrail logs. The CloudTrail log will only show when an AWS Secrets Manager secret is accessed by Amazon Q to retrieve credentials to connect to the third party provider. - -Amazon Q doesn't share any information with third party providers when you configure or use plugins. For more information on how Amazon Q uses your data, see [Data protection](./data-protection.html). - -###### Note - -Member accounts within an AWS organization don't have access to plugins that are configured in the organization's management account profile. Each member account must create their own Q Developer profile before they can configure and use plugins in their account. - -###### Warning - -Third party provider user permissions are not detected by Amazon Q Developer plugins. When an administrator configures a plugin in an AWS account, users with plugin permissions in that account have access to any resources in the third party provider account retrievable by the plugin. - -You can configure IAM policies to restrict which plugins users have access to. For more information, see [Allow users to chat with plugins from one provider](./id-based-policy-examples-users.html#id-based-policy-examples-allow-plugin-type). - -To get started, see the topic for the plugin you want to use with Amazon Q Developer. +For current documentation, see [Using plugins with the AWS assistant](https://docs.aws.amazon.com/assistant/latest/userguide/plugins.html) in the _AWS assistant User Guide_.