developer ↗

AWS's AI coding assistant (VS Code, JetBrains, Visual Studio, Eclipse, q chat CLI). Agentic mode runs in the IDE process with full developer privileges — no sandbox. The July 2025 wiper supply-chain attack (CVE-2025-8217) shipped a cleaner.md system prompt in v1.84.0 telling Q to rm -rf + delete AWS resources. Followed by AWS-2025-019 prompt-injection RCE in Aug 2025.

Version Pinning & Extension Provenance

The wiper shipped because users auto-updated to v1.84.0 within hours. Pin a known-good version, verify the publisher (AmazonWebServices), validate VSIX SHA-256 against the GHSA advisory before rollout.

Setting: VS Code extensions.autoUpdate: false + MDM-deployed VSIX; JetBrains "Manage Plugin Repositories" pinned to a vetted mirror.

Real incident Jul 2025 — threat actor merged a PR into aws/aws-toolkit-vscode via an over-scoped GitHub token; v1.84.0 shipped a wiper prompt instructing Q to rm -rf user homes and delete AWS resources. A syntax error stopped execution; AWS pulled the release after ~6 days on the Marketplace. BleepingComputer · The Register

Tip: subscribe to aws/aws-toolkit-vscode security advisories; stage releases through a canary ring for ≥72h before broad deployment.

Q Chat Panel Exposure

The chat panel auto-includes open editor tabs, workspace files referenced by @workspace, and (in agent mode) terminal output — any of which can carry indirect prompt-injection payloads. The cleaner.md file was loaded exactly this way.

Setting: amazonQ.workspaceIndex.enabled: false for repos containing untrusted contributor content.

Tip: disable Q in workspaces hosting third-party PRs, decompiled binaries, or scraped web data.

Authentication — IAM Identity Center, Not Builder ID

AWS Builder ID is a personal identity with no IAM mapping, no MFA enforcement, and a 90-day Q session. IAM Identity Center (SSO) gives permission sets, group-based subscription management, MFA, SCIM provisioning, and a usage dashboard.

Setting: IdC instance + AmazonQDeveloperAccess permission set; disable Builder ID sign-in via org SCP.

Tip: federate IdC to your IdP (Okta/Entra ID), require MFA, shorten the IdC session below the 90-day Q default.

Isolation — Assume No Sandbox

The extension runs inside the IDE process with the developer's UID, full home-dir access, and whatever AWS profile is selected. There is no container, no seccomp, no AppArmor.

Setting: run Q CLI inside a devcontainer / Firecracker microVM / bubblewrap jail; never as root.

Tip: for agent mode, use a dedicated low-privilege OS account and a project-scoped AWS profile, not your admin shell.

Tool / Action Allowlist

Agent mode exposes fs_read (trusted by default), fs_write, executeBash, plus AWS-CLI invocations. /tools trustall gives the model unconfirmed write and shell.

Setting: in Q CLI use /tools trust fs_read only; never trustall. Configure ~/.aws/amazonq/agent.json with explicit allowedCommands (e.g. git status, npm test) and deny rm, aws * delete*, curl, wget.

Tip: require HITL for every executeBash; ensure Language Server ≥ v1.24.0 (AWS-2025-019 fix that closed the find/grep HITL bypass).

Credential Handling

Q inherits the active AWS credential chain — environment vars, ~/.aws/credentials, SSO cache, IMDS on EC2 dev hosts. A compromised prompt can aws s3 cp or aws iam create-access-key with whatever role you've assumed.

Setting: named profiles per project (AWS_PROFILE=q-sandbox), short-lived SSO creds, IAM permission boundary capping the role to read-only + sandbox-account write.

Tip: never run Q with AdministratorAccess or your management-account credentials; rotate any access keys exposed during a Q session.

Custom Rules / Context (`.amazonq/` and Customizations)

Q reads project rules from .amazonq/rules/*.md and pulls private-codebase context from "Amazon Q Customizations" (admin-uploaded S3 indexes). Both are prompt-injection vectors.

Setting: treat .amazonq/ as code — require code-owner review, sign commits, CI-lint for suspicious directives (rm -rf, aws * delete, base64 blobs).

Tip: restrict Customizations admin to IdC group q-customization-admins; scope each customization to one team via resource-based policy.

Prompt Injection (Wiper as Canonical Example)

The wiper succeeded by getting Q to obey a cleaner.md smuggled into the source tree. The same class works via README files, dependency code, GitHub issues opened in the chat panel, web pages opened via tools, even error messages from executeBash.

Setting: combine #2 (don't include untrusted context), #5 (deny destructive shell), #6 (scoped creds), and content scanners on .md / docstring inputs.

Tip: add a CI check that fails the build if any file in .amazonq/, prompts/, or docs/ contains imperative-mood instructions to delete resources or exfiltrate data; treat any LLM-generated commit touching these paths as high-risk.

Updates — Auto-Update Off, MDM On

The wiper window was the auto-update window. Disable auto-update for the extension and the Q Language Server, mirror VSIXes internally, roll forward via MDM after a staging soak.

// VS Code settings.json
"extensions.autoUpdate": false,
"extensions.autoCheckUpdates": false

Tip: bind extension installs to an MDM-pushed extensions.json recommendation list with version pins; alert on any developer-installed deviation.

Audit — CloudTrail Data Events + Prompt Logging

Q Developer API calls (GenerateRecommendations, SendTelemetryEvent, customization access) are CloudTrail data events — not logged by default. Inline prompt content is hidden unless you opt in.

Setting: create an org trail with AWS::QDeveloper::* data events enabled, ship to a Log Archive account, enable Prompt Logging in the Q Developer console (admin-only, off by default).

Tip: alert in Security Hub / GuardDuty on q-developer principal performing iam:*, s3:DeleteObject, or cross-region *:Delete*; correlate with VS Code extension version telemetry. Disable training-data sharing — Free tier opt-in by default.

References & further reading