Arrange a customized plugin on Amazon Q Enterprise and authenticate with Amazon Cognito to work together with backend techniques

Companies are continuously evolving, and leaders are challenged every single day to satisfy new necessities and are searching for methods to optimize their operations and acquire a aggressive edge. One of many key challenges they face is managing the complexity of disparate enterprise techniques and workflows, which ends up in inefficiencies, knowledge silos, and missed alternatives.

Generative AI can play an essential function in integrating these disparate techniques in a safe and seamless method, addressing these challenges in an economical manner. This integration permits for safe and environment friendly knowledge change, motion triggering, and enhanced productiveness throughout the group. Amazon Q Enterprise performs an essential function in making this occur. Amazon Q Enterprise permits organizations to shortly and effortlessly analyze their knowledge, uncover insights, and make data-driven selections. With its intuitive interface and seamless integration with different AWS providers, Amazon Q Enterprise empowers companies of various sizes to rework their knowledge into actionable intelligence and drive innovation throughout their operations.

On this put up, we exhibit the right way to construct a customized plugin with Amazon Q Enterprise for backend integration. This plugin can combine current techniques, together with third-party techniques, with little to no growth in simply weeks and automate crucial workflows. Moreover, we present the right way to safeguard the answer utilizing Amazon Cognito and AWS IAM Identification Heart, sustaining the security and integrity of delicate knowledge and workflows. Amazon Q Enterprise additionally provides software surroundings guardrails or chat controls you could configure to regulate the end-user chat expertise so as to add an extra layer of security. Lastly, we present the right way to expose your backend APIs by means of Amazon API Gateway, which is constructed on serverless AWS Lambda features and Amazon DynamoDB.

Resolution overview

Amazon Q Enterprise is a completely managed, generative AI-powered assistant that helps enterprises unlock the worth of their knowledge and data. With Amazon Q Enterprise, you’ll be able to shortly discover solutions to questions, generate summaries and content material, and full duties through the use of the data and experience saved throughout your organization’s varied knowledge sources and enterprise techniques. On the core of this functionality are built-in knowledge supply connectors and customized plugins that seamlessly combine and index content material from a number of repositories right into a unified index. This allows the Amazon Q Enterprise massive language mannequin (LLM) to supply correct, well-written solutions by drawing from the consolidated knowledge and data. The information supply connectors act as a bridge, synchronizing content material from disparate techniques like Salesforce, Jira, and SharePoint right into a centralized index that powers the pure language understanding and generative skills of Amazon Q Enterprise. Amazon Q Enterprise additionally supplies the aptitude to create customized plugins to combine together with your group’s backend system and third-party purposes.

After you combine Amazon Q Enterprise together with your backend system utilizing a customized plugin, customers can ask questions from paperwork which might be uploaded in Amazon Easy Storage Service (Amazon S3). For this put up, we use a easy doc that accommodates product names, descriptions, and different associated info. Among the questions you’ll be able to ask Amazon Q Enterprise may embrace the next:

• “Give me the identify of the merchandise.”
• “Now checklist all of the merchandise together with the outline in tabular format.”
• “Now create one of many merchandise <product identify>.” (At this stage, Amazon Q Enterprise would require you to authenticate in opposition to Amazon Cognito to be sure you have the appropriate permission to work on that software.)
• “Listing all of the merchandise together with ID and value in tabular format.”
• “Replace the worth of product with ID <product ID>.”

The next diagram illustrates the answer structure.

The workflow consists of the next steps:

1. The person asks a query utilizing the Amazon Q Enterprise chat interface.
2. Amazon Q Enterprise searches the listed doc in Amazon S3 for related info and presents it to the person.
3. The person can use the plugin to carry out actions (API calls) within the system uncovered to Amazon Q Enterprise utilizing Open API 3.x standards.
4. As a result of the API is secured with Amazon Cognito, Amazon Q Enterprise requires the person to authenticate in opposition to the person credentials out there in Amazon Cognito.
5. On profitable authentication, API Gateway forwards the request to Lambda.
6. The API response is returned to the person by means of the Amazon Q Enterprise chat interface.

Conditions

Earlier than you start the walkthrough, you have to have an AWS account. For those who don’t have one, join one. Moreover, you have to have entry to the next providers:

• Amazon API Gateway
• AWS CloudFormation
• Amazon Cognito
• Amazon DynamoDB
• AWS IAM Identification Heart
• AWS Lambda
• Amazon Q Enterprise Professional (This can have an extra month-to-month price)
• Amazon S3

Launch the CloudFormation template

Launch the next CloudFormation template to arrange Amazon Cognito, API Gateway, DynamoDB, and Lambda sources.

After you deploy the stack, navigate to the Outputs tab for the stack on the AWS CloudFormation console and observe the useful resource particulars. We use these values later on this put up.

For those who’re operating the CloudFormation template a number of occasions, be sure that to decide on a novel identify for the stack every time.

Create an Amazon Q Enterprise software

Full the next steps to create an Amazon Q Enterprise software:

1. On the Amazon Q Enterprise console, select Purposes within the navigation pane.
2. Select Create software.

3. Present an software identify (for instance, product-mgmt-app).
4. Go away the opposite settings as default and select Create.

The appliance can be created in just a few seconds.

5. On the appliance particulars web page, select Information supply.
6. Select Add an index.
7. For Index identify, enter a reputation for the index.
8. For Index provisioning, choose Enterprise or Starter.
9. For Variety of items, depart because the default 1.
10. Select Add an index.

11. On the Information supply web page, select Add an information supply.
12. Select Amazon S3 as your knowledge supply and enter a novel identify.
13. Enter the info supply location as the worth of BucketName from the CloudFormation stack outputs within the format s3://<name_here>.

In a later step, we add a file to this S3 bucket.

14. For IAM function¸ select Create a brand new service function (really useful).
15. For Sync scope, choose Full sync.
16. For Frequency, choose Run on demand.
17. Select Add knowledge supply.
18. On the appliance particulars web page, select Handle person entry.
19. Select Add teams and customers.
20. You need to use current customers or teams in IAM Identification Heart or create new customers and teams, then select Affirm.

Solely these teams and customers have entry to the Amazon Q Enterprise software for his or her subscriptions.

21. Pay attention to deployed URL of the appliance to make use of in a later step.
22. On the Amazon S3 console, find the S3 bucket you famous earlier and add the sample document.
23. On the Amazon Q Enterprise console, navigate to the appliance particulars web page and sync the Amazon S3 knowledge supply.

Configure Amazon Cognito

Full the next steps to arrange Amazon Cognito:

1. On the Amazon Cognito console, navigate to the person pool created utilizing the CloudFormation template (ending with-ProductUserPool).
2. Beneath Branding within the navigation pane, select Area.
3. On the Actions menu, select Create Cognito area.

We didn’t create a site after we created the person pool utilizing the CloudFormation template.

4. For Cognito area, enter a site prefix.
5. For Model, choose Hosted UI.
6. Select Create Cognito area.

7. Beneath Purposes within the navigation pane, select App shoppers.
8. Select your app shopper.

9. On the app shopper element web page, select Login pages after which select Edit the managed login pages configuration.
10. For URL, enter the deployed URL you famous earlier, adopted by /oauth/callback. For instance, https://xxxxx.chat.qbusiness.us-east-1.on.aws/oauth/callback.
11. Specify your identification supplier, OAuth 2.0 grant kind, OpenID Join scopes, and customized scopes.

Customized scopes are outlined as a part of the API configuration in API Gateway. This can assist Amazon Q Enterprise decide what motion a person is allowed to take. On this case, we’re permitting the person to learn, write, and delete. Nonetheless, you’ll be able to change this based mostly on what you need your customers to do utilizing the Amazon Q Enterprise chat.

12. Select Save modifications.

13. Pay attention to the Consumer ID and Consumer secret values within the App shopper info part to make use of in a later step.

Amazon Cognito doesn’t help altering the shopper secret after you’ve got created the app shopper; a brand new app shopper is required if you wish to change the shopper secret.

Lastly, it’s important to add not less than one person to the Amazon Cognito person pool.

14. Select Customers beneath Consumer administration within the navigation pane and select Create person.
15. Create a person so as to add to your Amazon Cognito person pool.

We’ll use this person to authenticate earlier than we are able to chat and ask inquiries to the backend system utilizing Amazon Q Enterprise.

Create an Amazon Q Enterprise customized plugin

Full the next steps to create your customized plugin:

1. On the Amazon Q Enterprise console, navigate to the appliance you created.
2. Beneath Actions within the navigation pane, select Plugins
3. Select Add plugin.

4. Choose Create customized plugin.
5. Present a plugin identify (for instance, Merchandise).
6. Beneath API schema supply, choose Outline with in-line OpenAPI schema editor and enter the next code:

openapi: 3.0.0
data:
  title: CRUD API
  model: 1.0.0
  description: API for performing CRUD operations
servers:
  - url: put api gateway endpoint url right here, copy it from cloudformation output
    
paths:
  /merchandise:
    get:
      abstract: Listing all merchandise
      safety:
        - OAuth2:
            - merchandise/learn
      description: Returns an inventory of all out there merchandise
      responses:
        '200':
          description: Profitable response
          content material:
            software/json:
              schema:
                kind: array
                gadgets:
                  $ref: '#/parts/schemas/Product'
        '500':
          description: Inner server error
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Error'
    put up:
      abstract: Create a brand new product
      safety:
        - OAuth2:
            - merchandise/write
      description: Creates a brand new product
      requestBody:
        required: true
        content material:
          software/json:
            schema:
              $ref: '#/parts/schemas/Product'
      responses:
        '201':
          description: Created
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Product'
        '400':
          description: Unhealthy Request
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Error'
        '500':
          description: Inner server error
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Error'
  /merchandise/{id}:
    get:
      abstract: Get a product
      safety:
        - OAuth2:
            - merchandise/learn
      description: Retrieves a selected product by its ID
      parameters:
        - identify: id
          in: path
          required: true
          description: The ID of the product to retrieve
          schema:
            kind: string
      responses:
        '200':
          description: Profitable response
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Product'
        '404':
          description: Product not discovered
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Error'
        '500':
          description: Inner server error
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Error'
    put:
      abstract: Replace a product
      safety:
        - OAuth2:
            - merchandise/write
      description: Updates an current product
      parameters:
        - identify: id
          in: path
          required: true
          description: The ID of the product to replace
          schema:
            kind: string
      requestBody:
        required: true
        content material:
          software/json:
            schema:
              $ref: '#/parts/schemas/Product'
      responses:
        '200':
          description: Profitable response
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Product'
        '404':
          description: Product not discovered
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Error'
        '500':
          description: Inner server error
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Error'
    delete:
      abstract: Delete a product
      safety:
        - OAuth2:
            - merchandise/delete
      description: Deletes a selected product by its ID
      parameters:
        - identify: id
          in: path
          required: true
          description: The ID of the product to delete
          schema:
            kind: string
      responses:
        '204':
          description: Profitable response
        '404':
          description: Product not discovered
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Error'
        '500':
          description: Inner server error
          content material:
            software/json:
              schema:
                $ref: '#/parts/schemas/Error'
parts:
  securitySchemes:
    OAuth2:
      kind: oauth2
      flows:
        authorizationCode:
          authorizationUrl: <Cognito area>/oauth2/authorize
          tokenUrl: <Cognito area>/oauth2/token
          scopes:
            merchandise/learn: learn prodcut
            merchandise/write: write prodcut
            merchandise/delete: delete prodcut
  schemas:
    Product:
      kind: object
      required:
        - id
        - identify
        - description
      properties:
        id:
          kind: string
        identify:
          kind: string
        description:
          kind: string
    Error:
      kind: object
      properties:
        error:
          kind: string

7. Within the YAML file, exchange the URL worth with the worth of ProductAPIEndpoint from the CloudFormation stack outputs:

servers url: https://<<xxxx>>.execute-api.us-east-1.amazonaws.com/dev

8. Exchange the Amazon Cognito area URL with the area you created earlier:

authorizationCode:

authorizationUrl: https://xxxx.auth.us-east1.amazoncognito.com/oauth2/authorize

tokenUrl: https://xxxx.auth.us-east-1.amazoncognito.com/oauth2/token

The YAML file accommodates the schema (Open API 3.x) that Amazon Q Enterprise makes use of to resolve which API must be known as based mostly on the outline. For instance, line 16 within the following screenshot says Return an inventory all out there merchandise, which instructs Amazon Q Enterprise to name this API each time a person makes a request to checklist all merchandise.

9. For authentication, choose Authentication required.
10. For AWS Secrets and techniques Supervisor secret, select Create and add new secret and enter the shopper ID and shopper secret you saved earlier, and enter the callback URL the identical manner as you probably did for the Amazon Cognito host UI (https://<>.chat.qbusiness.<<area>>.on.aws/oauth/callback).
11. For Select a way to authorize Amazon Q Enterprise, select Create and use a brand new service function.
12. Select Create plugin.

The final step is to allow the chat orchestration function so Amazon Q Enterprise can choose the plugin robotically.

13. On the customized plugin particulars web page, select Admin controls and guardrails beneath Enhancements within the navigation pane.
14. Within the World controls part, select Edit.

15. Choose Permit Amazon Q Enterprise to robotically orchestrate chat queries throughout plugins and knowledge sources, then select Save.

Configure API Gateway, Lambda, and DynamoDB sources

Every thing associated to API Gateway, Lambda, and DynamoDB is already configured utilizing the CloudFormation template. Particulars can be found on the Outputs tab of the stack particulars web page. You may as well assessment the main points of the Lambda operate and DynamoDB desk on their respective service consoles. To learn the way the Lambda operate is uncovered as an API by means of API Gateway, assessment the main points on the API Gateway console.

Chat with Amazon Q Enterprise

Now you’re prepared to speak with Amazon Q Enterprise.

1. On the Amazon Q Enterprise console, navigate to your software.
2. Select the hyperlink for Deployed URL.
3. Authenticate utilizing IAM Identification Heart (that is to be sure you have entry to Amazon Q Enterprise Professional).

Now you can ask questions in pure language.

Within the following instance, we examine if Amazon Q Enterprise is ready to entry the info from the S3 bucket by asking “Listing all of the merchandise and their description in a desk.”

After the product descriptions can be found, begin chatting and ask questions like Are you able to create product <product identify> with identical description please?. Alternatively, you’ll be able to create a brand new product that isn’t listed within the pattern doc uploaded in Amazon S3. Amazon Q Enterprise will robotically decide the appropriate plugin (on this case, Merchandise).

Subsequent requests for API calls to undergo the customized plugin will ask you to authorize your entry. Select Authorize and authenticate with the person credentials created in Amazon Cognito earlier. After you’re authenticated, Amazon Q Enterprise will cache the session token for subsequent API calls and full the request.

You’ll be able to question on the merchandise which might be out there within the backend by asking questions like the next:

• Are you able to please checklist all of the merchandise?
• Delete a product by ID or by identify.
• Create a brand new product with the identify 'Gloves' and outline as 'Soccer gloves' with automated in-built cooling

Primarily based on the previous immediate, a product has been created within the merchandise desk in DynamoDB.

Price issues

The price of organising this resolution is predicated on the worth of the person AWS providers getting used. Costs of these providers can be found on the person service pages. The one obligatory price is the Amazon Q Enterprise Professional license. For extra info, see Amazon Q Enterprise pricing.

Clear up

Full the next steps to wash up your sources:

1. Delete the CloudFormation stack. For directions, confer with Deleting a stack on the AWS CloudFormation console.
2. Delete the Amazon Q Enterprise software.
3. Delete the Amazon Cognito person pool area.
4. Empty and delete the S3 bucket. For directions, confer with Deleting a normal goal bucket.

Conclusion

On this put up, we explored how Amazon Q Enterprise can seamlessly combine with enterprise techniques utilizing a customized plugin to assist enterprises unlock the worth of their knowledge. We walked you thru the method of organising the customized plugin, together with configuring the mandatory Amazon Cognito and authentication mechanisms.

With this practice plugin, organizations can empower their staff to work effectively, solutions shortly, speed up reporting, automate workflows, and improve collaboration. You’ll be able to ask Amazon Q Enterprise pure language questions and watch because it surfaces essentially the most related info out of your firm’s backend system and act on requests.

Don’t miss out on the transformative energy of generative AI and Amazon Q Enterprise. Join immediately and expertise the distinction that Amazon Q Enterprise could make in your group’s workflow automation and the effectivity it brings.

Concerning the Authors

Shubhankar Sumar is a Senior Options Architect at Amazon Internet Providers (AWS), working with enterprise software program and SaaS clients throughout the UK to assist architect safe, scalable, environment friendly, and cost-effective techniques. He’s an skilled software program engineer, having constructed many SaaS options powered by generative AI. Shubhankar makes a speciality of constructing multi-tenant techniques on the cloud. He additionally works intently with clients to deliver generative AI capabilities to their SaaS purposes.

Dr. Anil Giri is a Options Architect at Amazon Internet Providers. He works with enterprise software program and SaaS clients to assist them construct generative AI purposes and implement serverless architectures on AWS. His focus is on guiding shoppers to create progressive, scalable options utilizing cutting-edge cloud applied sciences.

Ankur Agarwal is a Principal Enterprise Architect at Amazon Internet Providers Skilled Providers. Ankur works with enterprise shoppers to assist them get essentially the most out of their funding in cloud computing. He advises on utilizing cloud-based purposes, knowledge, and AI applied sciences to ship most enterprise worth.