Permissions reference for the AWS assistant
You can use the following permissions as a reference when you write identity-based
policies for the AWS assistant. The permissions use the q service prefix.
Important
To chat with the AWS assistant, an IAM identity needs permissions for the following actions:
q:StartConversationq:SendMessageq:GetConversation(AWS Management Console only)q:ListConversations(AWS Management Console only)
If one of these actions isn't explicitly allowed by an attached policy, an IAM permissions error is returned when you try to chat with the AWS assistant.
Name |
Description of permission granted |
|---|---|
User permissions |
|
|
Start a conversation with the AWS assistant |
|
Send a message to the AWS assistant |
|
Get individual messages associated with a specific conversation with the AWS assistant (AWS Management Console only) |
|
List individual conversations associated with a specific AWS assistant user (AWS Management Console only) |
|
Update a conversation with the AWS assistant |
|
Delete a conversation with the AWS assistant |
|
Allow the AWS assistant to fetch application identity-related metadata |
|
Allow the AWS assistant to perform actions that an IAM identity has permission to perform |
|
Start a troubleshooting analysis with the AWS assistant |
|
Get troubleshooting results with the AWS assistant |
|
Start a troubleshooting resolution explanation with the AWS assistant |
|
Allow the AWS assistant to analyze resources to troubleshoot a console error |
|
Access plugins from the AWS assistant |
Administrator permissions for plugins |
|
|
Create and configure a third-party plugin for the AWS assistant |
|
View information about a specific plugin |
|
Delete a configured plugin |
|
View configured plugins |
|
View available plugins |
|
Update feature enablement controls for a third-party integration plugin |
|
Register a third-party application user |
|
Update a third-party application user |
|
Register a third-party OAuth application |
|
Update a third-party OAuth application |
|
Send events from a third-party application for processing |
For example policies, see Identity-based policy examples for the AWS assistant. For all actions that use the q service
prefix, see Actions, resources, and condition keys
for Amazon Q in the Service Authorization Reference.
Using q:PassRequest
q:PassRequest is a permission that allows the AWS assistant to call
AWS APIs on your behalf. When you add the q:PassRequest permission
to an IAM identity, the AWS assistant gains permission to call any API that the IAM identity
has permission to call. For example, if an IAM role has the s3:ListAllMyBuckets
permission and the q:PassRequest permission, the AWS assistant can call the
ListAllMyBuckets API when a user who assumes that role asks the AWS assistant to
list their Amazon S3 buckets.
You can create IAM policies that restrict the scope of the q:PassRequest
permission. For example, you can prevent the AWS assistant from performing a specific action,
or permit it to perform only a subset of actions for a service. You can also specify which
Regions the AWS assistant can make calls to when it performs actions on your behalf.
For example policies that control the use of q:PassRequest, see the
following:
