Amazon Quick Integration

Connect Amazon Quick (Quick Suite) to Capsule Security for visibility into your agents, flows, spaces, knowledge bases, action connectors, and the people who own and use them.

Capsule assumes a read-only IAM role in your AWS account and syncs your Quick resources in every region you select. Chat activity is read from Quick chat logs that you deliver to CloudWatch Logs.

• An Amazon Quick account. Inventory works for any edition the Capsule role can read. Chat activity requires Enterprise or Professional subscriptions, per AWS
• Agentic features enabled in each region you want to connect
• Your Quick identity region. Users and groups exist only there
• IAM permissions to deploy CloudFormation stacks (or AdministratorAccess)
• CloudTrail enabled, so Capsule can find agent owners, agents in preview, and deleted resources
• To capture activity: permission to deploy the chat logs CloudFormation stack in each region (Step 3)
• Access to the Capsule Security portal

1. Log in to the Capsule Security portal
2. Click Integrations in the left sidebar
3. Find the Amazon Quick card and click Set up Integration
4. Under Choose regions, select every AWS region where your team uses Amazon Quick, then click Continue

Capsule offers eight regions:

Capsule monitors each selected region as its own environment, named after the region code. AWS GovCloud is not supported.

Deploy the Capsule IAM role using the provided CloudFormation template.

1. Under Create the access role, click Open CloudFormation
2. In the AWS CloudFormation console, review the stack details. The role name defaults to CapsuleSecurityAmazonQuickAccessRole
3. Acknowledge IAM resource creation and click Create stack
4. When the status shows CREATE_COMPLETE, open the Outputs tab and copy RoleArn
5. Back in Capsule, click Continue

The template is published at:

https://capsule-security-us-east-1-public-demo.s3.us-east-1.amazonaws.com/cf-capsule-amazon-quick-integration/versions/1.0.yaml

The role is global, so you deploy the stack once for the account, not once per region.

The template grants read-only access only. It has no write, update, or delete permissions.

Capsule reads Quick activity from chat logs. Regions without delivery still inventory agents but show Activity requires chat log delivery. instead of chat activity. You can skip this step in the wizard and deploy it later. We recommend deploying it.

Things to know first:

• Delivery is per region. Deploy the stack once in every region you selected
• Logs are not retroactive. Capsule sees only conversations after delivery starts
• Each account-region supports one CHAT_LOGS delivery source
• Per AWS, chat logs require an Amazon Quick instance with Enterprise or Professional subscriptions. AWS does not document whether chats from other subscription types appear
• You pay CloudWatch Logs vended-log charges for the delivered logs. See CloudWatch pricing
• The role from Step 2 already has the CloudWatch Logs read permissions Capsule needs

1. In the wizard, under Turn on chat activity, click Open CloudFormation next to each region
2. Review the stack parameters. The stack name is capsule-amazon-quick-chat-logs
3. Acknowledge and click Create stack
4. When the status shows CREATE_COMPLETE, repeat for the next region

The stack creates:

Deleting the stack deletes the log group and the logs in it.

To deploy later, open the CloudFormation console in the region, click Create stack and choose With new resources, and use this template URL. Name the stack capsule-amazon-quick-chat-logs. Capsule discovers the delivery on its next sync.

https://capsule-security-us-east-1-public-demo.s3.us-east-1.amazonaws.com/cf-capsule-amazon-quick-chat-logs/versions/1.0.yaml

The person deploying the stack needs these permissions in each region:

• cloudformation:CreateStack and cloudformation:DescribeStacks
• logs:CreateLogGroup, logs:PutRetentionPolicy, logs:PutResourcePolicy
• logs:PutDeliverySource, logs:PutDeliveryDestination, logs:CreateDelivery
• quicksight:AllowVendedLogDeliveryForResource
• The matching delete, describe, and get actions to update or delete the stack

If a CHAT_LOGS delivery already exists in a region and its destination is a CloudWatch Logs log group, Capsule discovers it and you do not need the stack there. Deliveries to S3 or Firehose destinations are not read.

Capsule detects the delivery on its next sync and shows the state per region under Chat activity on the integration:

No message means chat logs are flowing.

Chat responses that fail outside a flow run are not recorded as separate events.

CloudTrail is used for owners, agents in preview, and deleted resources, not for activity.

1. Under Connect and verify, paste the Role ARN from Step 2
2. Click Verify access. Capsule assumes the role in each selected region and checks that your Quick account is reachable
3. When Capsule shows "Capsule can read Amazon Quick in every selected region.", click Save

If verification fails, Capsule shows Capsule could not verify access and lists each problem with its region. The message names the missing permission or the region problem. See Troubleshooting.

• The first sync may take several minutes
• View synced resources in Inventory
• Activity appears only in regions where you completed Step 3

The role created in Step 2 allows the following, on all resources:

1. Open CloudFormation / Stacks in your AWS account
2. Select the Capsule Amazon Quick stack
3. Click Update stack → Create a change set
4. Select Standard change set → Replace existing template
5. Provide the template URL from Step 2 (or the newer version URL Capsule gives you)
6. Click through Next, review the terms, and agree
7. Review the change set and click Execute change set

Users and groups can be read only from your Quick identity region. Capsule reads them once, from that region, and skips them in the others. If the error persists, include region X in the Quick regions you select and verify again.

The Quick account edition does not support the operation Capsule called. Check the account edition in the Amazon Quick console, or connect a different account.

The region does not have agentic features. Capsule skips the unsupported part for that region and continues. Remove the region from your selection if you do not use Quick there, or enable agentic features and sync again.

No chat log delivery exists for the region. Complete Step 3 in that region. Delivery is per region and not retroactive, so earlier conversations are not captured.

Delivery exists, but Capsule could not read the log group. Confirm the chat logs stack from Step 3 is still deployed and unmodified, and that the log group is in the same region as the delivery. The notice includes the error returned by AWS.

• Confirm the stack status is CREATE_COMPLETE
• Verify you copied the full ARN from the Outputs tab
• Check that the role and its policies have not been modified or deleted
• Check that no service control policy blocks sts:AssumeRole or quicksight:* in the region

• Verify agents exist in the selected regions
• Verify agentic features are enabled in those regions
• Agents shared with other users but not with the role may not appear. If an agent is missing, contact support
• Agents still in preview are found through CloudTrail. Without CloudTrail they are missed
• Allow several minutes for the initial sync

Owners come from CloudTrail Create* events. Resources created before CloudTrail was enabled, or longer ago than the CloudTrail event history retains, have no owner.

us-east-1, us-west-2, eu-west-1, eu-west-2, eu-central-1, ap-southeast-1, ap-southeast-2, ap-northeast-1. Flows are not available in ap-southeast-1.

For help with this integration, contact support.

For Amazon Quick issues:

• Amazon Quick Documentation
• AWS Support