Amazon Q Developer Enterprise Security for Engineering Teams
Amazon Q Developer chats, writes code and runs agentic tasks for engineers who already hold AWS access. Its Pro tier adds admin controls on top of AWS identity. This page reads what AWS publishes, shows where each control stops, and says when a team needs a second one.
Direct answer
Amazon Q Developer enterprise security rests on AWS identity and access management, an admin dashboard on the Pro tier that manages users and policies through IAM Identity Center, data protection and compliance programs documented in the AWS user guide, and network options such as VPC endpoints through AWS PrivateLink. Those controls decide who can use Q Developer and how data is handled. They do not judge whether one agentic action, such as a command run or a change to cloud resources, should proceed, so high-impact actions need a separate approval step.
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
A platform team enables Amazon Q Developer Pro for three hundred engineers through IAM Identity Center. An engineer asks the agent to fix a failing deploy. It reads a pasted log that contains hostile text and proposes a command that widens a role policy. Sign-in was through the company identity provider and the subscription was managed. Nobody decided that this particular change was wrong.
How AgentShield handles it
Start with the Pro items for identity, the admin dashboard and the network options, because they cover who uses the tool and where traffic goes. Then route agent calls that reach systems of record through an AgentShield gateway. Rules check the arguments of each call, hold deploys, permission changes and bulk writes for a named approver, and write one attributed record of what was allowed, denied and approved.
The controls
The controls that secure which AWS resources, commands and code changes an Amazon Q Developer session may touch, and which wait for a named approver.
What AWS documents for Amazon Q Developer security
The honest summary is that AWS gives an Amazon Q Developer customer its standard cloud identity, network and compliance layer, and leaves the decision about each action the agent takes to the user and to your own tooling. The facts below come from the AWS Amazon Q Developer pricing page and user guide security chapter, read on November 10, 2026. Check the current pages and ask for written terms before you sign.
| Control | What the vendor pages say | Where it stops |
|---|---|---|
| Shared responsibility | The user guide frames security as AWS securing the cloud and you securing what you do in it | Your data sensitivity and agent permissions are your job |
| Identity and access | A security chapter covers identity and access management, and Pro uses IAM Identity Center | Controls who signs in, not what a signed-in session runs |
| Admin dashboard | The pricing page lists user and policy management for Pro, not for Free | Manages subscriptions and policies, not individual actions |
| Data handling | Pro is automatically opted out of data collection, and Free users can opt out | Covers service improvement, not what the agent does with your systems |
| Network | The guide documents VPC endpoints through AWS PrivateLink, plus firewall, proxy and data perimeter guidance | Where traffic travels, not which actions are allowed |
| Compliance | The guide points to AWS Services in Scope by Compliance Program | Check the specific programs listed for Q Developer yourself |
The pricing page lists Pro at $19 per user per month with IP indemnity and increased agentic request limits, and it does not state security scan limits. Ask for the audit record contents and the current compliance scope in writing.
Where Amazon Q Developer controls stop
None of these gaps is unique to Amazon. They are the normal shape of a control at the identity layer, where the decision is made before the agent reads the specific text that will steer it.
| Gap | Why it matters in a rollout |
|---|---|
| The agent acts with the permissions of the person or role behind it | An engineer with broad access hands that reach to every step the agent takes |
| Logs, tickets and code comments are untrusted input | The agent reads them to do the job, and so can an attacker who writes to them |
| Identity controls are per user, not per action | A wrongly scoped role change and a harmless read look the same at sign-in |
| Admin policy is not a decision record | An auditor asks who approved a production change, which a subscription list cannot show |
The same questions apply to the other agents your engineers may run, covered on Kiro security, Bedrock AgentCore security and the wider coding agents page.
Amazon Q Developer security checklist for US platform and security teams
- Choose Pro for any team that needs the admin dashboard, IAM Identity Center sign-in and policy management.
- Give engineers least privilege roles in the accounts where Q Developer runs, never an administrator role by default.
- Keep production accounts separate from the accounts where agents run commands.
- Use VPC endpoints and data perimeter policies where the guide describes them.
- Get the compliance scope and audit record contents in writing.
- Run a pilot, record which calls the agent actually makes, and write rules from that list.
Steps one to five cost administration time. Step six is the one that needs a mechanism, and it is where teams look for a second control.
Where a second control earns its place
An AgentShield gateway sits on the paths your agents use to reach systems of record, such as a deploy API, a ticket system, a database tool or a payment service. It does not replace AWS controls. It adds a decision on each action, outside the model and outside the IDE.
| Risk | AWS control | Second control |
|---|---|---|
| Wrong people use the tool | IAM Identity Center and the Pro dashboard | None needed. Use the plan |
| Traffic leaves the network path you want | VPC endpoints and data perimeters | None needed. Use the settings |
| Injected text triggers a permission change | Role scoping, if you set it up | Rule on the target and arguments, held for a named approver |
| Agent calls a billing, identity or deploy API | Scoped keys, if you set them up | Count and amount limits per run and per day, approval above them |
| Customer data leaves in a tool call | None documented | Content scan on outbound arguments |
| Proof for a customer security review | Account level logging you configure | One attributed record of allowed, denied and approved actions |
The gateway works for calls you route through it, such as internal APIs and tools reached through an MCP endpoint. It cannot see actions that never leave the IDE, so least privilege roles remain your control there. The enforcement mechanics are on tool permissions and the approval flow on human in the loop AI agents.
When to buy nothing, use AWS controls, or add AgentShield
| Your situation | What to do |
|---|---|
| A few engineers use Q Developer in a sandbox account | Buy nothing. Least privilege roles are enough |
| You need managed sign-in and policies for many engineers | Use Pro with IAM Identity Center |
| You need traffic kept on private paths | Use the VPC endpoint and perimeter settings |
| Agents call billing, identity, deploy or customer data tools | Add argument rules and approval on those calls |
| An auditor wants proof of who approved what | Add the gateway record |
Three of five rows end without a purchase from us. That is deliberate, because a control you do not need is not worth selling.
FAQ
Common questions about amazon q developer enterprise security.
Is Amazon Q Developer secure for enterprise use?
AWS documents identity and access management, data protection, compliance validation, VPC endpoints and data perimeter guidance for it, and Pro adds an admin dashboard with IAM Identity Center. Those cover identity and network paths. They do not decide whether one agentic action should run, so high-impact actions need a separate control.
How much does Amazon Q Developer Pro cost?
The AWS pricing page lists Pro at $19 per user per month, with increased agentic request limits, 4,000 pooled lines of Java transformation per user each month, an admin dashboard and IP indemnity. Confirm current terms with AWS before you sign, since rates can change.
Does Amazon Q Developer use my code to train models?
The pricing page says Pro users are automatically opted out of data collection and Free users can opt out. Confirm that in your contract and the current service terms rather than relying on a default, and check retention terms for chat history.
Can Amazon Q Developer be hijacked by prompt injection?
Any agent that reads logs, tickets, code comments or web pages can be steered by hostile text in them. Least privilege roles limit what it can reach, but an approved call can still be misused. Rules on tool call arguments, with approval for risky actions, limit the damage when the model is fooled.
Does Amazon Q Developer support single sign-on?
Yes on Pro, which the pricing page ties to IAM Identity Center for user and policy management. The Free tier works with an AWS Builder ID or IAM user. Sign-in controls who uses the tool, not what an approved session does afterward.
Does AgentShield work with Amazon Q Developer?
Yes, for tool and API calls routed through a gateway endpoint, such as internal APIs and MCP servers, where it checks the arguments of each call and holds risky ones for approval. It does not replace AWS controls and cannot see activity that stays inside the IDE.
More use cases