Prerequisites for configuring Amazon Q Business built-in plugins

In Action field for "Sid": "QBusinessConversationPermissions, add the following permissions to allow Amazon Q Business to list plugin actions:

{
    "Sid": "QBusinessConversationPermissions",
    "Effect": "Allow",
    "Action": [
        "qbusiness:ListPluginActions",
    ],
    "Resource": "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}"
}

Add the following permissions to allow Amazon Q Business to allow your end users to discover plugins in their web experience:

{
    "Sid": "QBusinessPluginDiscoveryPermissions",
    "Effect": "Allow",
    "Action": [
        "qbusiness:ListPluginTypeMetadata",
        "qbusiness:ListPluginTypeActions"
    ],
    "Resource": "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}"
}

For the complete set of permissions needed for an IAM role, see IAM role for an Amazon Q Business web experience.

If you use the console or the API to create a plugin, make sure to add the following permissions:

{
    "Version": "2012-10-17",
    "Statement": [{
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue"
            ],
            "Resource": [
                "arn:aws:secretsmanager:{{your-region}}:{{your-account-id}}:secret:[[secret-id]]"
            ]
        }
    ]
}

To allow Amazon Q to assume a role, use the following trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "QBusinessApplicationTrustPolicy",
      "Effect": "Allow",
      "Principal": {
        "Service": "qbusiness.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "{{source_account}}"
        },
        "ArnLike": {
          "aws:SourceArn":"arn:aws:qbusiness:{{your-region}}:{{source_account}}:application/{{application_id}}"
        }
      }
    }
  ]
}