4.2.5. The Amazon Q Family: Business and Developer
💡 First Principle: Amazon Q is AWS's family of managed generative AI assistants — you bring the data and the identity, AWS runs the model and the retrieval. Q Business targets enterprise knowledge work; Q Developer targets the software lifecycle. The exam tests which member fits a scenario and how each respects enterprise identity and permissions.
The Amazon Q family at a glance:
| Member | Purpose | Key capabilities |
|---|---|---|
| Amazon Q Business | Enterprise knowledge assistant | Connectors to SharePoint, Confluence, S3, Salesforce, and more; answers honor source ACLs; plugins trigger actions in external apps |
| Amazon Q Developer | Software development assistant | In-IDE code generation and explanation; code transformation (for example Java 8 to Java 17); customizations on private repos; AWS console troubleshooting |
| Amazon Q in QuickSight | Natural-language BI | Build and query dashboards in natural language |
Amazon Q Business — identity and access:
- Connects to enterprise data sources and honors each document's existing access controls, so a user sees only content their permissions already allow. It integrates with IAM Identity Center for user identity and group membership.
- Plugins let users trigger actions in external systems such as a ticketing tool. An administrator scopes who may run which plugin actions through Identity Center groups — never by sharing one set of credentials.
- Q Business retrieves from indexed content; it does not train a new foundation model on customer documents by default.
Amazon Q Developer — the software lifecycle:
- Works inside the IDE (VS Code, JetBrains) to generate, explain, and refactor code, and troubleshoots errors in the AWS console.
- Code transformation automates large language-version upgrades such as Java 8 to Java 17, updating dependencies and constructs across the codebase.
- Customizations index an organization's private code repositories so suggestions follow internal libraries and patterns, with access scoped through IAM Identity Center. This is the governed alternative to pasting internal code into prompts.
⚠️ Exam Trap: Don't confuse the two. Answering employee questions from SharePoint or Confluence with per-user permissions points to Q Business. Upgrading a legacy codebase or tailoring code suggestions to internal repos points to Q Developer. A base Bedrock model has no connection to enterprise content or its permission model, so it cannot enforce per-user access on its own.
Reflection Question: An enterprise wants employees to query internal wikis and ticketing data through a chat assistant, seeing only what their role permits, and separately wants developers to upgrade a Java 8 service to Java 17. Which Amazon Q members address each need, and how is per-user access enforced in the first case?
