Amazon Q Business: Secure Data Access with Trusted Token Issuer

Amazon Q Business, launched in 2024, allows Independent Software Vendors (ISVs) to securely access customer enterprise data. A key enhancement is the Trusted Token Issuer (TTI) authorization, improving security for Software as a Service (SaaS) solutions. Previously, data accessors relied on AWS IAM Identity Center integration, requiring authorization code flow. TTI lets ISVs use their own OpenID Provider for authentication, eliminating double authentication while maintaining robust security. This simplifies identity integration by propagating user identity information into IAM role sessions, enabling AWS services to make authorization decisions based on the end user’s identity and group memberships. The process involves ISV registration, providing details like display name, logo, and OIDC configuration, including a unique tenantId for multi-tenant environments. Customers then add the ISV as a data accessor, granting access to their Amazon Q index. TTI authentication involves the customer setting up a trusted token issuer with the ISV’s OAuth information, creating a data accessor application, and the ISV implementing an authentication flow using the AssumeRole and CreateTokenWithIAM APIs. The ISV then accesses the customer’s index via the SearchRelevantContent API. The article details the advantages of TTI over the authorization code method, highlighting single authentication versus double authentication. It also guides ISVs through registration, providing steps for retrieving OIDC configuration details, and guides enterprises through enabling TTI-authenticated data accessors. Finally, the article explains how to clean up resources after use.

(Source: https://aws.amazon.com/blogs/machine-learning/authenticate-amazon-q-business-data-accessors-using-a-trusted-token-issuer/)