As of April 30, 2024 Amazon Q Enterprise is usually accessible. Amazon Q Enterprise is a conversational assistant powered by generative synthetic intelligence (AI) that enhances workforce productiveness by answering questions and finishing duties based mostly on info in your enterprise programs. Your staff can entry enterprise content material securely and privately utilizing internet purposes constructed with Amazon Q Enterprise. The success of those purposes depends upon two key elements: first, that an end-user of the applying is simply in a position to see responses generated from paperwork they’ve been granted entry to, and second, that every consumer’s dialog historical past is personal, safe, and accessible solely to the consumer.
Amazon Q Enterprise operationalizes this by validating the identification of the consumer each time they entry the applying in order that the applying can use the end-user’s identification to limit duties and solutions to paperwork that the consumer has entry to. This final result is achieved with a mix of AWS IAM Identification Middle and Amazon Q Enterprise. IAM Identification Middle shops the consumer identification, is the authoritative supply of identification info for Amazon Q Enterprise purposes, and validates the consumer’s identification after they entry an Amazon Q Enterprise software. You’ll be able to configure IAM Identification Middle to make use of your enterprise identification supplier (IdP)—akin to Okta or Microsoft Entra ID—because the identification supply. Amazon Q Enterprise makes positive that entry management lists (ACLs) for enterprise paperwork being listed are matched to the consumer identities supplied by IAM Identification Middle, and that these ACLs are honored each time the applying calls Amazon Q Enterprise APIs to reply to consumer queries.
On this put up, we present how IAM Identification Middle acts as a gateway to steer consumer identities created by your enterprise IdP because the identification supply, for Amazon Q Enterprise, and the way Amazon Q Enterprise makes use of these identities to reply securely and confidentially to consumer queries. We use an instance of a generative AI worker assistant constructed with Amazon Q Enterprise, show learn how to set it as much as solely reply utilizing enterprise content material that every worker has permissions to entry, and present how staff are in a position to converse securely and privately with this assistant.
Answer overview
The next diagram reveals a high-level structure of how the enterprise IdP, IAM Identification Middle occasion, and Amazon Q Enterprise software work together with one another to allow an authenticated consumer to securely and privately work together with an Amazon Q Enterprise software utilizing an Amazon Q Enterprise internet expertise from their internet browser.
When utilizing an exterior IdP akin to Okta, customers and teams are first provisioned within the IdP after which routinely synchronized with the IAM Identification Middle occasion utilizing the SCIM protocol. When a consumer begins the Amazon Q Enterprise internet expertise, they’re authenticated with their IdP utilizing single sign-on, and the tokens obtained from the IdP are utilized by Amazon Q Enterprise to validate the consumer with IAM Identification Middle. After validation, a chat session is began with the consumer.
The pattern use case on this put up makes use of an IAM Identification Middle account occasion with its identification supply configured as Okta, which is used because the IdP. Then we ingest content material from Atlassian Confluence. The Amazon Q Enterprise built-in connector for Confluence ingests the native customers and teams configured in Confluence, in addition to ACLs for the areas and paperwork, to the Amazon Q Enterprise software index. These customers from the info supply are matched with the customers configured within the IAM Identification Middle occasion, and aliases are created in Amazon Q Enterprise Consumer Retailer for proper ACL enforcement.
Stipulations
To implement this resolution for the pattern use case of this put up, you want an IAM Identification Middle occasion and Okta identification supplier as identification supply. We offer extra details about these sources on this part.
IAM Identification Middle occasion
An Amazon Q Enterprise software requires an IAM Identification Middle occasion to be related to it. There are two sorts of IAM Identification Middle situations: a company occasion and an account occasion. Amazon Q Enterprise purposes can work with both kind of occasion. These situations retailer the consumer identities which can be created by an IdP, in addition to the teams to which the customers belong.
For manufacturing use circumstances, an IAM Identification Middle group occasion is really useful. The benefit of a company occasion is that it may be utilized by an Amazon Q Enterprise software in any AWS account in AWS Organizations, and also you solely pay as soon as for a consumer in your organization, if in case you have a number of Amazon Q Enterprise purposes unfold throughout a number of AWS accounts and you employ group occasion. Many AWS enterprise clients use Organizations, and have IAM Identification Middle group situations related to them.
For proof of idea and departmental use circumstances, or in conditions when an AWS account will not be a part of an AWS Group and also you don’t need to create a brand new AWS group, you should use an IAM Identification Middle account occasion to allow an Amazon Q Enterprise software. On this case, solely the Amazon Q Enterprise software configured within the AWS account during which the account occasion is created will have the ability to use that occasion.
Amazon Q Enterprise implements a per-user subscription charge. A consumer is billed just one time if they’re uniquely identifiable throughout completely different accounts and completely different Amazon Q Enterprise purposes. For instance, if a number of Amazon Q Enterprise purposes are inside a single AWS account, a consumer that’s uniquely recognized by an IAM Identification Middle occasion tied to this account will solely be billed one time for utilizing these purposes. In case your group has two accounts, and you’ve got an organization-level IAM Identification Middle occasion, a consumer who’s uniquely recognized within the organization-level occasion will likely be billed just one time despite the fact that they entry purposes in each accounts. Nevertheless, if in case you have two account-level IAM Identification Middle situations, a consumer in a single account can’t be recognized as the identical consumer in one other account as a result of there is no such thing as a central identification. Because of this the identical consumer will likely be billed twice. We due to this fact advocate utilizing organization-level IAM Identification Middle situations for manufacturing use circumstances to optimize prices.
In each these circumstances, the Amazon Q Enterprise software must be in the identical AWS Area because the IAM Identification Middle occasion.
Identification supply
Should you already use an IdP akin to Okta or Entra ID, you’ll be able to proceed to make use of your most popular IdP with Amazon Q Enterprise purposes. On this case, the IAM Identification Middle occasion is configured to make use of the IdP as its identification supply. The customers and consumer teams from the IdP may be routinely synced to the IAM Identification Middle occasion utilizing SCIM. Many AWS enterprise clients have already got this configured for his or her IAM Identification Middle group occasion. For extra details about all of the supported IdPs, see Getting began tutorials. The method is comparable for IAM Identification Middle group situations and account situations.
AWS IAM Identification Middle occasion configured with Okta because the identification supply
The next screenshot reveals the IAM Identification Middle software configured in Okta, and the customers and teams from the Okta configuration assigned to this software.
The next screenshot reveals the IAM Identification Middle occasion consumer retailer after configuring Okta because the identification supply. Right here the consumer and group info is routinely provisioned (synchronized) from Okta into IAM Identification Middle utilizing the System for Cross-domain Identification Administration (SCIM) v2.0 protocol.
Configure an Amazon Q Enterprise software with IAM Identification Middle enabled
Full the next steps to create an Amazon Q Enterprise software and allow IAM Identification Middle:
- On the Amazon Q Enterprise console, select Create software.
- For Utility identify, enter a reputation.
- Except you should change the AWS Identification and Entry Administration (IAM) function for the applying or customise encryption settings, maintain the default settings.
- Select Create.
- On the Choose retriever web page, except you need to configure a preexisting Amazon Kendra index as a retriever, or you should configure storage models for greater than 20,000 paperwork, you’ll be able to proceed with the default settings.
- Select Subsequent.
For extra details about Amazon Q Enterprise retrievers, discuss with Creating and choosing a retriever for an Amazon Q Enterprise software.
- On the Join information sources web page, for Information sources, select Confluence.
The next directions show learn how to configure the Confluence information supply. These could differ for different information sources.
- For Information supply identify, enter a reputation.
- For Supply¸ choose Confluence Cloud.
- For Confluence URL, enter the Confluence URL.
- For Authentication, choose Fundamental authentication.
- For AWS Secrets and techniques Supervisor secret, select an AWS Secrets and techniques Supervisor secret.
- For Digital Personal Cloud, select No VPC.
- For IAM function, select Create a brand new service function.
- For Function identify¸ both go along with the supplied identify or edit it in your new function.
- For Sync scope, choose the contents to sync.
- For Sync mode, choose Full sync.
- For Frequency, select Run on demand.
- For Area mappings, go away the defaults.
- Select Add information supply.
- Select Subsequent.
- On the Add teams and customers web page, select Add teams and customers.
- Within the pop-up window, select Get began.
- Seek for customers based mostly on their show identify or teams, then select the consumer or group you need to add to the applying.
- Add extra customers as wanted.
- Select Assign.
- You will note the next display:
- Select subscription for every consumer by clicking on the Select subscription pull down after which choosing the verify mark.
- After selecting subscription for all of the customers, your display will look as under. Except you need to change the service function, select Create software.
After the applying is created, you will note the applying settings web page, as proven within the following screenshot.
Worker AI assistant use case
As an instance how one can construct a safe and personal generative AI assistant in your staff utilizing Amazon Q Enterprise purposes, let’s take a pattern use case of an worker AI assistant in an enterprise company. Two new staff, Mateo Jackson and Mary Main, have joined the corporate on two completely different tasks, and have completed their worker orientation. They’ve been given company laptops, and their accounts are provisioned within the company IdP. They’ve been informed to get assist from the worker AI assistant for any questions associated to their new workforce member actions and their advantages.
The corporate makes use of Confluence to handle their enterprise content material. The pattern Amazon Q software used to run the situations for this put up is configured with an information supply utilizing the built-in connector for Confluence to index the enterprise Confluence areas utilized by staff. The instance makes use of three Confluence areas: AnyOrgApp Venture, ACME Venture House, and AJ-DEMO-HR-SPACE. The entry permissions for these areas are as follows:
- AJ-DEMO-HR-SPACE – All staff, together with Mateo and Mary
- AnyOrgApp Venture – Workers assigned to the challenge together with Mateo
- ACME Venture House – Workers assigned to the challenge together with Mary
Let’s take a look at how Mateo and Mary expertise their worker AI assistant.
Each are supplied with the URL of the worker AI assistant internet expertise. They use the URL and register to the IdP from the browsers of their laptops. Mateo and Mary each need to learn about their new workforce member actions and their fellow workforce members. They ask the identical inquiries to the worker AI assistant however get completely different responses, as a result of every has entry to separate tasks. Within the following screenshots, the browser window on the left is for Mateo Jackson and the one on the suitable is for Mary Main. Mateo will get details about the AnyOrgApp challenge and Mary will get details about the ACME challenge.
Mateo chooses Sources below the query about workforce members to take a more in-depth take a look at the workforce member info, and Mary selecting Sources below the query for brand new workforce member onboarding actions. The next screenshots present their up to date views.
Mateo and Mary need to discover out extra about the advantages their new job presents and the way the advantages are relevant to their private and household conditions.
The next screenshot reveals that Mary asks the worker AI assistant questions on her advantages and eligibility.
Mary can even discuss with the supply paperwork.
The next screenshot reveals that Mateo asks the worker AI assistant completely different questions on his eligibility.
Mateo seems on the following supply paperwork.
Each Mary and Mateo first need to know their eligibility for advantages. However after that, they’ve completely different inquiries to ask. Although the benefits-related paperwork are accessible by each Mary and Mateo, their conversations with worker AI assistant are personal and private. The peace of mind that their dialog historical past is personal and might’t be seen by some other consumer is important for the success of a generative AI worker productiveness assistant.
Clear up
Should you created a brand new Amazon Q Enterprise software to check out the combination with IAM Identification Middle, and don’t plan to make use of it additional, unsubscribe and take away assigned customers from the applying and delete it in order that your AWS account doesn’t accumulate prices.
To unsubscribe and take away customers go to the applying particulars web page and choose Handle entry and subscriptions.
Choose all of the customers, after which use the Edit button to decide on Unsubscribe and take away as proven under.
Delete the applying after eradicating the customers, going again to the applying particulars web page and choosing Delete.
Conclusion
For enterprise generative AI assistants such because the one proven on this put up to achieve success, they have to respect entry management in addition to guarantee the privateness and confidentiality of each worker. Amazon Q Enterprise and IAM Identification Middle present an answer that authenticates every consumer and validates the consumer identification at every step to implement entry management together with privateness and confidentiality.
To realize this, IAM Identification Middle acts as a gateway to sync consumer and group identities from an IdP (akin to Okta), and Amazon Q Enterprise makes use of IAM Identification Middle-provided identities to uniquely establish a consumer of an Amazon Q Enterprise software (on this case, an worker AI assistant). Doc ACLs and native customers arrange within the information supply (akin to Confluence) are matched up with the consumer and group identities supplied by IAM Identification Middle. At question time, Amazon Q Enterprise solutions questions from customers using solely these paperwork that they’re supplied entry to by the doc ACLs.
If you wish to know extra, check out the Amazon Q Enterprise launch weblog put up on AWS Information Weblog, and discuss with Amazon Q Enterprise Consumer Information. For extra info on IAM Identification Middle, discuss with the AWS IAM Identification Middle Consumer Information.
In regards to the Authors
Abhinav Jawadekar is a Principal Options Architect within the Amazon Q Enterprise service workforce at AWS. Abhinav works with AWS clients and companions to assist them construct generative AI options on AWS.
Venky Nagapudi is a Senior Supervisor of Product Administration for Q Enterprise, Amazon Comprehend and Amazon Translate. His focus areas on Q Enterprise embody consumer identification administration, and utilizing offline intelligence from paperwork to enhance Q Enterprise accuracy and helpfulness.
