Amazon Q Developer

Get your External ID

On app.software.com, go to Settings > Connected Apps > Amazon Q Developer and copy the External ID.

Create an IAM policy

In your AWS account, create an IAM policy that grants read access to your Amazon Q S3 bucket.

1. Go to IAM > Policies > Create policy.
2. Select the JSON tab and paste the following, replacing YOUR_BUCKET_NAME (e.g. q-developer-data) with your bucket name. If you are using the Identity Store permission, replace YOUR_ACCOUNT_ID with your 12-digit AWS account ID and YOUR_IDENTITY_STORE_ID with your identity store ID (for example d-xxxxxxxxxx). You can find the identity store ID under IAM Identity Center > Settings.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR_BUCKET_NAME",
        "arn:aws:s3:::YOUR_BUCKET_NAME/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "identitystore:ListUsers"
      ],
      "Resource": "arn:aws:identitystore::YOUR_ACCOUNT_ID:identitystore/YOUR_IDENTITY_STORE_ID"
    }
  ]
}

3. Name the policy (e.g., Antenna-AmazonQ-ReadOnly) and create it.

Create an IAM role

Create an IAM role that allows Antenna to read from your S3 bucket. The trust policy below grants access to arn:aws:iam::134217665810:role/software-app-prod, which is the IAM role managed by Antenna.

1. Go to IAM > Roles > Create role.
2. Select Custom trust policy and paste the following, replacing YOUR_EXTERNAL_ID with the value from Step 1:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::134217665810:role/software-app-prod"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "YOUR_EXTERNAL_ID"
        }
      }
    }
  ]
}

3. Click Next and attach the policy you created in the Create an IAM policy step.
4. Name the role (e.g., Antenna-AmazonQ-Role) and create it.
5. Copy the Role ARN from the role summary page.

Create the user directory

Amazon Q usage data identifies users by UUID only — it does not include email addresses. You need to upload a CSV that maps each UserId to an Email and/or DisplayName so Antenna can match Amazon Q users to your team members.

Create a CSV file with the following format:

UserId,DisplayName,Email
"a1b2c3d4-e5f6-7890-abcd-ef1234567890","Jane Doe","jane@example.com"
"b2c3d4e5-f6a7-8901-bcde-f12345678901","John Jay","john@example.com"

You can find both fields in AWS IAM Identity Center (formerly AWS SSO). Use the AWS CLI to list all users:

aws identitystore list-users --identity-store-id YOUR_IDENTITY_STORE_ID

This will return a paginated response. Each user in the response includes a UserId, DisplayName, and their Emails. Upload the finished CSV to a directory in your S3 bucket (e.g., user-directory/).

Here is an example script to extract users from the JSON into a CSV:

#!/bin/bash
 
# Prompt for Identity Store ID
read -p "Enter your Identity Store ID (e.g., d-1234567890): " IDENTITY_STORE_ID
 
# Basic validation to ensure ID is provided
if [ -z "$IDENTITY_STORE_ID" ]; then
    echo "Error: Identity Store ID cannot be empty."
    exit 1
fi
 
OUTPUT_FILE="identity_store_users.csv"
 
# Write the CSV header
echo "UserId,DisplayName,Email" > "$OUTPUT_FILE"
 
echo "Starting export from Identity Store: $IDENTITY_STORE_ID..."
 
NEXT_TOKEN=""
while : ; do
    # Fetch a page of users. We use JSON output for easier parsing with jq.
    if [ -z "$NEXT_TOKEN" ]; then
        RESPONSE=$(aws identitystore list-users --identity-store-id "$IDENTITY_STORE_ID" --output json)
    else
        RESPONSE=$(aws identitystore list-users --identity-store-id "$IDENTITY_STORE_ID" --starting-token "$NEXT_TOKEN" --output json)
    fi
 
    # Parse and append data
    # The jq filter finds the email where .Primary is true, falls back to the first email, or returns empty.
    echo "$RESPONSE" | jq -r '.Users[] | [
        .UserId,
        .DisplayName // "",
        (.Emails[]? | select(.Primary == true).Value // .Value) // ""
    ] | @csv' >> "$OUTPUT_FILE"
 
    # Check for a NextToken to determine if more pages exist
    NEXT_TOKEN=$(echo "$RESPONSE" | jq -r '.NextToken // empty')
 
    # Exit loop if no more tokens are returned
    if [[ -z "$NEXT_TOKEN" ]]; then
        break
    fi
done
 
echo "Export complete! Data saved to $OUTPUT_FILE"

Add the connection

Back on app.software.com, go to Settings > Connected Apps > Amazon Q Developer and enter:

• Role ARN — The ARN of the IAM role you created
• S3 bucket region — The AWS region of your S3 bucket
• Bucket Name — Your S3 bucket name
• Usage metrics directory — The directory that contains the AWSLogs folder. For example, if your metrics are at s3://q-developer-data/q-developer-user-data/AWSLogs, enter q-developer-user-data.
• Identity Store ID - Your Identity Center Identity Store ID (optional)
• Identity Store region — The AWS region of your Identity Store (optional)
• User directory — The directory that contains your user directory CSV. For example, if your file is at s3://q-developer-data/user-directory/user-directory.csv, enter user-directory.

Click Connect to finish.