Amazon Q index for independent software vendors (ISVs)
Topics
- Key concepts
- Prerequisites
- Information to be provided to the Amazon Q Business team
- Getting access to your customer's Amazon Q index
- Accessing a customer's Amazon Q index as a data accessor using cross-account access
- Creating an Amazon Q index on behalf of a customer
- Calling the SearchRelevantContent API to an Amazon Q index with an IAM Identity Center application environment
- Calling the SearchRelevantContent API on an Amazon Q application environment with IAM Federation
- Troubleshooting
The Amazon Q index allows independent software vendors (ISVs) to access and integrate a company's data into their applications, enhancing end user productivity for customers by providing seamless access to company data sources across the ISV's applications. Amazon Q index allows access to a company's data without having to access, connect, or index every individual data source. This can help to improve user engagement, satisfaction, and retention for the ISV's applications.
Key concepts
- Amazon Q index
-
A comprehensive collection of a company's data that can be queried to build enhanced application experiences. It serves as the foundation for retrieving relevant content across various enterprise data sources.
Organizations that are Amazon Q Business customers and would like to connect their data sources with a supported ISV can add the ISV as a data accessor. For more information, see Data accessors.
SearchRelevantContentAPI operation-
This API operation enables ISVs to access the Amazon Q index. It supports keyword, semantic, and hybrid queries—allowing for flexible data retrieval options.
- AWS Identity and Access Management IAM Identity CenterManaged Application
-
Amazon Q Business manages end user access to a customer's Amazon Q index using IAWS Identity and Access Management IAM Identity Center.
- Resource-based policy
-
A resource-based policy is an IAM policy that's attached to a resource. Amazon Q Business attaches a resource-based policy to an Amazon Q Business application environment during the data accessor setup. This policy grants the ISV's AWS account the necessary permissions to access content for the customer's end users from the customer's data sources through the
SearchRelevantContentAPI operation. By attaching a resource-based policy to the data accessor's AWS account, it allows access to the Amazon Q index of the application environment. For more information, see Data accessors.
Creating an Amazon Q index on behalf of a customer
We recommend creating one Amazon Q Business application environment per customer for better security and data segregation. Alternatively, you can create one Amazon Q Business application environment and share it with multiple customers. This is only recommended when you index documents that are visible to all users in your application.
Determine the identity management for your customer's Amazon Q Business application
All Amazon Q Business application environments require user access through AWS Identity and Access Management (IAM) identity management. You can choose one of two types of user IAM identity management methods supported by Amazon Q Business. These are IAM Identity Center and IAM Federation. Both IAM Identity Center and IAM Federation require an external identity provider setup to allow end users to log in through their identity provider.
IAM Identity Center provides advanced user group management, while Identity and Access Management (IAM) Federation provides more service quotas for the external identity providers. You can choose the identity management that's best suited for you and your end customer when creating their Amazon Q Business application environment. For more information, see Configuring an Amazon Q Business application environment using AWS IAM Identity Center and Creating an Amazon Q Business application environment using Identity Federation through IAM
After the Amazon Q Business application environment is created, set up the retriever and connect the data sources. For a complete list of data source connectors,see supported connectors. You will need your customers to provide the relevant credentials for each connector that you intend to retrieve data from. For more information, see Creating a retriever for an Amazon Q Business application and Connecting Amazon Q Business data sources.
