Manage access to Amazon Q Developer with policies

By default, users and roles don't have permission to use Amazon Q. IAM administrators can manage access to Amazon Q Developer and its features by granting permissions to IAM identities.

The quickest way for an administrator to grant access to users is through an AWS managed policy. The AmazonQFullAccess policy can be attached to IAM identities to grant full access to Amazon Q Developer and its features. For more information about this policy, see AWS managed policies for Amazon Q Developer.

To manage specific actions that IAM identities can perform with Amazon Q Developer, administrators can create custom policies that define what permissions a user, group, or role has. You can also use service control policies (SCPs) to control what Amazon Q features are available in your organization.

For a list of all Amazon Q permissions you can control with policies, see the see the Amazon Q Developer permissions reference.

Policy best practices

Identity-based policies determine whether someone can create, access, or delete Amazon Q Developer resources in your account. These actions can incur costs for your AWS account. When you create or edit identity-based policies, follow these guidelines and recommendations:

For more information about best practices in IAM, see Security best practices in IAM in the IAM User Guide.

Assign permissions

To provide access, add permissions to your users, groups, or roles:

Manage access with service control policies (SCPs)

Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. You can control what Amazon Q Developer features are available in your organization by creating an SCP that specifies permissions for some or all Amazon Q actions.

For more information about using SCPs to control access in your organization, see Creating, updating, and deleting service control policies and Attaching and detaching service control policies in the AWS Organizations User Guide.

The following is an example of an SCP that denies access to Amazon Q. This policy restricts access to Amazon Q chat, console error troubleshooting, and network troubleshooting.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyAmazonQFullAccess",
      "Effect": "Deny",
      "Action": [
        "q:*"
      ],
      "Resource": "*"
    }
  ]
}

Data perimeters for Amazon Q resources

For some features, Amazon Q uploads artifacts to AWS service-owned Amazon S3 buckets. If you are using data perimeters to control access to Amazon S3 in your environment, you might need to explicitly allow access to these buckets to use the corresponding Amazon Q features.

The following table lists the ARN and URL of each of the Amazon S3 buckets that Amazon Q requires access to, and the features that use each bucket. You can use the bucket ARN or bucket URL to allowlist these buckets, depending on how you control access to Amazon S3.

arn:aws:s3:::amazonq-code-scan-us-east-1-29121b44f7b

https://amazonq-code-scan-us-east-1-29121b44f7b.s3.amazonaws.com/

arn:aws:s3:::amazonq-code-transformation-us-east-1-c6160f047e0

https://amazonq-code-transformation-us-east-1-c6160f047e0.s3.amazonaws.com/

arn:aws:s3:::amazonq-feature-development-us-east-1-a5b980054c6

https://amazonq-feature-development-us-east-1-a5b980054c6.s3.amazonaws.com/