CLOUD SERVICE · AWS

Amazon Q Business - Amazon Q Business is an AWS-managed generative AI assistant for answering workplace questions using enterprise content and configured business integrations.

Amazon Q Business connects enterprise information sources to an AI assistant that retrieves relevant content, generates answers, and respects configured user access permissions. Since June 30, 2026, the service has been in maintenance and closed to new customers; existing customers can continue using it.

Cloud Services Hub →

What is Amazon Q Business

Read the extensive description

Amazon Q Business provides a managed conversational interface for finding and summarizing information across enterprise repositories. Organizations configure an application, connect supported information sources, and provide authenticated users with access through a web experience or an integrated application. Its primary purpose is to answer business questions using organizational content rather than act as a general-purpose model hosting platform.

A typical deployment includes an application, a retriever, an index or supported external retrieval configuration, and one or more data sources. Connectors ingest documents and associated metadata from repositories such as Amazon S3, SharePoint, Confluence, and Salesforce. Connector capabilities differ by source, including supported content types, authentication methods, synchronization options, and access-control handling. Engineers should validate these differences before assuming that every repository behaves identically.

During a conversation, the service retrieves relevant material and uses it to construct a response. Answers can include citations that let users inspect supporting documents. Follow-up questions maintain conversational context, and users can work with uploaded files where the experience and subscription support that capability. Retrieval reduces the need to copy enterprise knowledge into model prompts manually, but generated answers still require validation for consequential decisions.

Identity and authorization are central to the architecture. Deployments can use AWS IAM Identity Center to associate users with the application and subscriptions. When document access controls are ingested and identity mappings are configured correctly, retrieval can filter results according to the requesting user's permissions. Administrators should test representative users and groups, including users who must not see restricted documents. Missing permissions, stale group membership, and incorrect principal mappings can undermine the intended security behavior.

Operational work includes maintaining connector credentials, scheduling synchronization, investigating ingestion failures, and managing index capacity. Content freshness depends on successful synchronization with source repositories; changing a document in its original system does not necessarily make the change immediately available in answers. CloudWatch metrics and logs, together with CloudTrail records for supported API activity, help engineers troubleshoot ingestion and administrative changes.

Application controls allow administrators to shape assistant behavior, including how responses use enterprise information and how selected topics are handled. Supported plugins can let users perform business actions through connected systems, but each action requires appropriate authentication, authorization, and testing. Treat action integrations separately from read-only retrieval because their failure modes include unintended changes to external records.

Existing deployments should track user subscription assignments, index capacity, connector health, source permissions, and dependencies on application APIs. Before changing an established deployment, inventory its repositories, identity mappings, response controls, and action integrations so that its operational requirements remain explicit.

Amazon Q Business has been in maintenance since June 30, 2026, and has been closed to new customers since that date; existing customers can continue using it. For availability changes and migration guidance, see AWS's migration guide.

Key Amazon Q Business Features

Enterprise-grounded conversational answers

Retrieves relevant organizational content to answer natural-language questions and follow-up requests. Citations help users inspect the documents supporting an answer.

Managed repository connectors

Connects to supported enterprise repositories and synchronizes documents and metadata into the retrieval system. Engineers configure source credentials, synchronization schedules, and connector-specific ingestion settings.

Permission-aware retrieval

Uses supported document access-control information and user identity mappings to filter retrieval results. Validate connector ACL support and group mappings with both authorized and unauthorized test users.

Managed indexing and retrieval

Provides managed index options and supports retrieval configurations using an existing Amazon Kendra index. Capacity planning should account for document volume, extracted text, and query demand rather than only source storage size.

Web experience and application APIs

Offers a managed web experience and APIs for incorporating assistant interactions into existing applications. Custom integrations must preserve the correct end-user identity and authorization context.

Administrative response controls

Lets administrators configure application-level response behavior and controls for selected topics. Test these controls against representative prompts rather than treating them as a substitute for source permissions.

Business action plugins

Supports configured plugins for taking actions in connected business systems. Apply least-privilege credentials and test action parameters and confirmation flows before enabling write operations.

File-based conversations

Supports asking questions about uploaded files where enabled and supported by the subscription. Establish rules for sensitive uploads and distinguish temporary conversational material from centrally synchronized repository content.

Amazon Q Business Use Cases

Internal knowledge discovery

Employees ask questions across policies, technical documentation, and operational procedures without searching each repository separately. Citations provide a route back to authoritative source material.

IT and employee support

An existing assistant can answer questions about approved troubleshooting procedures, onboarding tasks, and workplace policies. Keep source articles current and route unresolved or sensitive requests to established support processes.

Sales and account preparation

Authorized users can summarize product documentation, account material, and approved sales content from connected repositories. Repository permissions must prevent access to accounts or commercial documents outside the user's responsibilities.

Operational procedure assistance

Engineers can retrieve runbooks, summarize incident documentation, and locate relevant service procedures. Validate generated instructions against cited runbooks before performing production changes.

Document review and summarization

Users can summarize supported documents, extract key points, and ask follow-up questions about their contents. Human review remains necessary for legal, financial, compliance, and other consequential interpretations.

Amazon Q Business pricing models

Amazon Q Business Lite subscriptions

The published Lite model charges per subscribed user per month for core assistant capabilities. Subscription costs are separate from applicable index capacity and connected-service charges.

Amazon Q Business Pro subscriptions

The published Pro model charges a higher per-user monthly subscription for expanded capabilities, including access to features such as Amazon Q Apps. Confirm feature entitlements and billing terms for the existing deployment before changing assignments.

Index capacity charges

Amazon Q Business native indexes use separately billed capacity, with Starter and Enterprise index options. Provisioned capacity and operating time affect cost; deployments using an Amazon Kendra retriever must account for Kendra charges instead.

Supporting AWS service charges

Connected resources can incur their own charges, including S3 requests and storage, Secrets Manager secrets, CloudWatch logs, and applicable data transfer. Include these costs when estimating the operating expense of an existing application.

Services Amazon Q Business integrates with

A common existing architecture combines an Amazon Q Business application with workforce authentication through IAM Identity Center, a managed retrieval configuration, and connectors to enterprise repositories. Amazon S3 can hold curated documents, while supported external-system connectors obtain credentials from Secrets Manager. Each connector needs narrowly scoped permissions, an explicit synchronization schedule, and a tested method for mapping repository principals to application users.Organizations with an established Amazon Kendra index can use a supported Kendra retriever configuration rather than maintain a separate native index for the same content. This requires checking index compatibility and preserving user-context filtering. Regardless of retrieval architecture, test restricted documents with multiple identities and confirm how quickly content and permission changes propagate.Operational monitoring typically combines CloudWatch metrics and synchronization logs with CloudTrail records for supported administrative API activity. For example, an ingestion failure following credential rotation can be investigated by correlating connector errors with configuration changes. Maintain separate controls for document ingestion, user subscriptions, and action plugins so that troubleshooting or granting application access does not unintentionally broaden source access.

Amazon Kendra

An Amazon Q Business application can use a supported existing Amazon Kendra index through a Kendra retriever configuration. For example, an organization already indexing internal documentation in Kendra can use that retrieval infrastructure for its assistant. Verify index compatibility, regional requirements, IAM permissions, and user-context handling before connecting the application.

Open Amazon Kendra →

AWS CloudTrail

CloudTrail records supported Amazon Q Business API activity for auditing and investigation. For example, an administrator can investigate who changed an application or data-source configuration. Use these records alongside operational logs; API audit history is not a substitute for document-access testing or a complete transcript of assistant conversations.

Open AWS CloudTrail →

Amazon CloudWatch

CloudWatch provides operational metrics and supported connector synchronization logs. For example, engineers can investigate a failed synchronization by checking ingestion error details and correlating them with a credentials change. Configure log retention and access controls because diagnostic records can contain repository identifiers and other operational metadata.

Open Amazon CloudWatch →

AWS Secrets Manager

Supported connectors use Secrets Manager to store authentication details for external repositories. For example, a connector can reference a secret containing credentials required to synchronize a business content system. Scope access to the relevant secret and coordinate credential rotation with connector authentication requirements.

Open AWS Secrets Manager →

Amazon S3

The Amazon S3 connector ingests supported documents from a configured bucket or prefix. For example, an existing application can synchronize approved engineering runbooks stored under a documentation prefix. Configure the connector role, encryption permissions, and supported metadata or ACL files explicitly rather than assuming S3 object access automatically represents end-user document permissions.

Open Amazon S3 →