Amazon Quick Suite Security: Quick Suite Agents, Action Connectors, MCP and Q Business Migration Controls

If you are securing Amazon Quick Suite because a Q Business migration landed on your desk, start here, because the controls do not move with the data. AWS stopped accepting new Q Business customers on July 30, 2026. Its availability page says AWS "will continue to provide bug fixes and security updates for existing customers, however new feature requests will no longer be considered," and it recommends that customers migrate their Q Business applications to Amazon Quick, which it calls "the next evolution of Amazon Q Business."

The fastest path is BYOI, which connects an existing Q Business index to Quick as a knowledge base. It is genuinely convenient. It also leaves several things behind, and AWS lists them itself.

Two rows deserve a second read. The access row is a security event dressed up as a migration step: in a non-IDC deployment, every Quick user automatically receives access to connected Q Business indexes, so a document that three people could retrieve last month may now be retrievable by everyone on the account. AWS's workaround is manual scripting to recreate group mappings at the knowledge base level. Our RAG security page covers why the retrieval boundary is the first thing to re-verify after a change like this.

The guardrails row matters because AWS's own validation advice is that "guardrails configured in Q Business will not apply through BYOI, so verify that Quick's native content governance meets your requirements." The migration guide also lists MCP constraints worth knowing before you route actions through it: a fixed 60-second timeout, static tool lists that require deleting and recreating the integration to pick up server changes, and no support for step-up authorization. That last one means you cannot ask a user to re-authenticate before a sensitive MCP call inside Quick itself. If that control matters, it has to live on the server side of the call.

Quick ships more governance than most agent platforms, and a security team should configure all of it before buying anything. The table below is drawn from the Quick user guide pages on AI and agent security, guardrails, action authentication, approval workflows and logging, checked September 27, 2026. The right-hand column is the limit AWS itself documents.

Read the guardrails row carefully, because it is where indirect prompt injection lives. Screening user requests catches someone typing an attack into chat. It does not describe a check on the email, ticket or document a flow reads halfway through a run, which is where an attacker actually plants instructions. AWS's own summary is honest about this: "No single layer is designed to catch every risk on its own." Our prompt injection protection inspects what comes back from a tool before the agent acts on it.

On write actions, an AWS moderator on the Quick community forum stated in July 2026 that write actions such as sending an email pause for manual approval by default, and users can turn that off with a run-with-no-confirmation setting. That is a sensible default for interactive use. It is not the same as a policy that holds a specific kind of change for a named approver, on a scheduled agent, with a deny if nobody answers. The human approval gates for AI agents page explains the difference in design.

Data residency deserves one line for regulated US buyers. Quick stores data in your primary Region, but AWS notes that with cross-Region inference "your input prompts and output results might move outside of that Region," that "You can't configure it," and that CloudWatch and CloudTrail logs do not record which Region handled the inference. Agentic features currently run in seven commercial Regions, including US East (N. Virginia) and US West (Oregon), plus GovCloud (US-West).

Amazon Quick is priced per user per month, with an account-level infrastructure fee on the business plans, and none of the tiers includes per-call enforcement on the systems your agents write to. These are AWS's published list prices in USD, checked on the Amazon Quick pricing page on September 27, 2026. Platform pricing changes, so confirm before you budget.

The Enterprise column is the one to read. The features that create the most risk (configuring action connectors, adding MCP servers, running always-on agents) and the features that govern them (custom permissions, approval workflows) sit on the same tier. That is reasonable packaging. It also means the budget conversation about Quick is usually a conversation about Enterprise, and the security review should happen before those seats are bought rather than after.

Storage overage is 5 USD per GB per month on every plan, and AWS offers a 30-day trial for up to 25 users. For comparison with the Microsoft side of the same decision, our Microsoft 365 Copilot security page lists what that platform charges and governs.

AgentShield sits in front of the remote MCP servers and HTTP endpoints your Quick agents and flows call, and it does not sit inside Quick or between Quick and AWS-managed connectors. That boundary is the whole answer, so here it is by need.

Three of those seven rows say buy nothing or nearly nothing, and we mean it. If your Quick rollout is chat and research over well-permissioned knowledge bases, configure AWS's controls properly and you are covered. The case for a runtime layer starts when a flow or an always-on agent can write to a system of record through a service account, because from that point the most consequential actions happen on infrastructure AWS explicitly leaves to you. The same pattern holds on Bedrock AgentCore, where AWS draws a similar line for non-harness deployments.

Setup is a change to where the MCP or HTTP connection points. You register the MCP server behind the AgentShield MCP gateway, write policy per tool (for example, allow ticket reads for anyone, allow updates only on tickets assigned to the invoking user, hold any bulk close or refund for approval), and the Quick integration keeps working. Because AWS does not refresh MCP tool lists after registration, a new tool on your server also needs a policy decision before Quick can ever call it, which is a useful habit rather than a burden.