Configuring a Google Calendar plugin for Amazon Q Business
Google Calendar is an online calendar service that helps users schedule meetings, set up events, set reminders, and share their schedules. If you’re a Google Calendar user, you can create an Amazon Q Business plugin to allow your end users to find and list events from within their web experience chat.
To create a Google Calendar plugin, you need configuration information from your Google Calendar instance to set up a connection between Amazon Q and Google Calendar and allow Amazon Q to perform actions in Google Calendar.
For more information on how to use plugins during your web experience chat, see Using plugins.
Prerequisites
Before you configure your Amazon Q Google Calendar plugin, you must do the following:
-
As an admin, create a new OAuth 2.0 Google Calendar app in the Google Calendar developer console with scoped permissions for performing actions in Amazon Q. To learn how to do this, see Using OAuth 2.0 to Access Google APIs
in Google Calendar Developer Documentation. -
Make sure you've added following required scopes:
calendar.readonly
,calendar.events
. -
Note the domain URL of your Google Calendar instance. For example:
https://www.googleapis.com/calendar/v3
. -
Note your:
-
Access token URL – For Google Calendar OAuth applications, this is
https://oauth2.googleapis.com/token
. -
Authorization URL – For Google Calendar OAuth applications, this is
https://accounts.google.com/o/oauth2/v2/auth
. -
Redirect URL – The URL to which user needs to be redirected after authentication. If your deployed web url is
<q-endpoint>
, use<q-endpoint>/oauth/callback
. Amazon Q Business will handle OAuth tokens in this URL. This callback URL needs to be allowlisted in your third-party application. -
Client ID – The client ID generated when you create your OAuth 2.0 application in Google Calendar.
-
Client secret – The client secret generated when you create your OAuth 2.0 application in Google Calendar.
You will need this authentication information during the plugin configuration process.
-
Service access roles
To successfully connect Amazon Q to Google Calendar, you need to give Amazon Q the following permission to access your Secrets Manager secret to get your Google Calendar credentials. Amazon Q assumes this role to access your Google Calendar credentials.
The following is the service access IAM role required:
{ "Version": "2012-10-17", "Statement": [{ "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue" ], "Resource": [ "arn:aws:secretsmanager:{{your-region}}:{{your-account-id}}:secret:[[secret-id]]" ] } ] }
To allow Amazon Q to assume a role, use the following trust policy:
{ "Version": "2012-10-17", "Statement": [ { "Sid": "QBusinessApplicationTrustPolicy", "Effect": "Allow", "Principal": { "Service": "qbusiness.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "{{source_account}}" }, "ArnLike": { "aws:SourceArn":"arn:aws:qbusiness:{{your-region}}:{{source_account}}:application/{{application_id}}" } } } ] }
If you use the console and choose to create a new IAM role, Amazon Q creates the role for you. If you use the console and choose to use an existing secret, or you use the API, make sure your IAM role contains these permissions.
Creating a plugin
To create a Google Calendar plugin for your web experience chat, you can use the AWS Management Console or the CreatePlugin API operation. The following tabs provide a procedure for creating a Google Calendar plugin using the console and code examples for the AWS CLI.