How do I use AWS Organizations and IAM Identity Center to manage my Amazon Q Developer Pro subscription?

Short description

Amazon Q Developer Pro requires an IAM Identity Center instance to subscribe users and groups. Use an organization instance of IAM Identity Center to manage and configure Amazon Q Developer Pro. Your choice of IAM Identity Center instance type is separate from where you subscribe users.

Resolution

Choose where to subscribe users

You can subscribe users in the management account, in a member account, or in a standalone account. You don't have to subscribe users in the management account to activate an organization instance.

Organization instance, subscribe users in member accounts

Activate IAM Identity Center in the management account, then create the Amazon Q Developer profile and the subscriptions in member accounts. For more information, see Subscribe users to Amazon Q Developer Pro in a member account.

You get the full organization instance feature set, and subscription management is distributed across member accounts, which is a best practice. This requires coordination across accounts. You can subscribe users in a maximum of 20 accounts per AWS Region within an organization.

Organization instance, subscribe users in the management account

Activate IAM Identity Center, create the Amazon Q Developer profile, and subscribe users, all in the management account. For more information, see Subscribe users to Amazon Q Developer Pro in a management account.

You manage all subscriptions from one account and get the full feature set. Because delegated administration isn't supported, management account administrators must handle every subscription task, so you can't follow the best practice of delegating those tasks to member accounts.

To allow these users to use their Pro subscription in the AWS Management Console and on AWS apps and websites while they're signed in to a member account, turn on profile sharing in the management account. When profile sharing is turned off, those users are subject to Free tier limits and features on those surfaces. Profile sharing doesn't affect Amazon Q in the IDE or on the command line.

Account instance in a member account

Activate IAM Identity Center in the member account itself, then create the profile and subscribe users there. For more information, see Subscribe users to Amazon Q Developer Pro in a member account.

Setup is quick and needs no organization-wide approval, which suits cases where you don't have a single identity provider that covers the users you want to subscribe. Account instances support fewer features than organization instances. They don't support permission sets, so users can't use their Pro subscription in the AWS Management Console or on AWS apps and websites.

Important: You can't convert or merge an account instance of IAM Identity Center into an organization instance. If you might later want organization-wide features, activate the organization instance in your management account from the start.

Note: If the same user is subscribed to Amazon Q Developer in multiple accounts within the same organization, you aren't double-billed. For more information, see Amazon Q Developer Pro subscription billing.

For a full comparison of the deployment patterns and instance types, see Step 1: Choose a deployment option and Organization and account instances of IAM Identity Center.

Activate an organization instance

Activate an organization instance from your Organizations management account.

When you use an organization instance, you have access to the following features across your organization:

• Shared Amazon Q Developer profile settings
• Prompt logging
• User activity reports

Note: Amazon Q Developer Pro subscription management doesn't support delegated administration. Administrators of the account where users are subscribed must perform subscription management tasks. This limitation is specific to Amazon Q Developer. An organization instance of IAM Identity Center does support a delegated administrator for IAM Identity Center itself.