AWS Chatbot is now Amazon Q Developer. Learn more

Amazon Q Developer in chat channels Service-linked role for performing operations on Amazon SNS topics and CloudWatch Logs

Amazon Q Developer uses the service-linked role named AWSServiceRoleForAWSChatbot. This is a managed IAM policy with scoped permissions that Amazon Q Developer in chat channels needs to run in customers’ accounts.

Service-Linked Role Permissions for Amazon Q Developer

The Amazon Q Developer in chat channels service-linked role gives permissions for the following services and resources:

These permissions allow Amazon Q Developer in chat channels to perform operations on Amazon SNS topics and CloudWatch Logs.

Administrators can view, but can't edit, the permissions for the Amazon Q Developer in chat channels service-linked role.

The AWSServiceRoleForAWSChatbot service-linked role provides trust permissions to the following service to assume its role:

You must configure permissions to allow an IAM entity (such as a user, group, or role) to create, edit, or delete a service-linked role. For more information, see Service-Linked Role Permissions in the IAM User Guide.

When you create an Amazon Q Developer in chat channels configuration, it creates the following policy for the service-linked role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
              "sns:ListSubscriptionsByTopic",
              "sns:ListTopics",
              "sns:Unsubscribe",
              "sns:Subscribe",
              "sns:ListSubscriptions"
            ],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
              "logs:PutLogEvents",
              "logs:CreateLogStream",
              "logs:DescribeLogStreams",
              "logs:CreateLogGroup",
              "logs:DescribeLogGroups"
            ],
            "Resource": "arn:aws:logs:*:*:log-group:/aws/chatbot/*"
        }
    ]
}

You don't need to take any action to support this role beyond using the Amazon Q Developer in chat channels service.

Enabling the service-linked role for Amazon Q Developer

When you configure Amazon Q Developer in chat applications for the first time, you configure a Microsoft Teams channel, a Slack channel, or Amazon Chime webhook to work with Amazon Simple Notification Service (Amazon SNS) topics for forwarding notifications to chat rooms. When you create the first resource, Amazon Q Developer in chat channels automatically creates the IAM service-linked role, which can be seen in the IAM console. You don't need to manually create or configure this role.

Editing a service-linked role for Amazon Q Developer

You can't edit the AWSServiceRoleForAWSChatbot service-linked role. You also can't change its name, because other entities might reference it. You can edit the role's description using the IAM console. For more information, see Editing a service-linked role in the IAM User Guide.

Manually deleting the AWSServiceRoleForAWSChatbot service-linked role

Under specific circumstances, you can manually delete the AWSServiceRoleForAWSChatbot service-linked role. If you no longer need to use any feature or service that requires a service-linked role, we recommend that you delete that role. Doing so prevents having an unused entity that is not actively maintained in your account.

To delete the Amazon Q Developer in chat channels service-linked role, you must delete all Amazon Q Developer in chat channels resources in your AWS account, including all Slack channels and Amazon Chime webhooks. You can delete all Amazon Q Developer in chat channels resources using the Amazon Q Developer in chat applications console, and then use the IAM console or AWS Command Line Interface (AWS CLI) to delete the service-linked role.

Supported regions for Amazon Q Developer service-linked roles

AWSServiceRoleForAWSChatbot doesn't support using service-linked roles in every AWS Region where the service is available. The following table shows the Regions where you can use the AWSServiceRoleForAWSChatbot.