Manage access to Amazon Q Developer with policies
Note
The information on this page pertains to accessing Amazon Q Developer. For information about managing access to Amazon Q Business, see Identity-based policy examples for Amazon Q Business in the Amazon Q Business User Guide.
The policies and examples in this topic are specific to Amazon Q in the AWS Management Console, AWS Console Mobile Application, AWS website, AWS Documentation, AWS Chatbot, and in IDEs. Other services integrated with Amazon Q might require different policies or settings. For more information, see the documentation for the service that contains an Amazon Q feature or integration.
By default, users and roles don't have permission to use Amazon Q. IAM administrators can manage access to Amazon Q Developer and its features by granting permissions to IAM identities.
The quickest way for an administrator to grant access to users is through an AWS managed
policy. The AmazonQFullAccess policy can be attached to IAM
identities to grant full access to
Amazon Q Developer and its features. For more information about this policy, see AWS managed policies for Amazon Q Developer.
To manage specific actions that IAM identities can perform with Amazon Q Developer, administrators can create custom policies that define what permissions a user, group, or role has. You can also use service control policies (SCPs) to control what Amazon Q features are available in your organization.
For a list of all Amazon Q permissions you can control with policies, see the see the Amazon Q Developer permissions reference.
Topics
Policy best practices
Identity-based policies determine whether someone can create, access, or delete Amazon Q Developer resources in your account. These actions can incur costs for your AWS account. When you create or edit identity-based policies, follow these guidelines and recommendations:
-
Get started with AWS managed policies and move toward least-privilege permissions – To get started granting permissions to your users and workloads, use the AWS managed policies that grant permissions for many common use cases. They are available in your AWS account. We recommend that you reduce permissions further by defining AWS customer managed policies that are specific to your use cases. For more information, see AWS managed policies or AWS managed policies for job functions in the IAM User Guide.
-
Apply least-privilege permissions – When you set permissions with IAM policies, grant only the permissions required to perform a task. You do this by defining the actions that can be taken on specific resources under specific conditions, also known as least-privilege permissions. For more information about using IAM to apply permissions, see Policies and permissions in IAM in the IAM User Guide.
-
Use conditions in IAM policies to further restrict access – You can add a condition to your policies to limit access to actions and resources. For example, you can write a policy condition to specify that all requests must be sent using SSL. You can also use conditions to grant access to service actions if they are used through a specific AWS service, such as AWS CloudFormation. For more information, see IAM JSON policy elements: Condition in the IAM User Guide.
-
Use IAM Access Analyzer to validate your IAM policies to ensure secure and functional permissions – IAM Access Analyzer validates new and existing policies so that the policies adhere to the IAM policy language (JSON) and IAM best practices. IAM Access Analyzer provides more than 100 policy checks and actionable recommendations to help you author secure and functional policies. For more information, see IAM Access Analyzer policy validation in the IAM User Guide.
-
Require multi-factor authentication (MFA) – If you have a scenario that requires IAM users or a root user in your AWS account, turn on MFA for additional security. To require MFA when API operations are called, add MFA conditions to your policies. For more information, see Configuring MFA-protected API access in the IAM User Guide.
For more information about best practices in IAM, see Security best practices in IAM in the IAM User Guide.
Assign permissions
To provide access, add permissions to your users, groups, or roles:
-
Users and groups in AWS IAM Identity Center:
Create a permission set. Follow the instructions in Create a permission set in the AWS IAM Identity Center User Guide.
-
Users managed in IAM through an identity provider:
Create a role for identity federation. Follow the instructions in Creating a role for a third-party identity provider (federation) in the IAM User Guide.
-
IAM users:
-
Create a role that your user can assume. Follow the instructions in Creating a role for an IAM user in the IAM User Guide.
-
(Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in Adding permissions to a user (console) in the IAM User Guide.
-
Manage access with service control policies (SCPs)
Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. You can control what Amazon Q Developer features are available in your organization by creating an SCP that specifies permissions for some or all Amazon Q actions.
For more information about using SCPs to control access in your organization, see Creating, updating, and deleting service control policies and Attaching and detaching service control policies in the AWS Organizations User Guide.
The following is an example of an SCP that denies access to Amazon Q. This policy restricts access to Amazon Q chat, console error troubleshooting, and network troubleshooting.
Note
Denying access to Amazon Q will not disable the Amazon Q icon or chat panel in the AWS console, AWS website, AWS documentation pages, or AWS Console Mobile Application.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAmazonQFullAccess", "Effect": "Deny", "Action": [ "q:*" ], "Resource": "*" } ] }
Data perimeters for Amazon Q resources
For some features, Amazon Q uploads artifacts to AWS service-owned Amazon S3 buckets. If you are using data perimeters to control access to Amazon S3 in your environment, you might need to explicitly allow access to these buckets to use the corresponding Amazon Q features.
The following table lists the ARN and URL of each of the Amazon S3 buckets that Amazon Q requires access to, and the features that use each bucket. You can use the bucket ARN or bucket URL to allowlist these buckets, depending on how you control access to Amazon S3.
| Amazon S3 bucket ARN | Amazon S3 bucket URL | Description |
|---|---|---|
|
|
An Amazon S3 bucket used to upload artifacts for Amazon Q code scans |
|
|
An Amazon S3 bucket used to upload artifacts for the Amazon Q Developer Agent for code transformation |
|
|
An Amazon S3 bucket used to upload artifacts for the Amazon Q Developer Agent for software development |
