AccessDeniedException when calling ChatSync API in Amazon Q App using Google-based IAM Identity Center Auth

Hi, I'm setting up a Q Business application using IAM Identity Center (with Google as the IdP via SSO). I'm trying to call the chat_sync API using temporary credentials assumed via assume_role_with_web_identity, and while the list_applications API works correctly the and chat_sync API call fails with:

botocore.errorfactory.AccessDeniedException: An error occurred (AccessDeniedException) when calling the ChatSync operation: User is not authorized for this service call.

I can access the Q app using web UI successfully without any issues.

Here’s what I’ve implemented:

I assume an IAM role using a Google ID token:

import boto3

def assume_role_with_google_token(google_id_token, role_arn, session_name="google-session"):
    sts_client = boto3.client("sts")

    response = sts_client.assume_role_with_web_identity(
        RoleArn=role_arn,
        RoleSessionName=session_name,
        WebIdentityToken=google_id_token,
        DurationSeconds=3600
    )

    credentials = response['Credentials']
    return {
        "access_key": credentials["AccessKeyId"],
        "secret_key": credentials["SecretAccessKey"],
        "session_token": credentials["SessionToken"],
    }

def call_amazon_q(temp_creds, question):
    client = boto3.client(
        "qbusiness",
        region_name="us-east-1",
        aws_access_key_id=temp_creds["access_key"],
        aws_secret_access_key=temp_creds["secret_key"],
        aws_session_token=temp_creds["session_token"]
    )

    print(client.list_applications())
    response = client.chat_sync(
        applicationId="abc",
        userMessage = question
        )

    return response

print("Hi")



aws_creds = assume_role_with_google_token(your_id_token, role_arn)
print(aws_creds)
message = "What is posh policy"
response = call_amazon_q(aws_creds, message)

IAM policy attached to the role:

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "qbusiness:ListApplications",
        "qbusiness:ChatSync"
      ],
      "Resource": "*"
    }
  ]
}

Questions:

1. Is chat_sync compatible with temporary credentials assumed via assume_role_with_web_identity?
2. Does ChatSync require the user identity to be explicitly added to the Amazon Q app (even for identity center users)?
3. Are there any additional conditions or trust policies required for the assumed role when using chat_sync?
4. Should the applicationId be configured to allow access for federated users explicitly?
5. Do I need to use a different principal or session configuration when working with Google SSO tokens?
6. Can this API be used programmatically for users who have never accessed the Q app through the console?
7. Is there a difference in behavior for chat_sync between identity-based users and identity center-based users?
8. Any diagnostics/logs I can check in AWS to trace the reason for the AccessDeniedException?

Appreciate any insights or examples from those who've successfully integrated Amazon Q with federated identities. Thanks!