What data does Amazon Q Developer send to AWS? Prompts, conversations, open file contents, selected code, repository context, commands, account and identity metadata, and client telemetry, with the exact set varying by surface and configuration. Tier and data sharing settings decide how AWS handles that content. Runtime controls decide what leaves the developer’s machine. Aurascape decodes coding assistant traffic inline, so teams govern the data and the action, not just the tool.

Last updated: August 2026.

What Amazon Q Developer Sends to AWS, Surface by Surface

Amazon Q Developer collects different context through its integrated development environment (IDE), command line, AWS Management Console, and repository workflows. Review each surface on its own, because inputs, permissions, and terms differ by feature (AWS, 2026). Follow the workflows developers actually use, not the subscription an administrator provisioned.

The Amazon Q Developer data path means the set of inputs, context, and measurements that can leave a developer workstation or a connected repository and reach AWS, with the exact combination varying by surface, feature, and configuration. Confirm each category below against current AWS documentation for the features you enable. Categories that recur across surfaces:

• Prompts and conversation history, including follow-up turns that carry earlier context forward.
• Open file contents and selected code passed as context with a request.
• Workspace and repository context gathered for multi-file tasks such as feature implementation, code transformation, and review.
• Commands and command output in command line sessions, including what the terminal returns.
• Account, identity, subscription, and Region metadata that routes and bills the request.
• Integration data from connected sources such as repositories and console troubleshooting sessions.
• Client telemetry describing how the assistant was used.

Two categories surprise teams during review. Workspace context runs wider than the visible prompt, because file contents open in the editor can travel with a request. Command line use reaches further still: a session can read terminal output, which puts environment variables, connection strings, and local credentials in scope alongside code. Check only the chat window and you will understate the surface. Use the matrix below as the intake sheet for each one.

What Changes by Amazon Q Developer Tier?

Subscription tier and data sharing settings decide how AWS handles customer content after transmission. On the Free Tier, customer content including code snippets, conversations, and file contents open in the IDE may be stored and processed, and unless the user explicitly opts out, that content may also be used to improve underlying foundation models. Pro Tier customer content is not used for foundation model training (AWS, 2026).

Client telemetry is a separate setting with a separate scope. AWS describes telemetry as usage measurement, for example whether a code recommendation was accepted or rejected, states that it does not contain actual code, and publishes field definitions in the commonDefinitions.json file of the aws-toolkit-common repository (AWS, 2026).

Verify the configured state rather than assume it. Record the tier, data sharing, and telemetry state for every client configuration you ship, and re-check it after image refreshes and plugin updates. Then note the limit of the exercise: a tier setting says nothing about whether a customer record or a production credential belonged in the prompt at all. That question applies to every assistant in the estate, which is why teams reviewing source code retention in Claude Code and retention behavior in Cursor end up writing one policy instead of six.

What Permissions, Regions, Retention, and Logs Should Administrators Review?

Identity and account context decide which enterprise subscription and session policies apply. Enterprise access to Amazon Q Developer runs through AWS IAM Identity Center, a different arrangement from an individual signing in with a personal builder identity. Enforce the enterprise account inside the interaction, not in a training deck, because the decision lands at the moment the request is made.

Amazon Q Developer permissions determine what the assistant, and any agent workflow it runs, can reach beyond the conversation itself. Features run under an AWS Identity and Access Management (IAM) identity: the role or profile attached to the developer’s session, or the role attached to a continuous integration and continuous delivery (CI/CD) pipeline when Amazon Q Developer runs there. Scope those permissions to the task before rollout, and review repository scopes, secrets manager access, and build credentials with the same rigor. Access control is where AI reviews most often stall: 97% of AI-related breaches lacked proper AI access controls (IBM, 2025).

Region and retention are contractual answers, so get them from AWS in writing rather than inferring them from a blog post. Ask for the Regions used to process and store data for each surface you enable, and for the retention windows covering conversation history, indexed workspace content, and administrative logs. Map both against residency, contractual, and sector obligations before the first repository is indexed, the same discipline applied to data residency review for Claude Code. Record the answers where auditors can find them. A policy becomes operational when teams can enforce it and produce evidence of each decision.

Ask the same question of logging. Confirm what usage and administrative evidence AWS returns for the subscriptions you manage, and what it does not: assignment and tier are visible to an administrator, while the content of a prompt, the file that went with it, and the command an agent proposed are a different class of record. That gap is the subject of the last section.

From Assistant to Agent: What Changes When Amazon Q Developer Acts

Basic chat and completion workflows are human-to-AI interactions. Agent workflows add delegated actions across files, commands, repositories, and tools, where a developer approves a task and the assistant reads, decides, and acts over multiple steps with less turn-by-turn review. That shift changes the question from what was said to what was done.

Agent workflows widen both the context read and the actions attempted. Multi-file feature implementation, code transformation, documentation generation, code review, and command line sessions draw on more of the repository than a single completion request, and some propose changes back into it. A completion suggestion raises a data question. An agent run raises a data question plus an action question: which files were read, which commands ran, which credentials sat in the environment, and what changed as a result.

Untrusted content rides along with that context. OWASP ranks prompt injection (LLM01), sensitive information disclosure (LLM02), and excessive agency (LLM06) among the top risks for AI applications (OWASP, 2025). In a coding workflow, injected instructions arrive in an issue description, a README, a dependency manifest, or a tool result, and an agent can treat them as input. Aurascape’s Aura Labs research documented zero click indirect prompt injection in a commercial AI agent, rated 9.8 Critical, with email data theft, secret leakage, and remote code execution demonstrated before mitigations shipped (Aurascape, 2026). The same failure mode is why teams ask whether an agentic coding tool can expose source code or secrets.

Model Context Protocol (MCP) is one common tool execution pattern, not the whole agent access control problem, and coding agents also act through shell commands, IDE extensions, and repository APIs. Aurascape discovers and secures local AI agents and their interactions, and adds a Zero-Bypass MCP Gateway that marks every tool call it approves and blocks unmarked calls, governing the agent-to-tool execution path inline rather than observing it (Aurascape, 2026). Observation and control do different jobs. Seeing that an agent ran a command helps an investigation after the fact. Holding a destructive command for confirmation, or blocking a chained read of customer records followed by a write to an external tool, keeps the workflow inside policy while it runs.

A Deployment Sequence for Amazon Q Developer

Work the sequence in order. Steps one through four set the account baseline. Steps five through nine govern data and actions at runtime.

1. Inventory the surfaces already in use. Check IDE plugins, command line installs, console sessions, and repository integrations, including installs nobody approved.
2. Fix identity and tier before rollout. Administer enterprise subscriptions through IAM Identity Center, and treat personal account use of the same tool as a policy event rather than a preference.
3. Set data sharing and telemetry deliberately. Choose the state, document it per client configuration, and re-check it after image refreshes and plugin updates.
4. Get Region and retention terms in writing. Map them to residency, contractual, and sector obligations before any repository is indexed.
5. Scope what the assistant can reach. Repository permissions, secrets managers, build credentials, and CI/CD tokens define the reach of any agent action.
6. Write policy against the intention, not just the app. Chat, code completion, code transformation, terminal execution, and repository write are different Intentions with different risk, so each carries its own rule.
7. Name what may never leave an interaction. Be specific: source code for named repositories, credentials and keys, customer records, regulated data, and pre-release material.
8. Govern the tool execution path and coach at the point of use. Approve tools individually, hold high-risk write and execute calls for human confirmation, block calls that arrive without approval, and coach the developer at the point of use or require the enterprise tenant before the request continues.
9. Instrument the record. Keep interaction records for audit and effectiveness under role-based access control, and make them answerable by the teams who face auditors.

Where AWS-Native Evidence Ends and Aurascape Interaction Records Begin

Set the native baseline first. AWS-native controls answer questions about the subscription an administrator manages: which identities hold Amazon Q Developer access, which tier they are assigned, how data sharing and telemetry are configured, and what usage the service reports back to that account. Confirm the exact contents of that reporting with AWS, then treat it as the floor rather than the whole record.

Interaction-level controls answer a different question: what a developer or an agent did, across every assistant in use, and whether that action matched policy. Aurascape discovers AI apps and agents across the network, endpoint, and API planes, with a continuously updated catalog of 30,000+ AI apps, 50+ new tools added a day, and a 48-hour signature service level agreement for new apps (Aurascape, 2026). The two columns below differ at the enforcement point: account settings act on the subscription, while inline controls act on the interaction and the action it triggers.

Policy is enforced in real time through allow, coach, notify, redact, redirect, block, capture, and require tenant actions, so a team never has to choose between permitting everything and breaking a build (Aurascape, 2026). Aurascape is additive to an existing security service edge (SSE), secure access service edge (SASE), cloud access security broker (CASB), data loss prevention (DLP), or secure web gateway (SWG) stack, steering only AI traffic. In one Aurascape deployment at a Fortune 500 financial services firm, 15,000+ developers were secured across 8 targeted AI tools, with source code and client data governed inside the interaction and enterprise account access enforced, alongside the firm’s existing SASE stack (Aurascape, 2026). That matters because pressure to speed development had already pushed development leadership toward requesting a bypass, which would have meant unmonitored AI traffic potentially carrying source code.

When an auditor reviews AI coding assistants, four questions carry the conversation, and each one needs a record rather than an assertion.

Aurascape creates interaction records for audit and effectiveness, governed by role-based access control (RBAC) for privacy, and Auri answers questions about AI usage, risk, policy, and behavior in natural language without a security console or a query language. Role-based answers let each team inspect the same governed interaction record while security keeps the policy.

Frequently Asked Questions

Does Amazon Q Developer send my source code to AWS?

Code travels with a request. AWS lists code snippets and file contents open in the IDE among Free Tier customer content, and multi-file workflows draw on wider repository context. Confirm the exact scope for the surfaces and features you enable against current AWS documentation before writing policy around it.

Does Amazon Q Developer train on my code?

Not on the Pro Tier, where AWS states customer content is not used for foundation model training. Free Tier content may be used for model improvement unless the user opts out, so record the opt-out state for each client configuration and re-check it after image and plugin updates.

What telemetry does the IDE plugin send?

AWS describes client-side telemetry as usage measurement, such as whether a recommendation was accepted or rejected, and states it does not contain actual code. Field definitions are published in the commonDefinitions.json file of the aws-toolkit-common repository for teams that need a field-level answer.

Where is Amazon Q Developer data processed and stored?

Ask AWS for the current Region list per surface and get the answer in writing. Processing and storage location is a residency and contractual question, so match the AWS answer to your obligations before indexing repositories rather than relying on a secondary technical analysis.

How long does AWS retain Amazon Q Developer data?

Request the retention windows directly and record them. Ask specifically about conversation history, indexed workspace content, and administrative logs, then store the answers where auditors and privacy reviewers can find them alongside your own interaction records.

Can Amazon Q Developer expose secrets?

Secrets reach the assistant the way they reach any coding tool: present in open files, in environment variables a command line session reads, or in command output. Inline data classification on the interaction catches keys and connection strings before they leave, and redaction lets the request continue without the sensitive value.

What permissions does Amazon Q Developer need?

Requirements vary by feature, so confirm them per surface in AWS documentation. In practice the assistant runs under an AWS Identity and Access Management identity: the role or profile attached to a developer session, or the role attached to a pipeline. Scope repository, secrets manager, and build credential access to least privilege before rollout.

What can Amazon Q Developer access through GitHub or CI/CD integrations?

Confirm the specific access AWS documents for the integration you enable, including which repository content is read or indexed and which workflows propose changes. In CI/CD, the pipeline identity rather than a person is the one whose permissions and logs matter, so review it with the same rigor as a developer account.

How do we stop developers from using personal accounts?

Enforce it on the interaction. Aurascape distinguishes enterprise tenants from personal accounts and applies a require tenant action inline, coaching the developer toward the sanctioned account. Discovery also surfaces installs on endpoints that never appeared in a subscription report.

Does Aurascape replace our SASE or DLP stack to control this?

No. Aurascape is an additive control layer that steers AI traffic through inline inspection and enforcement, and it adds policy based on identity, data, conversation context, Intentions, and the action attempted.

Aurascape gives AWS administrators, developers, and application security teams inline control over coding assistant data and actions. It discovers AI use, classifies sensitive data, enforces enterprise account policy, governs approved tool execution, and creates interaction records for audit. Adopt Amazon Q Developer at the pace your developers want, with the data path under policy.

See how Aurascape governs AI coding assistants across IDE, command line, and agent workflows →