How do I troubleshoot the "This application is not set up correctly. Please contact your admin for help." error in Amazon Q Business?

Short description

If your email address is missing or incorrect in your AWS IAM Identity Center profile, then you receive an error message. Amazon Q Business uses the email attribute to identify users and verify the user's subscription status. When you don't configure the email attribute, Amazon Q Business restricts access to the application.

User profiles that System for Cross-domain Identity Management (SCIM) synchronizes from an external identity provider (IdP) might incorrectly map the email attribute. Check that the email attribute maps to IAM Identity Center.

You might also receive the error message when you have an incomplete or inactive subscription. If you assigned a user to Amazon Q Business, then confirm that the user received the email invitation and verified the subscription.

If you didn't assign a user to an Amazon Q Business Lite or Pro subscription, then assign the user the required subscription.

Resolution

Note: To view and change Amazon Q Business user profiles, you must have sufficient permissions and access to IAM Identity Center. If you use Amazon Q Business in a member account, then contact your administrator to verify and change the user profile.

Verify the email attribute in IAM Identity Center

Complete the following steps:

1. Open the IAM Identity Center console.
2. In the navigation pane, choose Users, and then select the user.
3. Check the following in the email attribute:
   If the email is missing, then add a valid email address.
   If the email is incorrect, then update the email address.
4. Choose Save.
5. Log in to Amazon Q Business to test whether the email attribute successfully updated.

Note: If you use SCIM to synchronize your users, then check the IdP settings to make sure that the email attribute maps to IAM Identity Center.

Check subscription status

If the user receives a 404 ResourceNotFoundException error, then check that the user subscribed to Amazon Q Business. Confirm that the user received and verified the invitation email.

If you used IAM Identity Center to add the user, then complete the following steps:

1. Open the Amazon Q Business console.
2. In the navigation pane, choose Applications.
3. Select your application.
4. Under User access, choose Manage user access, and then choose Add groups and users.
5. Select your user.
6. Choose Assign, and then select either Q Business Lite or Pro.

Note: Subscription assignments can take up to 24 hours to take effect.

Verify IAM role permissions for Amazon Q Business

To start and manage conversations, you must have specific AWS Identity and Access Management (IAM) role permissions.

Check that the IAM role that's assigned to Amazon Q Business includes the following role policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "QBusinessConversationPermission",
      "Effect": "Allow",
      "Action": [
        "qbusiness:Chat",
        "qbusiness:ChatSync",
        "qbusiness:ListMessages",
        "qbusiness:ListConversations",
        "qbusiness:GetWebExperience",
        "qbusiness:GetApplication",
        "qbusiness:PutFeedback",
        "qbusiness:DeleteConversation"
      ],
      "Resource": "arn:aws:qbusiness:{{region}}:{{source_account}}:application/{{application_id}}"
    }
  ]
}

Check that the IAM role includes the following trust policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "QBusinessTrustPolicy",
      "Effect": "Allow",
      "Principal": {
        "Service": "application.qbusiness.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "{{source_account}}"
        },
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:qbusiness:{{region}}:{{source_account}}:application/{{application_id}}"
        }
      }
    }
  ]
}

If you still experience the issue, then contact AWS Support.

Include the following information in your request:

• Application ID
  Note: To locate your application ID, open the Amazon Q Business console. In the navigation pane, choose Applications, and then select your application. Under Application settings, find your application ID.
• AWS Region where you deploy Amazon Q Business
• IAM Identity Center group and user
• IAM role ARN
• Permission set at the organizational level
• HAR file that you create when you query Amazon Q Business.