Cognito Temp Credentials cannot access Q Business

Question

We have setup Q Business Application with IAM Identity Center and authenticating through Cognito User Pool & Identity Pool. When we create temporary credentials using username, password and identity pool and try and access Q Business Chat Method in JS SDK of client-qbusiness, it shows error as

"An error was encountered in a non-retryable streaming request.
AWS Q Business Error: AccessDeniedException: User is not authorized for this service call."

We have mapped the role with permissions as Q Business Full Access & STS Cognito Policies along with trust policies as below, please help me what am missing to make it work. Thanks.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "cognito-identity.amazonaws.com"
            },
            "Action": [
                "sts:AssumeRoleWithWebIdentity",
                "sts:TagSession"
            ],
            "Condition": {
                "StringEquals": {
                    "cognito-identity.amazonaws.com:aud": "us-east-1:f82cb590-f4d4-441d-9643-75c2a65a4b5d"
                },
                "ForAnyValue:StringLike": {
                    "cognito-identity.amazonaws.com:amr": "authenticated"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "qbusiness.amazonaws.com"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "cognito-identity.amazonaws.com:aud": "us-east-1:f82cb590-f4d4-441d-9643-75c2a65a4b5d"
                },
                "ForAnyValue:StringLike": {
                    "cognito-identity.amazonaws.com:amr": "authenticated"
                }
            }
        },
        {
            "Sid": "QBusinessTrustPolicy",
            "Effect": "Allow",
            "Principal": {
                "Service": "integrations.qbusiness.amazonaws.com"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:SetContext"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceAccount": "373612751264"
                },
                "ArnLike": {
                    "aws:SourceArn": "arn:aws:qbusiness:us-east-1:373612751264:application/f765527c-d33f-4342-81e1-5b3bb9d4c4c3"
                }
            }
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": "qbusiness.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

re:Post Agent · Answer

The issue you're experiencing with Amazon Q Business access using Cognito temporary credentials is likely due to the way identity propagation is handled for Q Business. Q Business requires a specific identity-aware session to authorize users, which is not directly compatible with the standard Cognito temporary credentials flow.

To resolve this, you need to implement trusted identity propagation for Q Business using AWS IAM Identity Center. This involves a few key steps:

1. Set up a trusted token issuer in IAM Identity Center, configuring it to work with your external identity provider (in this case, Cognito).

2. Create an IAM role with the necessary permissions for Q Business access, including a trust policy that allows Q Business to assume the role.

3. In your application, you'll need to exchange the Cognito ID token for an IAM Identity Center token, and then use that to assume the IAM role for Q Business access.

4. Use the temporary credentials from the assumed role to make Q Business API calls.

Your current setup is missing the crucial step of exchanging the Cognito token for an IAM Identity Center token before accessing Q Business. The trust policy you've provided includes some elements for Q Business, but it's not correctly configured for the trusted identity propagation flow.

To implement this, you'll need to:

1. Use the IAM Identity Center API to exchange the Cognito token for an IAM Identity Center token.
2. Use the IAM Identity Center token to assume the IAM role with Q Business permissions.
3. Use the temporary credentials from the assumed role to make Q Business API calls.

This process ensures that the user's identity is properly propagated to Q Business, allowing for correct authorization. You may need to update your application code to include these additional token exchange and role assumption steps before making Q Business API calls.

Additionally, ensure that your Q Business application in the AWS console is configured to use IAM Identity Center for authentication, and that the necessary IAM roles and policies are in place to allow this identity propagation flow.  
**Sources**  
[Configure Amazon Q Business with AWS IAM Identity Center trusted identity propagation | AWS Machine Learning Blog](https://aws.amazon.com/blogs/machine-learning/configuring-amazon-q-business-with-aws-iam-identity-center-trusted-identity-propagation/)  
[Implement secure API access to your Amazon Q Business applications with IAM federation user access management | AWS Machine Learning Blog](https://aws.amazon.com/blogs/machine-learning/implement-secure-api-access-to-your-amazon-q-business-applications-with-iam-federation-user-access-management/)

Cognito Temp Credentials cannot access Q Business

Add your answer

Relevant content