AccessDeniedException - ChatSync operation (IAM Identity Center)

The AccessDeniedException you're encountering with the ChatSync operation in Amazon Q Business is likely due to changes in how user identity is handled for API access. The solution involves implementing a more secure, identity-aware approach:

1. You can no longer directly specify the user ID in the chat-sync command. Instead, you need to use an identity-aware session.

2. To obtain an identity-aware session:

   • Get an idToken from your SSO Identity Provider (IdP)
   • Exchange this token for an identity-aware token from IAM Identity Center
   • Use the IAM Identity Center token to assume an IAM role, obtaining temporary identity-aware session credentials

3. Use these temporary credentials to call the chat-sync API without specifying a user ID, as the identity is now implicit in the session.

This new method, while more complex, provides a more secure solution by tightly coupling the user's identity to their API access. It prevents masquerading as other users, which was possible before with the --user-id parameter.

To implement this:

• Ensure your IdP is configured as a trusted token issuer in IAM Identity Center
• Set up the necessary IAM roles and policies
• Modify your application to handle the token exchange and credential assumption process

If you're still having issues after implementing these changes, verify that:

• The IAM role you're using has the necessary permissions for Amazon Q Business operations
• There are no conflicting Service Control Policies (SCPs) or organization-level policies
• The user exists in the identity source connected to IAM Identity Center

Remember that changes in IAM Identity Center can take a few minutes to propagate, so allow some time before retrying if you've recently made configuration changes.
Sources
Amazon Q Business chat-sync CLI command always failing | AWS re:Post
IAM role for an Amazon Q Business web experience using IAM Identity Center - Amazon Q Business

Please refer to this solution here: https://github.com/aws-samples/custom-web-experience-with-amazon-q-business