# Amazon Quick Integration

Connect Amazon Quick (Quick Suite) to Capsule Security for visibility into your agents, flows, spaces, knowledge bases, action connectors, and the people who own and use them.

## Overview

Capsule assumes a read-only IAM role in your AWS account and syncs your Quick resources in every region you select. Chat activity is read from Quick chat logs that you deliver to CloudWatch Logs.

| Category | What Gets Captured |
|  --- | --- |
| **Agents** | Quick agents, including agents still in preview, with configuration and permissions |
| **Flows** | Flow definitions and permissions |
| **Spaces** | Spaces and the resources they contain |
| **Knowledge Bases** | Knowledge bases and their permissions |
| **Action Connectors** | Connectors agents use to call external systems. Connectors that look like MCP servers are detected as such |
| **Users and Groups** | Quick users, groups, and memberships, read from your identity region |
| **Owners** | The user who created each agent, flow, and action connector, taken from CloudTrail |
| **Activity** (optional) | Messages, tool calls, flow runs, knowledge retrieval, and errors, read from chat logs you deliver to CloudWatch |


## Prerequisites

- An **Amazon Quick** account. Inventory works for any edition the Capsule role can read. Chat activity requires **Enterprise or Professional** subscriptions, per AWS
- **Agentic features** enabled in each region you want to connect
- Your Quick **identity region**. Users and groups exist only there
- **IAM permissions** to deploy CloudFormation stacks (or `AdministratorAccess`)
- **CloudTrail** enabled, so Capsule can find agent owners, agents in preview, and deleted resources
- To capture activity: permission to deploy the chat logs CloudFormation stack in each region (Step 3)
- Access to the **Capsule Security** portal


## Step 1: Choose Regions

1. Log in to the **Capsule Security** portal
2. Click **Integrations** in the left sidebar
3. Find the **Amazon Quick** card and click **Set up Integration**
4. Under **Choose regions**, select every AWS region where your team uses Amazon Quick, then click **Continue**


Capsule offers eight regions:

| Region |
|  --- |
| US East (N. Virginia) `us-east-1` |
| US West (Oregon) `us-west-2` |
| Europe (Ireland) `eu-west-1` |
| Europe (London) `eu-west-2` |
| Europe (Frankfurt) `eu-central-1` |
| Asia Pacific (Singapore) `ap-southeast-1` |
| Asia Pacific (Sydney) `ap-southeast-2` |
| Asia Pacific (Tokyo) `ap-northeast-1` |


Capsule monitors each selected region as its own environment, named after the region code. AWS GovCloud is not supported.

## Step 2: Create the Access Role

Deploy the Capsule IAM role using the provided CloudFormation template.

1. Under **Create the access role**, click **Open CloudFormation**
2. In the AWS CloudFormation console, review the stack details. The role name defaults to `CapsuleSecurityAmazonQuickAccessRole`
3. Acknowledge IAM resource creation and click **Create stack**
4. When the status shows **CREATE_COMPLETE**, open the **Outputs** tab and copy **RoleArn**
5. Back in Capsule, click **Continue**


The template is published at:

```
https://capsule-security-us-east-1-public-demo.s3.us-east-1.amazonaws.com/cf-capsule-amazon-quick-integration/versions/1.0.yaml
```

The role is global, so you deploy the stack once for the account, not once per region.

### What gets deployed

| Resource | Purpose |
|  --- | --- |
| IAM Role | `CapsuleSecurityAmazonQuickAccessRole`, assumed by Capsule for read-only access |
| Trust Policy | Allows only Capsule's hub role, and only with the External Id generated for your tenant |
| Inventory policy | Read-only Quick, user, and region discovery permissions |
| Activity policy | Read-only CloudTrail lookup and CloudWatch Logs access for chat logs |


The template grants read-only access only. It has no write, update, or delete permissions.

## Step 3: Deliver Chat Logs to CloudWatch Logs (optional)

Capsule reads Quick activity from chat logs. Regions without delivery still inventory agents but show **Activity requires chat log delivery.** instead of chat activity. You can skip this step in the wizard and deploy it later. We recommend deploying it.

Things to know first:

- Delivery is **per region**. Deploy the stack once in every region you selected
- Logs are **not retroactive**. Capsule sees only conversations after delivery starts
- Each account-region supports one `CHAT_LOGS` delivery source
- Per AWS, chat logs require an Amazon Quick instance with **Enterprise or Professional** subscriptions. AWS does not document whether chats from other subscription types appear
- You pay CloudWatch Logs vended-log charges for the delivered logs. See [CloudWatch pricing](https://aws.amazon.com/cloudwatch/pricing/)
- The role from Step 2 already has the CloudWatch Logs read permissions Capsule needs


### Deploy the chat logs stack

1. In the wizard, under **Turn on chat activity**, click **Open CloudFormation** next to each region
2. Review the stack parameters. The stack name is `capsule-amazon-quick-chat-logs`
3. Acknowledge and click **Create stack**
4. When the status shows **CREATE_COMPLETE**, repeat for the next region


| Parameter | Default | Notes |
|  --- | --- | --- |
| `RetentionInDays` | `30` | Keep at 7 or more. Capsule reads up to 7 days back |
| `KmsKeyArn` | empty | Optional. KMS key to encrypt the log group |


The stack creates:

| Resource | Purpose |
|  --- | --- |
| Log group | `/aws/vendedlogs/capsule-security/amazon-quick-chat-logs` |
| `CHAT_LOGS` delivery source | Chat logs for your Quick account in that region |
| CloudWatch Logs destination | Points the delivery at the log group |
| Delivery | Connects the source to the destination |


Deleting the stack deletes the log group and the logs in it.

To deploy later, open the CloudFormation console in the region, click **Create stack** and choose **With new resources**, and use this template URL. Name the stack `capsule-amazon-quick-chat-logs`. Capsule discovers the delivery on its next sync.

```
https://capsule-security-us-east-1-public-demo.s3.us-east-1.amazonaws.com/cf-capsule-amazon-quick-chat-logs/versions/1.0.yaml
```

The person deploying the stack needs these permissions in each region:

- `cloudformation:CreateStack` and `cloudformation:DescribeStacks`
- `logs:CreateLogGroup`, `logs:PutRetentionPolicy`, `logs:PutResourcePolicy`
- `logs:PutDeliverySource`, `logs:PutDeliveryDestination`, `logs:CreateDelivery`
- `quicksight:AllowVendedLogDeliveryForResource`
- The matching delete, describe, and get actions to update or delete the stack


If a `CHAT_LOGS` delivery already exists in a region and its destination is a CloudWatch Logs log group, Capsule discovers it and you do not need the stack there. Deliveries to S3 or Firehose destinations are not read.

Capsule detects the delivery on its next sync and shows the state per region under **Chat activity** on the integration:

| Message | Meaning |
|  --- | --- |
| Activity requires chat log delivery. | No delivery is set up in that region. Complete this step |
| Chat log delivery is set up. No events have arrived yet. | Delivery works. Activity appears after the first chat in that region |
| Capsule could not read chat logs. | Capsule found the delivery but could not read it. The error detail follows |


No message means chat logs are flowing.

### What activity captures

| Chat log content | Shown in Capsule as |
|  --- | --- |
| User and agent messages | Conversation messages, grouped by conversation |
| File attachments | Attachment names on the user message |
| Selected and cited resources | Data source access on the conversation |
| Flow runs | Flow run records linked to the agent, with Succeeded or Failed status |
| Action connector calls | Not captured. Connectors stay in raw data |
| Chats with the default assistant | Activity on the default assistant |


Chat responses that fail outside a flow run are not recorded as separate events.

CloudTrail is used for owners, agents in preview, and deleted resources, not for activity.

## Step 4: Connect and Verify

1. Under **Connect and verify**, paste the **Role ARN** from Step 2
2. Click **Verify access**. Capsule assumes the role in each selected region and checks that your Quick account is reachable
3. When Capsule shows "Capsule can read Amazon Quick in every selected region.", click **Save**


If verification fails, Capsule shows **Capsule could not verify access** and lists each problem with its region. The message names the missing permission or the region problem. See [Troubleshooting](#troubleshooting).

### After setup

- The first sync may take several minutes
- View synced resources in **Inventory**
- Activity appears only in regions where you completed Step 3


## Permissions

The role created in Step 2 allows the following, on all resources:

| Service | Actions | Purpose |
|  --- | --- | --- |
| QuickSight | `List*`, `Describe*`, `Search*` for agents, flows, spaces, knowledge bases, action connectors, users, groups, and namespaces | Inventory and permissions |
| QuickSight | `GetFlowMetadata`, `GetFlowPermissions`, `DescribeAccountSubscription`, `DescribeAccountSettings`, `ListSpaceResources` | Flow details, edition check, space contents |
| EC2 | `ec2:DescribeRegions` | Region discovery |
| CloudTrail | `cloudtrail:LookupEvents` | Owners, preview agents, deletions |
| Logs | `DescribeDeliveries`, `DescribeDeliverySources`, `DescribeDeliveryDestinations`, `DescribeLogGroups` | Detect chat log delivery |
| Logs | `FilterLogEvents`, `GetLogEvents`, `StartQuery`, `GetQueryResults`, `StopQuery` | Read chat logs |


## Updating the CloudFormation Stack

1. Open **CloudFormation / Stacks** in your AWS account
2. Select the Capsule Amazon Quick stack
3. Click **Update stack → Create a change set**
4. Select **Standard change set → Replace existing template**
5. Provide the template URL from Step 2 (or the newer version URL Capsule gives you)
6. Click through **Next**, review the terms, and agree
7. Review the change set and click **Execute change set**


## Troubleshooting

### AccessDenied: "identity region is X"

Users and groups can be read only from your Quick identity region. Capsule reads them once, from that region, and skips them in the others. If the error persists, include region `X` in the **Quick regions** you select and verify again.

### UnsupportedUserEditionException

The Quick account edition does not support the operation Capsule called. Check the account edition in the Amazon Quick console, or connect a different account.

### UnknownOperationException

The region does not have agentic features. Capsule skips the unsupported part for that region and continues. Remove the region from your selection if you do not use Quick there, or enable agentic features and sync again.

### Activity requires chat log delivery.

No chat log delivery exists for the region. Complete [Step 3](#step-3-deliver-chat-logs-to-cloudwatch-logs-optional) in that region. Delivery is per region and not retroactive, so earlier conversations are not captured.

### Capsule could not read chat logs.

Delivery exists, but Capsule could not read the log group. Confirm the chat logs stack from Step 3 is still deployed and unmodified, and that the log group is in the same region as the delivery. The notice includes the error returned by AWS.

### Capsule could not verify access.

- Confirm the stack status is **CREATE_COMPLETE**
- Verify you copied the full ARN from the **Outputs** tab
- Check that the role and its policies have not been modified or deleted
- Check that no service control policy blocks `sts:AssumeRole` or `quicksight:*` in the region


### No agents appearing

- Verify agents exist in the selected regions
- Verify agentic features are enabled in those regions
- Agents shared with other users but not with the role may not appear. If an agent is missing, contact support
- Agents still in preview are found through CloudTrail. Without CloudTrail they are missed
- Allow several minutes for the initial sync


### Agent owners missing

Owners come from CloudTrail `Create*` events. Resources created before CloudTrail was enabled, or longer ago than the CloudTrail event history retains, have no owner.

## Supported Regions

`us-east-1`, `us-west-2`, `eu-west-1`, `eu-west-2`, `eu-central-1`, `ap-southeast-1`, `ap-southeast-2`, `ap-northeast-1`. Flows are not available in `ap-southeast-1`.

## Support

For help with this integration, contact support.

For Amazon Quick issues:

- [Amazon Quick Documentation](https://docs.aws.amazon.com/quicksuite/latest/userguide/)
- [AWS Support](https://aws.amazon.com/support/)