> For the complete documentation index, see [llms.txt](https://ai-security-docs.akto.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ai-security-docs.akto.io/akto-argus-agentic-ai-security-for-homegrown-ai/connectors/ai-agent-security/connect-akto-with-amazon-quick.md).

# Amazon Quick

## Overview

Amazon Quick Suite is an AWS-native agentic AI platform that lets employees query data, trigger workflows, and take actions across enterprise tools through natural language chat. Organizations use Amazon Quick to build and deploy AI-powered chat agents that connect to business systems like Jira, ServiceNow, Slack, and more.

The Akto Amazon Quick connector automatically:

* Discovers all Amazon Quick chat agents and action connectors in your environment
* Monitors chat conversations and agent interactions
* Sends activity data to Akto for security analysis and guardrail enforcement

## How It Works

Amazon Quick Suite records all agent and chat activity as logs. Akto reads these logs asynchronously, forwards them to Akto's Data Ingestion Service, and surfaces findings in your dashboard.

```mermaid
flowchart LR
    A[Amazon Quick] --> B[Activity Logs]
    B --> C[Akto Data\nIngestion Service]
    C --> D[Akto Dashboard]
```

{% hint style="info" %}
**Async mode** — Akto reads from Amazon Quick logs after the fact. There is an inherent delay between an event occurring in Amazon Quick and it appearing in Akto.
{% endhint %}

## What Data is Collected

| Category                     | What Akto Discovers                                                           |
| ---------------------------- | ----------------------------------------------------------------------------- |
| **Chat activity**            | User queries, agent responses, conversation sessions                          |
| **Action connector events**  | External service actions triggered from Quick (Jira, Slack, ServiceNow, etc.) |
| **Admin operations**         | Connector creation/deletion, permission and policy changes                    |
| **User & access management** | User additions, role changes, group membership updates                        |

## Steps to Connect

Reach out to the Akto support team via in-app intercom or using the contact links below. The team will provide the **CloudFormation Template (CFT)** and guide you through the full setup of the Amazon Quick connector in your AWS environment.

### IAM Permissions

The IAM policy below covers the permissions needed for the connector: enabling Quick's vended log delivery, managing the delivery source/destination, reading the delivered log objects from S3, writing execution logs, reading the Akto API key from Secrets Manager, and letting EventBridge invoke the forwarding function.

Replace the placeholders (`REGION`, `ACCOUNT_ID`, `CONVERSATION_BUCKET`, `LAMBDA_FUNCTION_NAME`, `AKTO_SECRET_ARN`) with your actual values.

```yaml
Version: "2012-10-17"

Statement:
  # -------------------------------------------------------------------------
  # 1. Enable Amazon Quick conversation logging
  # -------------------------------------------------------------------------
  - Sid: EnableQuickConversationLogging
    Effect: Allow
    Action:
      - quicksight:AllowVendedLogDeliveryForResource
    Resource:
      - arn:aws:quicksight:REGION:ACCOUNT_ID:account/ACCOUNT_ID

  - Sid: ManageQuickLogDelivery
    Effect: Allow
    Action:
      - logs:PutDeliverySource
      - logs:GetDeliverySource
      - logs:DeleteDeliverySource

      - logs:PutDeliveryDestination
      - logs:GetDeliveryDestination
      - logs:DeleteDeliveryDestination
      - logs:GetDeliveryDestinationPolicy
      - logs:PutDeliveryDestinationPolicy
      - logs:DeleteDeliveryDestinationPolicy

      - logs:CreateDelivery
      - logs:GetDelivery
      - logs:DeleteDelivery
      - logs:UpdateDeliveryConfiguration

      - logs:DescribeDeliverySources
      - logs:DescribeDeliveryDestinations
      - logs:DescribeDeliveries
      - logs:DescribeConfigurationTemplates

      - logs:TagResource
      - logs:UntagResource
      - logs:ListTagsForResource
    Resource: "*"

  # -------------------------------------------------------------------------
  # 2. Allow Lambda to discover and read Quick conversation files
  # -------------------------------------------------------------------------
  - Sid: ListQuickConversationObjects
    Effect: Allow
    Action:
      - s3:ListBucket
    Resource:
      - arn:aws:s3:::CONVERSATION_BUCKET
    Condition:
      StringLike:
        s3:prefix:
          - AWSLogs/ACCOUNT_ID
          - AWSLogs/ACCOUNT_ID/*

  - Sid: ReadQuickConversationObjects
    Effect: Allow
    Action:
      - s3:GetObject
    Resource:
      - arn:aws:s3:::CONVERSATION_BUCKET/AWSLogs/ACCOUNT_ID/*

  # -------------------------------------------------------------------------
  # 3. Allow Lambda to write its operational logs
  # -------------------------------------------------------------------------
  - Sid: CreateLambdaLogGroup
    Effect: Allow
    Action:
      - logs:CreateLogGroup
    Resource:
      - arn:aws:logs:REGION:ACCOUNT_ID:*

  - Sid: WriteLambdaLogs
    Effect: Allow
    Action:
      - logs:CreateLogStream
      - logs:PutLogEvents
    Resource:
      - arn:aws:logs:REGION:ACCOUNT_ID:log-group:/aws/lambda/LAMBDA_FUNCTION_NAME:*

  # -------------------------------------------------------------------------
  # 4. Allow Lambda to read the Akto API credential
  # -------------------------------------------------------------------------
  - Sid: ReadAktoApiCredential
    Effect: Allow
    Action:
      - secretsmanager:GetSecretValue
    Resource:
      - AKTO_SECRET_ARN

  # -------------------------------------------------------------------------
  # 5. Allow EventBridge Scheduler to invoke Lambda
  # -------------------------------------------------------------------------
  - Sid: InvokeQuickConversationLambda
    Effect: Allow
    Action:
      - lambda:InvokeFunction
    Resource:
      - arn:aws:lambda:REGION:ACCOUNT_ID:function:LAMBDA_FUNCTION_NAME
```

A quick breakdown of what each group is for:

1. **Enable Amazon Quick conversation logging**: lets you turn on vended log delivery for your Quick account, and manage the delivery source/destination through the CloudWatch Logs delivery APIs.
2. **Allow Lambda to discover and read Quick conversation files**: lets the Lambda list and read the delivered chat log objects in the destination S3 bucket, scoped to the `AWSLogs/ACCOUNT_ID/*` prefix.
3. **Allow Lambda to write its operational logs**: standard Lambda execution logging permissions.
4. **Allow Lambda to read the Akto API credential**: lets the Lambda pull the Akto API key out of Secrets Manager rather than hardcoding it.
5. **Allow EventBridge Scheduler to invoke Lambda**: lets the EventBridge schedule invoke the Lambda.

## Get Support for your Akto setup

There are multiple ways to request support from Akto. We are 24X7 available on the following:

1. In-app `intercom` support. Message us with your query on intercom in Akto dashboard and someone will reply.
2. Join our [discord channel](https://www.akto.io/community) for community support.
3. Email us at <support@akto.io> for direct help.
4. Contact us [here](https://www.akto.io/contact-us).