GitLab Duo concepts

Here are some concepts and terms to know when using GitLab Duo with Amazon Q.

Setting up GitLab Duo with Amazon Q

Before you can use Amazon Q artificial intelligence (AI) capabilities in GitLab Duo, you need to complete the prerequisites and create AWS resources. For more information, see Set up GitLab Duo with Amazon Q in the GitLab documentation.

Onboarding with AWS resources and permission policies

As part of the GitLab Duo onboarding process, you need to create an Amazon Q Developer profile through the Amazon Q Developer console. The profile allows you to create customization and control settings for all or a subset of users in your identity provider. After creating a profile, you need an OpenID Connect (OIDC) identity provider (IdP), as well as an IAM service role, to establish trust between GitLab Duo and your AWS account. To learn how to create the required resources and set up GitLab Duo with Amazon Q, see Set up GitLab Duo with Amazon Q in the GitLab documentation.

When the new IAM role is created, the required trust policy with the necessary permissions is also created. A role trust policy is a required resource-based policy that is attached to a role in IAM.

You need to add a permissions policy, which grants ability to connect with Amazon Q and utilize the features in the GitLab Duo with Amazon Q integration. The policy must be added when creating the IAM role. To learn more about the permissions provided by the permissions policy, see GitLabDuoWithAmazonQPermissionsPolicy.

Alternatively, you can create an inline policy and add the required permissions. You can choose to create an inline policy if you want to custom access control. For more information, see Managed policies and inline policies and Policies and permissions in AWS Identity and Access Management in the IAM User Guide.

Trust policy

JSON

{
    "Version":"2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Principal": {
                "Federated": "arn:aws:iam::111122223333:oidc-provider/auth.token.gitlab.com/cc/oidc/instance-id"
            },
            "Condition": {
                "StringEquals": {
                    "auth.token.gitlab.com/cc/oidc/instance-id:aud": "gitlab-cc-instance-id"
                }
            }
        }
    ]
}

Permissions policy

JSON

{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Sid": "GitLabDuoUsagePermissions",
      "Effect": "Allow",
      "Action": [
        "q:SendEvent",
        "q:CreateAuthGrant",
        "q:UpdateAuthGrant",
        "q:GenerateCodeRecommendations",
        "q:SendMessage",
        "q:ListPlugins",
        "q:VerifyOAuthAppConnection"
      ],
      "Resource": "*"
    },
    {
      "Sid": "GitLabDuoManagementPermissions",
      "Effect": "Allow",
      "Action": [
        "q:CreateOAuthAppConnection",
        "q:DeleteOAuthAppConnection"
      ],
      "Resource": "*"
    },
    {
      "Sid": "GitLabDuoPluginPermissions",
      "Effect": "Allow",
      "Action": [
        "q:CreatePlugin",
        "q:DeletePlugin",
        "q:GetPlugin"
      ],
      "Resource": "arn:aws:qdeveloper:*:*:plugin/GitLabDuoWithAmazonQ/*"
    }
  ]
}

Optionally, you can also use customer managed keys (CMK) to encrypt your resources if you want full control over the lifecycle and usage of your key. The kms:ViaService condition key to limit who can use CMK for encrypting and decrypting content. For more information, see Manage access to Amazon Q Developer for third-party integration.

GitLab quick actions

When invoked, quick actions perform tasks for you in GitLab issues and merge requests. To learn how to invoke quick actions in GitLab, see the GitLab documentation.