Organizations need efficient ways to access and analyze their enterprise data. Amazon Q Business addresses this need as a fully managed generative AI-powered assistant that helps you find information, generate content, and complete tasks using enterprise data. It provides immediate, relevant information while streamlining tasks and accelerating problem-solving.
Amazon FSx for Windows File Server is a fully managed Windows file system that provides high-performance file storage for Windows-based applications. You can use Amazon FSx to lift and shift your on-premises Windows file server workloads to the cloud, taking advantage of the scalability, durability, and cost-effectiveness of AWS while maintaining full compatibility with your existing Windows applications and tooling.
Amazon Q Business is designed to be secure and private, seamlessly integrating with your existing identity provider (IdP). It works directly with your identities, roles, and permission sets, making sure users can’t access data they are not authorized to. Additionally, Amazon Q Business seamlessly integrates with multiple enterprise data stores, including FSx for Windows File Server, enabling you to index documents from file server systems and perform tasks such as summarization, Q&A, or data analysis of large numbers of files effortlessly.
In this post, we demonstrate how to use the Amazon Q connector for FSx for Windows File Server, explore a practical use case, and provide step-by-step instructions to help you get started and gain insights out of your data stored in FSx for Windows File Server.
Overview of the Amazon Q data source connector
A data source connector is a mechanism for integrating and synchronizing data from multiple repositories, including Microsoft SharePoint, Salesforce, Amazon Simple Storage Service (Amazon S3) buckets, and even your internal FSx for Windows File Server into one container index. Amazon Q Business offers multiple data source connectors that can connect to your data sources and help you create your generative AI solution with minimal configuration. For a list of supported connectors, see Supported connectors.
Supported document types
Amazon Q boasts impressive versatility, supporting a wide range of document types stored at various places in your environment, including Windows Share (FSX for Windows File Server). Amazon Q can ingest and understand common formats like plaintext, PDF, HTML, XML, and JSON to Microsoft formats like Excel, Word, and PowerPoint. This provides a comprehensive search experience for your enterprise users.
Secure access with supported authentication types
Security is job zero at AWS, and Amazon Q has been built keeping that in mind. It supports a variety of authentication types, seamlessly integrating with your existing identity management systems. Whether you use single sign-on (SSO) or a custom authentication solution, Amazon Q can adapt to your specific needs.
Fine-grained control with ACLs and identity crawling
For organizations with highly sensitive data, Amazon Q offers an extra layer of security. Amazon Q Business supports crawling access control lists (ACLs) for document security by default. When you connect an Amazon FSx (Windows) data source to Amazon Q Business, it crawls ACL information attached to a document (user and group information) from the directory service of the Amazon FSx instance.
Overview of solution
The following diagram shows a high-level architecture of how AWS Managed Active Directory users, through AWS IAM Identity Center, can access and interact with an Amazon Q Business application. This enables an authenticated user to securely and privately interact with the application and gain insights from the enterprise data stored in FSx for Windows File Server, using the Amazon Q Business web experience from their web browser.
In this post, we walk you through the process of integrating Amazon Q Business with FSx for Windows File Server to extract meaningful insights from your file system using natural language processing (NLP). This solution enables you to interact with your file system data using conversational AI, making information discovery more intuitive and efficient.
To set up your Amazon Q Business application, complete the following high-level steps:
- Create a new Amazon Q application. Select the retriever. Add a data source (FSx for Windows File Server). Synchronize your file system data.
Lastly, we demonstrate the application functionality by testing its access for two different users.
Prerequisites
To implement this solution, you should have an AWS account with administrative privileges.
Follow the instructions in the GitHub repository’s README file to provision the infrastructure required for exploring the Amazon Q connector for FSx for Windows File Server.
Create an Amazon Q Business application
Complete the following steps to create a new Amazon Q Business application:
- On the Amazon Q Business console, choose Applications in the navigation pane. Choose Create application.
- For Application name, enter a name (for example, anycompany-filesystem-knowledgebase). For Access management method, select AWS IAM Identity Center.
If you completed the prerequisites, then IAM Identity Center is already enabled, and you should see the instance ARN listed.
- Under Quick start user, for Select user, choose your users. Leave Select subscription as Q Business Pro. For Application details, use the default values. Choose Create.
In the next step, you will select the data source to retrieve and index the data.
Select the retriever
In this step, you select the retriever to connect data sources to the application. There are two options: use a native retriever or use Amazon Kendra. For this example, we use a native retriever.
- On the application details page, under Q Recommendations, choose Data sources.
- Choose Select retriever.
- For Retrievers, select Native. For Index provisioning, select Enterprise. For Number of units, enter 1. Choose Confirm.
Add a data source
Complete the following steps to add a data source:
- On the application details page, choose Add data source. Search for Amazon FSx and choose the plus sign next to Amazon FSX (Windows).
- In the Name and description section, enter a name (for example, anycompany-filesystem-source) and an optional description. In the Source section, for Amazon FSx file system ID, choose the file system ID you created as a prerequisite. In the Authorization section, leave as default (ACLs are enabled for the connector).
- In the Authentication section, for AWS Secrets Manager secret, choose the AWS Secrets Manager secret that holds the active directory credentials to communicate with Amazon FSx to crawl the file system (QBusiness-fsx-creds). In the Configure VPC and security group, provide the following information:
- For Virtual Private Cloud (VPC), choose the virtual private cloud (VPC) created as a prerequisite (amazon-connector-for-win-fsx-blog-vpc). For Subnets, choose the private subnets that hold the FSx for Windows File System and active directory instance. For VPC security groups, choose your security group (<stack-name>-DefaultSecurityGroup).
- In the IAM role section, provide the following information:
- For IAM role¸ choose Create a new service role. For Role name, enter a name for the role.
- For Maximum file size, use the default option of 50 MB. Under Regex patterns, you can add inclusion and exclusion patterns. For this post, we add the inclusion pattern for PDF file types, so the Amazon Q crawler will include PDF files.
- In the Sync mode section, select Full sync.
Full sync is preferable for the first sync; for subsequent runs, you can choose only the modified data.
- In the Sync run schedule section, for Frequency, choose Run on demand.
You also have the option to run the sync on a recurring basis like hourly or daily.
- In the Tags section, you can optionally add tags.
- In the Field mappings section, use the default field mappings selected.
The Amazon Q connector offers seven fields. Modifying field mappings and adding custom fields will be available after you create the application and retriever. For more information on the field mappings, refer to Amazon FSx (Windows) data source connector field mappings.
- Choose Add data source.
Synchronize your file system data
When the data source is successfully created, a banner message appears. In the banner message (or on the data source details page), choose Sync now to sync your file system data.
You can monitor the status of the sync, which includes direct links to Amazon CloudWatch logs.
The sync can take a few minutes to a few hours to complete. Sync speeds are limited by factors such as remote repository throughput and throttling, network bandwidth, and the size of documents.
When the sync is complete, you should see the stats on the scan, which includes the number of items scanned and failed.
For this post, we have two active directory groups, ml-engineers and security-engineers. Each group has one user under them (John Doe and Jane Smith), and they have access to only one whitepaper based on their group (Choosing a generative AI service and AWS Security Incident Response Guide, respectively). The following diagram illustrates this access.
Validate the Amazon Q application functionality
Now that you have completed the setup, you can validate the application functionality by testing the access controls. We test the access of two users, John Doe and Jane Smith, who are users of the ml-engineers group and security-engineers group, respectively. You can retrieve the user name and password for each user from Secrets Manager. The secret name for John Doe is jdoe, and for Jane Smith, it’s jsmith.
- On the application details page, in the Web experience settings section, choose the link for the deployed URL.
- Sign in as John Doe.
A successful login directs you to the Amazon Q Business chat interface. This window serves as the main workspace where users interact with the application, as shown in the following screenshot.
With the test configuration, John Doe has access to only one document: generative-ai-on-aws-how-to-choose.pdf. You can test the access controls by asking questions about this whitepaper through the chat interface. This restricted access demonstrates the effective implementation of document-level permissions.
- For our first question, we ask What are the key factors to consider when choosing a generative AI service?
The following screenshot shows the response.
- Next, we ask Does Amazon Bedrock provide an option to customize the model?
The response includes citations from Amazon Q with reference to the source data.
Testing confirms that John Doe successfully receives responses to questions about content from generative-ai-on-aws-how-to-choose.pdf. You can ask additional questions about generative AI services, such as:
- What are the generative AI service offerings from AWS? What is Amazon Q optimized for? What are critical factors to consider when choosing an appropriate foundational model?
Next, we test access to the security incident response guide.
- We ask What are the four phases of the AWS security incident response process?
When asking questions about security topics from aws-security-incident-response-guide.pdf, the system returns no results. This behavior validates that document indexing respects the configured access permissions, and users can only access content they’re authorized to view.
- To validate access controls for the security-engineers user group, log in as Jane Smith.
You can test with questions about security incident response:
- What are the key objectives of an AWS security incident response plan? What are the four phases of the AWS security incident response process? What are the recommended steps for containing and eradicating a security incident in AWS? What types of data should be collected during an AWS security incident investigation? What are the key considerations for recovering from an AWS security incident?
Troubleshooting
If you encounter issues during the setup or operation of your Amazon Q Business application with FSx for Windows File Server, refer to the detailed troubleshooting guide in the README file. The guide provides solutions for common configuration challenges and operational issues you might experience.
Clean up
To avoid ongoing charges, we recommend cleaning up the resources you created while following this guide. For step-by-step cleanup instructions, refer to the README file.
Conclusion
In this post, we provided an overview of the Amazon Q FSx connector and how you can use it for safe and seamless integration of generative AI assistance with your enterprise data source. By using Amazon Q in your organization, you can enable employees to be more data-driven, efficient, prepared, and productive. Lastly, we demonstrated how using simple NLP search through Amazon Q Business enhances your ability to discover insights from your enterprise data quicker and respond to your needs faster.
The Amazon Q Business application offers a compelling solution for organizations seeking to enhance their data-driven capabilities. By using its NLP and secure data source integration features, you can unlock the true value of your data and empower your teams to be more productive and efficient in their work.
To learn more about the Amazon Q connector for FSx for Windows File Server, refer to Connecting Amazon FSx (Windows) to Amazon Q Business.
About the Authors
Manjunath Arakere is a Senior Solutions Architect on the Worldwide Public Sector team at AWS, based in Atlanta, Georgia. He partners with AWS customers to design and scale well-architected solutions, supporting their cloud migrations and modernization initiatives. With extensive experience in the field, Manjunath specializes in migration strategies, application modernization, serverless, and Generative AI (GenAI). He is passionate about helping organizations leverage the full potential of cloud computing to drive innovation and operational efficiency. Outside of work, Manjunath enjoys outdoor runs, tennis, volleyball, and challenging his son in PlayStation soccer games.
Imtranur Rahman is an experienced Sr. Solutions Architect in WWPS team with 14+ years of experience. Imtranur works with large AWS Global SI partners and helps them build their cloud strategy and broad adoption of Amazon’s cloud computing platform. Imtranur specializes in Containers, Dev/SecOps, GitOps, microservices based applications, hybrid application solutions, application modernization and loves innovating on behalf of his customers. He is highly customer obsessed and takes pride in providing the best solutions through his extensive expertise.
