

# Connecting Confluence (Cloud) to Amazon Q Business
<a name="confluence-cloud-connector"></a>

Atlassian Confluence is a collaborative work-management tool designed for sharing, storing, and working on project planning, software development, and product management. You can connect Confluence (Cloud) instance to Amazon Q Business—using either the AWS Management Console or the [https://docs.aws.amazon.com/amazonq/latest/api-reference/API_CreateDataSource.html](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_CreateDataSource.html) API—and create an Amazon Q web experience.

**Topics**
+ [Confluence (Cloud) connector overview](confluence-cloud-overview.md)
+ [Prerequisites for connecting Amazon Q Business to Confluence (Cloud)](confluence-cloud-prereqs.md)
+ [Setting up Confluence (Cloud) for connecting to Amazon Q Business](confluence-cloud-credentials.md)
+ [Connecting Amazon Q Business to Confluence (Cloud) using the console](confluence-cloud-console.md)
+ [Connecting Amazon Q Business to Confluence (Cloud) using APIs](confluence-cloud-api.md)
+ [Connecting Amazon Q Business to Confluence (Cloud) using AWS CloudFormation](confluence-cloud-cfn.md)
+ [How Amazon Q Business connector crawls Confluence (Cloud) ACLs](confluence-cloud-user-management.md)
+ [Amazon Q Business Confluence (Cloud) data source connector field mappings](confluence-cloud-field-mappings.md)
+ [IAM role for Amazon Q Confluence (Cloud) connector](confluence-cloud-iam-role.md)
+ [Understand error codes in the Amazon Q Business Confluence (Cloud) connector](confluence-cloud-error-codes.md)

**Learn more**
+ For an overview of the Amazon Q web experience creation process using IAM Identity Center, see [Configuring an application using IAM Identity Center](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/create-application.html).
+ For an overview of the Amazon Q web experience creation process using AWS Identity and Access Management, see [Configuring an application using IAM](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/create-application-iam.html).
+ For an overview of connector features, see [Data source connector concepts](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-concepts.html).
+ For information about connector configuration best practices, see [Connector configuration best practices](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-best-practices.html).

# Confluence (Cloud) connector overview
<a name="confluence-cloud-overview"></a>

The following table contains an overview of the Amazon Q Business Confluence (Cloud) connector and its supported features.


****  
[\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-overview.html)

# Prerequisites for connecting Amazon Q Business to Confluence (Cloud)
<a name="confluence-cloud-prereqs"></a>

Before you begin, make sure that you have completed the following prerequisites.

**In Confluence Cloud, make sure you have:**
+ Copied your Confluence instance URL. For example: *https://example.atlassian.net*. You need your Confluence instance URL to connect to Amazon Q.
+ Configured basic authentication credentials containing a username (email ID used to log into Confluence) and password (Confluence API token) to allow Amazon Q to connect to your Confluence instance. For information about how to create a Confluence API token, see [Manage API tokens for your Atlassian account](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/#Create-an-API-token) on the Atlassian website.
+ **Optional:** Configured OAuth 2.0 credentials containing a Confluence app key, Confluence app secret, Confluence access token, and Confluence refresh token to allow Amazon Q to connect to your Confluence instance. If your access token expires, you can either use the refresh token to regenerate your access token and refresh token pair, or you can repeat the authorization process. For more information about access tokens, see [Manage OAuth access tokens](https://support.atlassian.com/confluence-cloud/docs/manage-oauth-access-tokens/) on the Atlassian website.

**In your AWS account, make sure you have:**
+ Created a Amazon Q Business application.
+ Created a [Amazon Q Business retriever and added an index](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/select-retriever.html).
+ Created an [IAM role](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/iam-roles.html#iam-roles-ds) for your data source and, if using the Amazon Q API, noted the ARN of the IAM role.
+ If you want to have Amazon Q automatically rotate your secret, ensure that your IAM role includes the `secretsmanager:PutSecretValue` and `secretsmanager:UpdateSecret` permissions. 
+ Stored your Confluence (Cloud) authentication credentials in an AWS Secrets Manager secret and, if using the Amazon Q API, noted the ARN of the secret.
**Note**  
If you’re a console user, you can create the IAM role and Secrets Manager secret as part of configuring your Amazon Q application on the console.

For a list of things to consider while configuring your data source, see [ Data source connector configuration best practices](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-best-practices.html).

**Note**  
For more information on connecting Confluence (Cloud) to Amazon Q Business, see [Index your Atlassian Confluence Cloud contents using the Amazon Q Confluence Cloud connector for Amazon Q Business](https://aws.amazon.com/blogs/machine-learning/index-your-atlassian-confluence-cloud-contents-using-the-amazon-q-confluence-cloud-connector-for-amazon-q-business/) in the *AWS Machine Learning Blog*.

# Setting up Confluence (Cloud) for connecting to Amazon Q Business
<a name="confluence-cloud-credentials"></a>

Before you connect Confluence (Cloud) to Amazon Q Business, you need to create and retrieve the Confluence (Cloud) credentials you will use to connect Confluence (Cloud) to Amazon Q. You will also need to add any permissions needed by Confluence (Cloud) to connect to Amazon Q.

The following sections give you an overview of how to configure Confluence (Cloud) to connect to Amazon Q using either basic authentication or OAuth 2.0 authentication.

**Topics**
+ [Basic authentication](confluence-cloud-credentials-basic.md)
+ [OAuth 2.0 authentication](confluence-cloud-credentials-oauth.md)
+ [How Amazon Q works with Confluence (Cloud) access and refresh tokens](confluence-cloud-credentials-notes.md)
+ [Checking Confluence (Cloud) connectivity](confluence-cloud-connection-check.md)

# Basic authentication
<a name="confluence-cloud-credentials-basic"></a>

You can connect Amazon Q to Confluence (Cloud) using basic authentication credentials. The following procedure gives you an overview of how to configure Confluence (Cloud) to connect to Amazon Q using basic authentication.

**Configuring Confluence (Cloud) basic authentication for Amazon Q**

1. Log in to your account from the [Confluence (Cloud)](https://confluence.atlassian.com/). Note the username you logged in with. You will need this later to connect to Amazon Q.

1. From your Confluence (Cloud) home page, note your Confluence (Cloud) URL from your Confluence browser URL. For example: *https://example.atlassian.net*. You will need this later to connect to Amazon Q.

1. Then, go to [Security]( https://id.atlassian.com/manage-profile/security/api-tokens.) page in Confluence (Cloud).

1. From the **API tokens** page, select **Create API token**.  
![\[Screenshot of the Atlassian account settings page showing where to access API tokens.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-1.png)

1. In the **Create an API token** dialog box that opens, for **Label**, add a name for your API token. Then, select **Create**.  
![\[Screenshot of the "Create an API token" dialog box where users enter a label for their API token.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-2.png)

1. From the **Your new API token** dialog box, copy the API token and save it in a text editor of your choice. You can't retrieve the API token once you close the dialog box.  
![\[Screenshot of the "Your new API token" dialog box displaying the generated API token that needs to be copied and saved.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-3.png)

1. Select **Close**.

You now have the username, Confluence (Cloud) URL, and Confluence (Cloud) API token you need to connect to Amazon Q with basic authentication.

For more information, see [Manage API tokens for your Atlassian account](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/) in Atlassian Support.

## Atlassian Admin Authentication
<a name="confluence-cloud-credentials-admin-auth"></a>

To ensure Amazon Q can access all user and group information from your Confluence (Cloud) instance, you must provide Atlassian admin credentials. These credentials allow Amazon Q to sync user information regardless of individual email visibility settings.

### Get your Atlassian admin credentials
<a name="w2aac29c14c23c29c39c23c11c11b5"></a>

1. Sign in to the [Atlassian admin portal](https://admin.atlassian.com/) with administrator permissions.

1.  Open the Administration app for your organization. The URL should look like: `https://admin.atlassian.com/o/{ORGANIZATION-UUID}/overview` 

1. Choose **Settings**, then choose **API Keys**.

1. Choose **Create API key**.

1. Select all available scopes for the API key. 

   Note that the Confluence APIs that fetch user and group information require full scope access.

1.  Copy and save both the **Organization ID** and **API Key**. Note that API keys expire. Monitor the expiration date and update your data source credentials before the key expires. 

### Get your Directory ID
<a name="w2aac29c14c23c29c39c23c11c11b7"></a>

1. Use the Atlassian Admin Workspace API to get your Directory ID. Run the following command:

   ```
   curl --request POST \
   --url 'https://api.atlassian.com/admin/v2/orgs/{ORGANIZATION-ID}/workspaces' \
   --header 'Authorization: Bearer {API-KEY}' \
   --header 'Accept: application/json' \
   --header 'Content-Type: application/json'
   ```

1. In the API response, find the workspace entry that matches your Confluence Cloud instance. Look for `"type": "Confluence"`. Verify the workspace name matches your instance and then copy the directory value from the attributes section. If your instance isn't listed, use the pagination cursor in the `links.next` field to view additional pages.

   ```
   curl --request POST \
   --url 'https://api.atlassian.com/admin/v2/orgs/{ORGANIZATION-ID}/workspaces' \
   --header 'Authorization: Bearer {API-KEY}' \
   --header 'Accept: application/json' \
   --header 'Content-Type: application/json' \
   --data '{"cursor": "{NEXT-PAGE-TOKEN}"}'
   ```

### Update your Confluence data source
<a name="w2aac29c14c23c29c39c23c11c11b9"></a>

When creating or updating your Confluence Cloud data source, provide these three values in your AWS Secrets Manager secret:

1. Admin API Key

1. Organization ID

1. Directory ID

For more information about Atlassian admin API scopes, see [Atlassian API scopes documentation](https://developer.atlassian.com/cloud/admin/scopes/).

For API details, see [Atlassian Admin Workspace API reference](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-workspaces/#api-group-workspaces).

# OAuth 2.0 authentication
<a name="confluence-cloud-credentials-oauth"></a>

You can connect Amazon Q to Confluence (Cloud) using OAuth 2.0 authentication credentials. The following procedures give you an overview of how to configure Confluence (Cloud) to connect to Amazon Q using OAuth 2.0 authentication.

**Topics**
+ [Step 1: Retrieving username and Confluence (Cloud) URL](#confluence-cloud-credentials-url)
+ [Step 2: Configuring an OAuth 2.0 app integration](#confluence-cloud-credentials-oauth-app)
+ [Step 3: Retrieving Confluence (Cloud) client ID and client Secret](#confluence-cloud-credentials-id-secret)
+ [Step 4: Generating an Confluence (Cloud) access token](#confluence-cloud-credentials-access)
+ [Step 5: Generating a Confluence (Cloud) refresh token](#confluence-cloud-credentials-refresh)
+ [Step 6: Generating a new Confluence (Cloud) access token using a refresh token](#confluence-cloud-credentials-refresh-access)

## Step 1: Retrieving username and Confluence (Cloud) URL
<a name="confluence-cloud-credentials-url"></a>

To connect Confluence (Cloud) to Amazon Q, you need your Confluence (Cloud) username and your Confluence (Cloud) URL. The following procedure shows you how to retrieve these.

**Retrieving username and Confluence (Cloud) URL**

1. Log in to your account from the [Confluence (Cloud)](https://confluence.atlassian.com/). Note the username you logged in with. You will need this later to connect to Amazon Q.

1. From your Confluence (Cloud) home page, note your Confluence (Cloud) URL from your Confluence browser URL. For example: *https://example.atlassian.net*. You will need this later to both configure your OAuth 2.0 token and connect to Amazon Q.

## Step 2: Configuring an OAuth 2.0 app integration
<a name="confluence-cloud-credentials-oauth-app"></a>

To connect Confluence (Cloud) to Amazon Q using OAuth 2.0 authentication, you need to create a Confluence (Cloud) OAuth 2.0 app with the necessary permissions. The following procedure shows you how to create this.

**Configuring an OAuth 2.0 app integration**

1. Log in to your account from the [Atlassian Developer page](https://developer.atlassian.com/).

1. Select the profile icon from the top-right corner. Then, from the dropdown menu that opens, select **Developer Console**.  
![\[Screenshot of the Atlassian Developer Console showing the "Create" button and options for creating a new integration.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-4.png)

1. From the **Welcome** page, select **Create** and then select **OAuth 2.0 integration**.  
![\[Screenshot of the Atlassian Developer Console welcome page showing the "Create" dropdown menu with the "OAuth 2.0 integration" option highlighted.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-5.png)

1. On the **Create a new OAuth 2.0 (3LO) integration** page, for **Name**, enter a name for the OAuth 2.0 application you are creating. Then, select the **I agree to be bound by Atlassian's developer terms** checkbox, and select **Create**.  
![\[Screenshot of the "Create a new OAuth 2.0 (3LO) integration" page where users enter a name for the OAuth application and agree to the Atlassian developer terms.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-6.png)

   The console will display a summary page outlining the details of the OAuth 2.0 app created.   
![\[Screenshot of the OAuth 2.0 app summary page showing details of the created application including name, ID, and other configuration information.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-7.png)

1. From the left navigation menu, choose **Authorization**.

1. From the **Authorization** page, choose **Add** to add **OAuth 2.0 (3LO)** to your app.  
![\[Screenshot of the OAuth 2.0 app's Authorization page showing the "Add callback URL" button that users need to click to configure the callback URL for the OAuth flow.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-8.png)

1. On the **OAuth 2.0 authorization code grants (3LO) for apps**, enter the Confluence (Cloud) URL you copied as the **Callback URL** and then choose **Save changes**.  
![\[Screenshot of the "OAuth 2.0 authorization code grants (3LO) for apps" section showing the Callback URL field where users enter the Confluence URL for the OAuth redirect.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-9.png)

1. From the **Authorization URL generator** section that appears, choose **Add APIs** to add APIs to your app. This will redirect you to the **Permissions** page.

1. On the **Permissions** page, for **Scopes**, navigate to **User Identity API**. Select **Add**, and then select **Configure**.  
![\[Screenshot of the Permissions page showing the "User Identity API" option that needs to be selected to configure user identity permissions for the OAuth app.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-10.png)

1. On the **User Identity API** page, choose **Edit Scopes**, and the add the following `read` scopes:
   + **`read:me`** – View active user profile
   + **`read:account`** – View user profiles  
![\[Screenshot of the User Identity API permissions page showing the available scopes that can be selected for the OAuth application, with read scopes highlighted.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-12.png)

   Then, select **Save**.

1. Return to the **Permissions** page. From **Scopes**, navigate to **Confluence API**. Select **Add**, and the select **Configure**.  
![\[Screenshot of the Permissions page showing the Confluence API option that needs to be selected to configure API permissions for accessing Confluence content.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-11.png)

1. Navigate to the **Granular scopes** page.  
![\[Screenshot of the Confluence API Granular scopes page showing the available API permission scopes that can be configured for the OAuth application.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-14.png)

   Then, choose **Edit Scopes**, and the add the following `read` scopes:
   + **`read:content:confluence`** – View detailed contents 
   + **`read:content-details:confluence`** – View content details 
   + **`read:space-details:confluence`** – View space details
   + **`read:audit-log:confluence`** – View audit records 
   + **`read:page:confluence`** – View pages 
   + **`read:attachment:confluence`** – View and download content attachments 
   + **`read:blogpost:confluence`** – View blogposts 
   + **`read:custom-content:confluence`** – View custom content 
   + **`read:comment:confluence`** – View comments 
   + **`read:template:confluence`** – View content templates 
   + **`read:label:confluence`** – View labels 
   + **`read:watcher:confluence`** – View content watchers 
   + **`read:group:confluence`** – View groups 
   + **`read:relation:confluence`** – View entity relationships 
   + **`read:user:confluence`** – View user details 
   + **`read:configuration:confluence`** – View Confluence settings 
   + **`read:space:confluence`** – View space details 
   + **`read:space.permission:confluence`** – View space permissions 
   + **`read:space.property:confluence`** – View space properties 
   + **`read:user.property:confluence`** – View user properties 
   + **`read:space.setting:confluence`** – View space settings 
   + **`read:analytics.content:confluence`** – View analytics for content 
   + **`read:content.permission:confluence`** – Check content permissions 
   + **`read:content.property:confluence`** – View content properties 
   + **`read:content.restriction:confluence`** – View content restrictions 
   + **`read:content.metadata:confluence`** – View content summaries 
   + **`read:inlinetask:confluence`** – View tasks 
   + **`read:task:confluence`** – View tasks 
   + **`read:permission:confluence`** – View content restrictions and space permissions 
   + **`read:whiteboard:confluence`** – View whiteboards 
   + **`read:app-data:confluence`** – Read app data 
   + *(Optional) ***`read:database:confluence`** – Read database
   + *(Optional) ***`read:embed:confluence `** – Read embeddings
   + *(Optional) ***`read:folder:confluence `** – Read folders
   + *(Optional) ***`read:email-address:confluence `** – Read email addresses

   Then, select **Save**.

For more information, see [Implementing OAuth 2.0 (3LO)](https://developer.atlassian.com/cloud/oauth/getting-started/implementing-oauth-3lo/) and [Determining the scopes required for an operation](https://developer.atlassian.com/cloud/oauth/getting-started/determining-scopes/) in Atlassian Developer.

### Atlassian Admin Authentication
<a name="confluence-cloud-credentials-admin-auth"></a>

To ensure Amazon Q can access all user and group information from your Confluence (Cloud) instance, you must provide Atlassian admin credentials. These credentials allow Amazon Q to sync user information regardless of individual email visibility settings.

#### Get your Atlassian admin credentials
<a name="w2aac29c14c23c29c39c23c15c13b9b5"></a>

1. Sign in to the [Atlassian admin portal](https://admin.atlassian.com/)with administrator permissions.

1.  Open the Administration app for your organization. The URL should look like: `https://admin.atlassian.com/o/{ORGANIZATION-UUID}/overview` 

1. Choose **Settings**, then choose **API Keys**.

1. Choose **Create API key**\$1

1. Select all available scopes for the API key. 

   Note that the Confluence APIs that fetch user and group information require full scope access.

1.  Copy and save both the **Organization ID** and **API Key**. Note that API keys expire. Monitor the expiration date and update your data source credentials before the key expires. 

#### Get your Directory ID
<a name="w2aac29c14c23c29c39c23c15c13b9b7"></a>

1. Use the Atlassian Admin Workspace API to get your Directory ID. Run the following command:

   ```
   curl --request POST \
   --url 'https://api.atlassian.com/admin/v2/orgs/{ORGANIZATION-ID}/workspaces' \
   --header 'Authorization: Bearer {API-KEY}' \
   --header 'Accept: application/json' \
   --header 'Content-Type: application/json'
   ```

1. In the API response, find the workspace entry that matches your Confluence Cloud instance. Look for `"type": "Confluence"`. Verify the workspace name matches your instance and then copy the directory value from the attributes section. If your instance isn't listed, use the pagination cursor in the `links.next` field to view additional pages.

   ```
   curl --request POST \
   --url 'https://api.atlassian.com/admin/v2/orgs/{ORGANIZATION-ID}/workspaces' \
   --header 'Authorization: Bearer {API-KEY}' \
   --header 'Accept: application/json' \
   --header 'Content-Type: application/json' \
   --data '{"cursor": "{NEXT-PAGE-TOKEN}"}'
   ```

#### Creating your Confluence data source
<a name="w2aac29c14c23c29c39c23c15c13b9b9"></a>

When creating your Confluence Cloud data source, provide these three values in your AWS Secrets Manager secret:

1. Admin API Key

1. Organization ID

1. Directory ID

For more information about Atlassian admin API scopes, see [Atlassian API scopes documentation](https://developer.atlassian.com/cloud/admin/scopes/).

For API details, see [Atlassian Admin Workspace API reference](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-workspaces/#api-group-workspaces).

#### Updating your Confluence data source
<a name="w2aac29c14c23c29c39c23c15c13b9c11"></a>

To update an existing Confluence Cloud data source with new admin credentials, add the following key pairs to your AWS Secrets Manager secret:

1. adminApiKey, \$1Admin API Key\$1

1. organizationId, \$1Organization ID\$1

1. directoryId, \$1Directory ID\$1

For more information about Atlassian admin API scopes, see [Atlassian API scopes documentation](https://developer.atlassian.com/cloud/admin/scopes/).

For API details, see [Atlassian Admin Workspace API reference](https://developer.atlassian.com/cloud/admin/organization/rest/api-group-workspaces/#api-group-workspaces).

## Step 3: Retrieving Confluence (Cloud) client ID and client Secret
<a name="confluence-cloud-credentials-id-secret"></a>

To connect Confluence (Cloud) to Amazon Q using OAuth 2.0 authentication, you need to provide a Confluence (Cloud) client ID and client secret. The following procedure shows you how to retrieve these.

**Note**  
You must create an OAuth 2.0 app before you can retrieve the client ID and client secret. See [Configuring an OAuth 2.0 app integration](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-credentials.html#confluence-cloud-credentials-oauth-app) for more details.

**Retrieving Confluence (Cloud) client ID and client secret**
+ From the left navigation menu, choose **Settings**. Then, scroll down to **Authentication details** section and copy and save the following in a text editor of your choice:
  + Client ID – You will enter this as **App key** in the Amazon Q console.
  + Client Secret – You will enter this as **App secret** in the Amazon Q console.  
![\[Screenshot of the OAuth application details page showing the client ID and client secret that need to be copied for API authentication with Confluence.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-15.png)

  You will need these to generate your Confluence (Cloud) OAuth 2.0 token and also to connect Amazon Q to Confluence (Cloud).

For more information, see [Implementing OAuth 2.0 (3LO)](https://developer.atlassian.com/cloud/oauth/getting-started/implementing-oauth-3lo/) and [Determining the scopes required for an operation](https://developer.atlassian.com/cloud/oauth/getting-started/determining-scopes/) in Atlassian Developer.

## Step 4: Generating an Confluence (Cloud) access token
<a name="confluence-cloud-credentials-access"></a>

To connect Confluence (Cloud) to Amazon Q, you need to generate an access token. The following procedure outlines how to generate an access token in Confluence (Cloud).

**Generating your Confluence (Cloud) access token**

1. Log in to your account from the [Atlassian Developer page](https://developer.atlassian.com/).

1. Open the OAuth 2.0 app you want to generate a refresh token for.

1. From the left navigation menu, choose **Authorization** again. Then, for **OAuth 2.0 (3LO)**, choose **Configure**.

1. From the **Authorization** page, from **Authorization URL generator**, from **Granular Confluence API authorization URL**, copy the URL and save it in a text editor of your choice.  
![\[Authorization page showing URL generator fields for User identity, Classic, and Granular Confluence API.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-16.png)

   The URL is of the following format:

   ```
   https://auth.atlassian.com/authorize?
   audience=api.atlassian.com 
   &client_id=YOUR_CLIENT_ID
   &scope=REQUESTED_SCOPE%20REQUESTED_SCOPE_TWO
   &redirect_uri=https://YOUR_APP_CALLBACK_URL
   &state=YOUR_USER_BOUND_VALUE 
   &response_type=code
   &prompt=consent
   ```

1. In the saved authorization URL, update the `state=${YOUR_USER_BOUND_VALUE}` parameter value to any text of your choice. For example, `state=`*sample\$1text*.

   For more information, see [What is the state parameter used for?](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/#what-is-the-state-parameter-used-for-) in Atlassian Support.

1. Open a web browser of your choice. Then, paste the authorization URL you copied into the browser URL. On the page that opens up, make sure everything is correct and then select **Accept**.  
![\[Atlassian account access request screen showing permissions and a warning about development mode.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-17.png)

   You will be returned to your Confluence (Cloud) home page.

1. Copy the URL of the Confluence (Cloud) home page and save it in a text editor of your choice. The URL contains the authorization code for your application. You will need this code to generate your Confluence (Cloud) access token. The whole section after `code=` is the authorization code.

1. Navigate to Postman.

   If you don't have Postman, you can also choose to use cURL to generate a Confluence (Cloud) access token. Use the following cURL command to do so:

   ```
   curl --location 'https://auth.atlassian.com/oauth/token' \
   --header 'Content-Type: application/json' \
   --data '{"grant_type": "authorization_code",
   "client_id": "YOUR_CLIENT_ID",
   "client_secret": "YOUR_CLIENT_SECRET",
   "code": "AUTHORIZATION_CODE",
   "redirect_uri": "YOUR_CALLBACK_URL"}'
   ```

1. On the Postman home page, select `POST` as the method, and then enter the following URL in the **Enter URL or paste text** box: `https://auth.atlassian.com/oauth/token`.

1. Then, select **Body** from the menu, and select **raw** **JSON**.  
![\[API request interface showing POST method, URL, and JSON body with OAuth parameters.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-18.png)

1. In the text box, enter the following code extract, replacing the fields with your credential values:

   ```
   {"grant_type": "authorization_code",
   "client_id": "YOUR_CLIENT_ID",
   "client_secret": "YOUR_CLIENT_SECRET",
   "code": "YOUR_AUTHORIZATION_CODE",
   "redirect_uri": "https://YOUR_APP_CALLBACK_URL"}
   ```

1. Then, select **Send**. If everything is configured correctly, Postman will return an `access-token`. Copy the access token and save it using a text editor of your choice. You will need it to connect Confluence (Cloud) to Amazon Q.

For more information, see [Implementing OAuth 2.0 (3LO)](https://developer.atlassian.com/cloud/oauth/getting-started/implementing-oauth-3lo/) in Atlassian Developer.

## Step 5: Generating a Confluence (Cloud) refresh token
<a name="confluence-cloud-credentials-refresh"></a>

The access token you use to connect Confluence (Cloud) to Amazon Q using OAuth 2.0 authentication expires after 1 hour. When it does, you can either repeat the whole authorization process and generate a new access token. Or, you can choose to generate a refresh token. You can use the refresh token to regenerate a new access token when an existing access token expires.

To do this, you add a `%20offline_access` parameter to the end of the `scope` value in the authorization URL you used to generate your access token. The following procedure shows you how to generate a refresh token.

**Generating an Confluence (Cloud) refresh token**

1. Log in to your account from the [Atlassian Developer page](https://developer.atlassian.com/).

1. Open the OAuth 2.0 app you want to generate a refresh token for.

1. From the left navigation menu, choose **Authorization** again. Then, for **OAuth 2.0 (3LO)**, choose **Configure**.

1. From the **Authorization** page, from **Authorization URL generator**, from **Granular Confluence API authorization URL**, copy the URL and save it in a text editor of your choice.  
![\[Authorization page showing URL generator fields for User identity, Classic, and Granular Confluence API.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-16.png)

1. In the saved authorization URL, update the `state=${YOUR_USER_BOUND_VALUE}` parameter value to any text of your choice. For example, `state=`*sample\$1text*.

   For more information, see [What is the state parameter used for?](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/#what-is-the-state-parameter-used-for-) in Atlassian Support.

1. Then, add the following text at the end of the `scope` value in your authorization URL: `%20offline_access` and copy it. For example:

   ```
   https://auth.atlassian.com/authorize?
   audience=api.atlassian.com 
   &client_id=YOUR_CLIENT_ID
   &scope=REQUESTED_SCOPE%20REQUESTED_SCOPE_TWO%20offline_access
   &redirect_uri=https://YOUR_APP_CALLBACK_URL
   &state=YOUR_USER_BOUND_VALUE 
   &response_type=code
   &prompt=consent
   ```

1. Open a web browser of your choice and paste the modified authorization URL you copied into the browser URL. On the page that opens up, make sure everything is correct and then select **Accept**.  
![\[Atlassian account access request screen showing permissions and a warning about development mode.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-17.png)

   You will be returned to the Confluence (Cloud) console.

1. Copy the URL of the Confluence (Cloud) home page and save it in a text editor of your choice. The URL contains the authorization code for your application. You will need this code to generate your Confluence (Cloud) refresh token. The whole section after `code=` is the authorization code.

1. Navigate to Postman.

   If you don't have Postman, you can also choose to use cURL to generate a Confluence (Cloud) access token. Use the following cURL command to do so:

   ```
   curl --location 'https://auth.atlassian.com/oauth/token' \
   --header 'Content-Type: application/json' \
   --data '{"grant_type": "authorization_code",
   "client_id": "YOUR CLIENT ID",
   "client_secret": "YOUR CLIENT SECRET",
   "code": "AUTHORIZATION CODE",
   "redirect_uri": "YOUR CALLBACK URL"}'
   ```

1. On the Postman home page, select `POST` as the method, and then enter the following URL in the **Enter URL or paste text** box: `https://auth.atlassian.com/oauth/token`.

1. Then, select **Body** from the menu, and select **raw** **JSON**.  
![\[API request interface showing POST method, URL, and JSON body with OAuth parameters.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-18.png)

1. In the text box, enter the following code extract, replacing the fields with your credential values:

   ```
   {"grant_type": "authorization_code",
   "client_id": "YOUR_CLIENT_ID",
   "client_secret": "YOUR_CLIENT_SECRET",
   "code": "YOUR_AUTHORIZATION_CODE",
   "redirect_uri": "https://YOUR_APP_CALLBACK_URL"}
   ```

1. Then, select **Send**. If everything is configured correctly, Postman will return an `refresh-token`.

   Copy the refresh token and save it using a text editor of your choice. You will need it to connect Confluence (Cloud) to Amazon Q.

For more information, see [Implementing a Refresh Token Flow](https://developer.atlassian.com/cloud/oauth/getting-started/refresh-tokens/) in Atlassian Developer.

## Step 6: Generating a new Confluence (Cloud) access token using a refresh token
<a name="confluence-cloud-credentials-refresh-access"></a>

You can use the refresh token you generated to create a new access token-refresh token pair when an existing access token expires. The following procedure shows you how to generate a refresh token.

**Generating an Confluence (Cloud) access token-refresh token pair**

1. Copy the refresh token you generated following the steps in [Step 5: Generating a Confluence (Cloud) refresh token](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-credentials.html#confluence-cloud-credentials-refresh).

1. Navigate to Postman.

   If you don't have Postman, you can also choose to use cURL to generate a new Confluence (Cloud) access token. Use the following cURL command to do so:

   ```
   curl --location 'https://auth.atlassian.com/oauth/token' \
   --header 'Content-Type: application/json' \
   --data '{"grant_type": "refresh_token",
   "client_id": "YOUR_CLIENT_ID",
   "client_secret": "YOUR_CLIENT_SECRET",
   "refresh_token": "YOUR_REFRESH_TOKEN"}'
   ```

1. On the Postman home page, select `POST` as the method, and then enter the following URL in the **Enter URL or paste text** box: `https://auth.atlassian.com/oauth/token`.

1. Then, select **Body** from the menu, and select **raw** **JSON**.  
![\[Screenshot of the Postman interface showing how to set up a POST request to refresh an access token using the refresh token.\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/images/confluence-20.png)

1. In the text box, enter the following code extract, replacing the fields with your credential values:

   ```
   {"grant_type": "refresh_token",
   "client_id": "YOUR_CLIENT_ID",
   "client_secret": "YOUR_CLIENT_SECRET",
   "refresh_token": "YOUR REFRESH TOKEN"}
   ```

1. Then, select **Send**. If everything is configured correctly, Postman will return a new access token-refresh token pair in the following format:

   ```
   {
   "access_token": "string,
   "expires_in": "expiry time of access_token in second",
   "scope": "string",
   "refresh_token": "string"
   }
   ```

For more information, see [Implementing a Refresh Token Flow](https://developer.atlassian.com/cloud/oauth/getting-started/refresh-tokens/) and [How do I get a new access token, if my access token expires or is revoked? ](https://developer.atlassian.com/cloud/jira/platform/oauth-2-3lo-apps/#how-do-i-get-a-new-access-token--if-my-access-token-expires-or-is-revoked-)in Atlassian Developer.

# How Amazon Q works with Confluence (Cloud) access and refresh tokens
<a name="confluence-cloud-credentials-notes"></a>

The following are important points to note about using Confluence (Cloud) access and refresh tokens with Amazon Q:
+ If a Confluence (Cloud) access token-refresh token pair you use to connect to Amazon Q are expired or invalid, the Amazon Q sync process fails. If this happens, you need to generate and provide a new pair of tokens.
+ If your access token is valid but you have an invalid refresh token, Amazon Q will sync data until the access token expires (up to 1 hour). After the access token expires, you won't be able to re-generate an access token-refresh token pair using the expired refresh token. When both access token and refresh token expire, the Amazon Q Confluence (Cloud) data source connector stops syncing.
+ If an access token expires during the Confluence (Cloud) connector sync process, the connector internally regenerates a new pair of tokens using the existing refresh token (if the provided refresh token is valid). After regenerating the new pair of tokens, the old pair is invalidated by Confluence (Cloud) and can't be re-used. To sync documents again after the connector auto-regenerates tokens, you must provide a new access token-refresh token pair.
+ If you use OAuth, select **Rotate secret** if you want Amazon Q to rotate the secret automatically so that you don’t have to manually update the secret every time before you sync. 
+ As a best practice, use Confluence (Cloud) OAuth and the **Rotate secret** feature for the Amazon Q connector.

# Checking Confluence (Cloud) connectivity
<a name="confluence-cloud-connection-check"></a>

Before you sync your Confluence (Cloud) data source connector after [configuring it](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-console.html), we recommend you check the connection between Amazon Q Business and Confluence (Cloud). The following are the cURL commands you need to check Confluence (Cloud) connectivity.

**Topics**
+ [Checking basic authentication connectivity](#confluence-cloud-connection-check-basic)

## Checking basic authentication connectivity
<a name="confluence-cloud-connection-check-basic"></a>

To check connectivity for a Confluence (Cloud) data source connector using basic authentication, use the following cURL command:

```
curl --location 'https://<confluence_host-url>/wiki/rest/api/user/current' 
--header 'Authorization: Basic <base64(email:api_token)>'
```

If your data source is connected as expected, the JSON response should resemble the following:

```
{
    "type": "known",
    "accountId": "accountId",
    "accountType": "atlassian",
    "email": "email",
    "publicName": "Administrator",
    "profilePicture": {
        "path": "/wiki/aa-avatar/<accountId>",
        "width": 48,
        "height": 48,
        "isDefault": false
    },
    "displayName": "Administrator",
    "isExternalCollaborator": false,
    "_expandable": {
        "operations": "",
        "personalSpace": ""
    },
    "_links": {
        "self": "https://<host_url>/wiki/rest/api/user?accountId=<accountId>",
        "base": "https://<host_url>/wiki",
        "context": "/wiki"
    }
}
```

If your Confluence (Cloud) connector is not connected correctly, you will see the following error:
+ CNF-5123: The profile value is invalid. Try again after sometime.

To troubleshoot the issue, check your Confluence (Cloud) URL and make sure it's correct.

# Connecting Amazon Q Business to Confluence (Cloud) using the console
<a name="confluence-cloud-console"></a>

The following procedure outlines how to connect Amazon Q Business to Confluence (Cloud) using the AWS Management Console.

**Connecting Amazon Q to Confluence (Cloud)**

1. Sign in to the AWS Management Console and open the Amazon Q Business console.

1. From the left navigation menu, choose **Data sources**.

1. From the **Data sources** page, choose **Add data source**.

1. Then, on the **Add data sources** page, from **Data sources**, add the **Confluence** data source to your Amazon Q application.

1. Then, on the **Confluence (Cloud)** data source page, enter the following information:

1. **Name and description**, do the following:
   + For **Data source name** – Name your data source for easy tracking.
**Note**  
You can include hyphens (-) but not spaces. Maximum of 1,000 alphanumeric characters.
   + **Description – *optional*** – Add an optional description for your data source. This text is viewed only by Amazon Q Business administrators and can be edited later.

1. In **Source**, enter the following information:

   1. In **Source**, for **Hosting Method**, choose ** Confluence Cloud**.

   1. ** Confluence URL** – Enter the Confluence host URLs. The format for the host URL that you enter is *https://example.atlassian.net*.
**Important**  
If you change or update your Confluence (Cloud) data source URL, you also need to update your Secrets Manager secret to ensure a secure connection.

1. **Authorization** – Amazon Q Business crawls ACL information by default to ensure responses are generated only from documents your end users have access to. If supported for your connector, you can manage ACLs by selecting ** Enable ACLs ** to enable ACLs or **Disable ACLs** to disable them. To manage ACLs, you need specific IAM permissions. See [Grant permission to create data sources with ACLs disabled](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/setting-up.html#DisableAclOnDataSource) for more details. See [Authorization](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-concepts.html#connector-authorization) for more details.

1. For **Authentication** – Choose between **Basic authentication** and **Oauth 2.0 authentication**, based on your use case.

1. **AWS Secrets Manager secret** – Choose an existing secret or create a Secrets Manager secret to store your Confluence authentication credentials. If you choose to create a secret, an AWS Secrets Manager secret window opens. Enter the following information in the window:

   1. **Secret name** – A name for your secret.

   1. If using **Basic Authentication** – Enter the **Secret name** **User name**, and **Password** ( Confluence API token) that you generated and downloaded from your Confluence account.

      If using **OAuth2.0 Authentication** – Enter the **Secret name**, **App key**, **App secret**, **Access token**, and **Refresh token** that you created in your Confluence account.
**Note**  
Select **Rotate secret** if you want Amazon Q to rotate the secret automatically so that you don’t have to manually update the secret every time before you sync. 

   1. Choose **Save and add secret**.

1. **Configure VPC and security group – *optional*** – Choose whether you want to use a VPC. If you do, enter the following information:

   1. **Subnets** – Select up to 6 repository subnets that define the subnets and IP ranges the repository instance uses in the selected VPC.

   1. **VPC security groups** – Choose up to 10 security groups that allow access to your data source. Ensure that the security group allows incoming traffic from Amazon EC2 instances and devices outside your VPC. For databases, security group instances are required. 

   For more information, see [VPC](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-concepts.html#connector-vpc).

1. **IAM role** – Choose an existing IAM role or create an IAM role to access your repository credentials and index content.
**Note**  
Creating a new service IAM role is recommended.

   For more information, see [IAM role](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-connector.html#confluence-cloud-iam).

1. In **Sync scope**, choose from the following options :

   1. In **Sync scope**, for **sync contents**, choose to sync from the following entity types: **Pages**, **Page comments**, **Page attachments**, **Blogs**, **Blog comments**, **Blog attachments**, **Personal spaces** **Archived spaces**, and **Archived pages**.
**Note**  
 **Page comments** and **Page attachments** can only be selected if you choose to sync **Pages**. **Blog comments** and **Blog attachments** can only be selected if you choose to sync **Blogs**.
**Important**  
You can crawl **Pages** and **Blogs** from one of more specific **Spaces**. If you don't specify a **Space key** regex pattern in **Additional configuration**, all **Pages** and **Blogs** will be crawled by default. If no **Space** is specified in the filter, all spaces will be crawled.

   1. **Multi-media content configuration – optional** – To enable content extraction from embedded images and visuals in documents, choose **Visual content in documents**.

      To extract audio transcriptions and video content, enable processing for the following file types:

   1. **Advanced settings**

      **Document deletion safeguard** - *optional*–To safeguard your documents from deletion during a sync job, select **On** and enter an integer between 0 - 100. If the percentage of documents to be deleted in your sync job exceeds the percentage you selected, the delete phase will be skipped and no documents from this data source will be deleted from your index. For more information, see [Document deletion safeguard](connector-concepts.md#document-deletion-safeguard).

   1. For **Maximum file size** – Specify the file size limit in MBs that Amazon Q will crawl. Amazon Q will crawl only the files within the size limit you define. The default file size is 50MB. The maximum file size should be greater than 0MB and less than or equal to 50MB.

   1. In **Additional configuration – *optional***, for **Space and regex patterns**, specify whether to include or exclude specific spaces, URLs, or file types in your index using the following:
      + **Space key** – For example, *my-space-123*. Select **Add** after entering each space key you want to add.
**Note**  
If you don't specify a **Space key** regex pattern in **Additional configuration**, all **Pages** and **Blogs** will be crawled by default. If no **Space** is specified in the filter, all spaces will be crawled.
      + **URL** – For example, *.\$1/MySite/MyDocuments/*. Select **Add** after entering each URL you want to add.
      + **File type** – For example, *.\$1\$1.pdf* or *.\$1\$1.txt*. Select **Add** after entering each file type you want to add.
      + For **Entity title regex patterns** – Specify regular expression patterns to include or exclude certain **Blogs**, **Pages**, **Comments**, and **Attachments** by titles.
**Note**  
If you want to crawl a specific page or subpage, you can use page title regex patterns to either include or exclude this page. Any valid regex pattern is supported. For example, if you use the regex `^QBusiness*`, any content starting with the word `QBusiness` followed by any number of characters will be filtered (`QBusiness_doc1` or `QBusiness`, but not `doc1_QBusiness`).

1. For **Sync mode**, choose how you want to update your index when your data source content changes. When you sync your data source with Amazon Q for the first time, all content is synced by default.
   + **Full sync** – Sync all content regardless of the previous sync status.
   + **New, modified, or deleted content sync** – Sync only new, modified, and deleted documents.

1. In **Sync run schedule**, for **Frequency** – Choose how often Amazon Q will sync with your data source. For more details, see [Sync run schedule](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-concepts.html#connector-sync-run). To learn how to start a data sync job, see [Starting data source connector sync jobs](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/supported-datasource-actions.html#start-datasource-sync-jobs).

1. **Tags - *optional*** – Add tags to search and filter your resources or track your AWS costs. See [Tags](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/tagging.html) for more details.

1. **Field mappings** – A list of data source document attributes to map to your index fields.
**Note**  
Add or update the fields from the **Data source details** page after you finish adding your data source. You can choose from two types of fields: 

   1. **Default** – Automatically created by Amazon Q on your behalf based on common fields in your data source. You can't edit these.

   1. **Custom** – Automatically created by Amazon Q on your behalf based on common fields in your data source. You can edit these. You can also create and add new custom fields.
**Note**  
Support for adding custom fields varies by connector. You won't see the **Add field** option if your connector doesn't support adding custom fields.

   For more information, see [Field mappings](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-concepts.html#connector-field-mappings).

1. In **Data source details**, choose **Sync now** to allow Amazon Q to begin syncing (crawling and ingesting) data from your data source. When the sync job finishes, your data source is ready to use.
**Note**  
View CloudWatch logs for your data source sync job by selecting **View CloudWatch logs**. If you encounter a `Resource not found exception` error, wait and try again as logs may not be available immediately.  
You can also view a detailed document-level report by selecting **View Report**. This report shows the status of each document during the crawl, sync, and index stages, including any errors. If the report is empty for an in-progress job, check back later as data is emitted to the report as events occur during the sync process.  
For more information, see [Troubleshooting data source connectors](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/troubleshooting-data-sources.html#troubleshooting-data-sources-not-indexed).

# Connecting Amazon Q Business to Confluence (Cloud) using APIs
<a name="confluence-cloud-api"></a>

You use the [CreateDataSource](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_CreateDataSource.html) action to connect a data source to your Amazon Q application. You can also use the [UpdateDataSource](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_UpdateDataSource.html) action to modify an existing data source configuration.

Then, you use the `configuration` parameter to provide a JSON blob that conforms the AWS-defined JSON schema.

For an example of the API request, see [CreateDataSource](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_CreateDataSource.html) and [UpdateDataSource](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_UpdateDataSource.html) in the Amazon Q API Reference.

**Topics**
+ [Confluence configuration properties](#confluence-configuration-keys)
+ [Confluence (Cloud) JSON schema](#confluence-cloud-json)
+ [Confluence (Cloud) JSON schema example](#confluence-cloud-api-json-example)

## Confluence configuration properties
<a name="confluence-configuration-keys"></a>

The following provides information about important configuration properties required in the schema.


| Configuration | Description | Type | Required | 
| --- | --- | --- | --- | 
| `connectionConfiguration` | Configuration information for the endpoint for the data source. | `object` This property has a sub-property called `repositoryEndpointMetadata`. | Yes | 
| `repositoryEndpointMetadata` | This is the endpoint information for the data source. This is a sub-property for the connectionConfiguration. | `object` This property has the following sub-properties. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-api.html) | Yes | 
| `hostUrl` | The URL for your Confluence instance. For example, https://example.confluence.com. | `string` Specify the URL in the pattern `https://*` | Yes | 
| `type` | The hosting method for your Confluence instance. | `string` The allowed values are `SAAS` or `ON_PREM`. | Yes | 
| `authType` | The authentication method for your Confluence instance. | `string` The allowed values are `Basic` or `OAuth2`. | Yes | 
| `repositoryConfigurations` | Configuration information for the content of the data source. For example, configuring specific types of content and field mappings. | `object` This property has the following sub-properties. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-api.html) | Yes | 
|  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-api.html)  | A list of objects that map the attributes or field names of your Confluence spaces, pages, blogs, comments, and attachments to Amazon Q index field names. | `object` These properties have the following sub-properties. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-api.html) | No | 
| `indexFieldName` | The field name of your Confluence spaces, pages, blogs, comments, or attachments. | `string`  | Yes | 
| `indexFieldType` | The field type of your Confluence spaces, pages, blogs, comments, or attachments. | `string` The allowed values are `STRING`, `STRING_LIST`, and `DATE`.  | Yes | 
| `dataSourceFieldName` | The data source field name of your Confluence spaces, pages, blogs, comments, or attachments. | `string`  | Yes | 
| `dateFieldFormat` | The date format of your Confluence spaces, pages, blogs, comments, or attachments. | `string` Specify the date format in the form `yyyy-MM-dd'T'HH:mm:ss'Z'`  | No | 
| `additionalProperties` | Additional configuration options for your content in your data source. | `object` This property has the following sub-properties. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-api.html) | Yes | 
| `isCrawlAcl` | Specify true to crawl access control information from documents. | `boolean` | No | 
| `isRotateSecret` | Specify true if you want to automatically rotate the secret. | `boolean` | No | 
| `fieldForUserId` | Specify field to use for UserId for ACL crawling. | `string` | No | 
| `proxyHost` | The host where the web proxy is required. The host name should be without protocol (http:// or https://). | `string` | Yes | 
| `proxyPort` | Port used by the host URL transport protocol. The port number should be a numeric value between 0 and 65535. | `string` | Yes | 
| `maxFileSizeInMegaBytes` | Specify the maximum single file size limit in MBs that Amazon Q will crawl. Amazon Q will crawl only the files within the size limit you define. The default file size is 50MB. The maximum file size should be greater than 0MB and less than or equal to 50MB. | `string` The allowed values are numbers between greater than 0 and less than or equal to 50. | No | 
| [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-api.html) | A list of regular expression patterns to include and/or exclude certain files in your Confluence data source. Files that match the patterns are included in the index. Files that don't match the patterns are excluded from the index. If a file matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the file isn't included in the index. | `array (string)` | No | 
|  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-api.html)  | Specify true to index files in your Confluence personal spaces, pages, blogs, page comments, page attachments, blog comments, and blog attachments. | `boolean` | No | 
| `type` | The type of data source. We recommend that you use CONFLUENCEV2 as your data source type. | `string` Valid values are `CONFLUENCEV2` and `CONFLUENCE`. | Yes | 
| `enableIdentityCrawler` | Specify `true` to activate identity crawler. Identity crawler is activated by default. See [Identity crawler](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-concepts.html#connector-identity-crawler) for more information. | `boolean` | Yes | 
| `syncMode` | Specify whether Amazon Q should update your index by syncing all documents or only new, modified, and deleted documents.  | `string` Valid values are `FORCED_FULL_CRAWL` and `FULL_CRAWL`. You can choose between the following options: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-api.html) | Yes | 
| `secretARN` | The Amazon Resource Name (ARN) of a Secrets Manager secret that contains the key-value pairs required to connect to your Confluence instance.  | `string` The minimum length is 20 and the maximum length is 2,048 characters. If you use basic authentication, the secret must contain a JSON structure with the following keys: <pre>{<br />    "username": "Confluence account user name",<br />    "password": "Confluence API token"<br />}</pre>If you use OAuth 2.0 authentication, the secret must contain a JSON structure with the following keys: <pre>{<br />    "confluenceAppKey": "app key for your Confluence account",<br />    "confluenceAppSecret": "app secret from your Confluence token",<br />    "confluenceAccessToken": "access token created in Confluence",<br />    "confluenceRefreshToken": "refresh token created in Confluence"<br />}</pre> | Yes | 
| `version` | The version of this template that's currently supported. | `string` | No | 

## Confluence (Cloud) JSON schema
<a name="confluence-cloud-json"></a>

The following is the Confluence (Cloud) JSON schema:

```
{
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "enum": ["CONFLUENCEV2", "CONFLUENCE"]
    },
    "syncMode": {
      "type": "string",
      "enum": ["FULL_CRAWL", "FORCED_FULL_CRAWL"]
    },
    "secretArn": {
      "type": "string",
      "minLength": 20,
      "maxLength": 2048
    },
    "enableIdentityCrawler": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "type": "string",
          "enum": ["true", "false"]
        }
      ]
    },
    "connectionConfiguration": {
      "type": "object",
      "properties": {
        "repositoryEndpointMetadata": {
          "type": "object",
          "properties": {
            "hostUrl": {
              "type": "string",
              "pattern": "https:.*"
            },
            "type": {
              "type": "string",
              "enum": ["SAAS"]
            },
            "authType": {
              "type": "string",
              "enum": ["Basic", "OAuth2"]
            }
          },
          "required": ["hostUrl", "type", "authType"]
        }
      },
      "required": ["repositoryEndpointMetadata"]
    },
    "repositoryConfigurations": {
      "type": "object",
      "properties": {
        "space": {
          "type": "object",
          "properties": {
            "fieldMappings": {
              "type": "array",
              "items": [
                {
                  "type": "object",
                  "properties": {
                    "indexFieldName": {
                      "type": "string"
                    },
                    "indexFieldType": {
                      "type": "string",
                      "enum": ["STRING", "STRING_LIST", "DATE"]
                    },
                    "dataSourceFieldName": {
                      "type": "string"
                    },
                    "dateFieldFormat": {
                      "type": "string",
                      "pattern": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                    }
                  },
                  "required": [
                    "indexFieldName",
                    "indexFieldType",
                    "dataSourceFieldName"
                  ]
                }
              ]
            }
          },
          "required": ["fieldMappings"]
        },
        "page": {
          "type": "object",
          "properties": {
            "fieldMappings": {
              "type": "array",
              "items": [
                {
                  "type": "object",
                  "properties": {
                    "indexFieldName": {
                      "type": "string"
                    },
                    "indexFieldType": {
                      "type": "string",
                      "enum": ["STRING", "STRING_LIST", "DATE", "LONG"]
                    },
                    "dataSourceFieldName": {
                      "type": "string"
                    },
                    "dateFieldFormat": {
                      "type": "string",
                      "pattern": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                    }
                  },
                  "required": [
                    "indexFieldName",
                    "indexFieldType",
                    "dataSourceFieldName"
                  ]
                }
              ]
            }
          },
          "required": ["fieldMappings"]
        },
        "blog": {
          "type": "object",
          "properties": {
            "fieldMappings": {
              "type": "array",
              "items": [
                {
                  "type": "object",
                  "properties": {
                    "indexFieldName": {
                      "type": "string"
                    },
                    "indexFieldType": {
                      "type": "string",
                      "enum": ["STRING", "STRING_LIST", "DATE", "LONG"]
                    },
                    "dataSourceFieldName": {
                      "type": "string"
                    },
                    "dateFieldFormat": {
                      "type": "string",
                      "pattern": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                    }
                  },
                  "required": [
                    "indexFieldName",
                    "indexFieldType",
                    "dataSourceFieldName"
                  ]
                }
              ]
            }
          },
          "required": ["fieldMappings"]
        },
        "comment": {
          "type": "object",
          "properties": {
            "fieldMappings": {
              "type": "array",
              "items": [
                {
                  "type": "object",
                  "properties": {
                    "indexFieldName": {
                      "type": "string"
                    },
                    "indexFieldType": {
                      "type": "string",
                      "enum": ["STRING", "STRING_LIST", "DATE", "LONG"]
                    },
                    "dataSourceFieldName": {
                      "type": "string"
                    },
                    "dateFieldFormat": {
                      "type": "string",
                      "pattern": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                    }
                  },
                  "required": [
                    "indexFieldName",
                    "indexFieldType",
                    "dataSourceFieldName"
                  ]
                }
              ]
            }
          },
          "required": ["fieldMappings"]
        },
        "attachment": {
          "type": "object",
          "properties": {
            "fieldMappings": {
              "type": "array",
              "items": [
                {
                  "type": "object",
                  "properties": {
                    "indexFieldName": {
                      "type": "string"
                    },
                    "indexFieldType": {
                      "type": "string",
                      "enum": ["STRING", "STRING_LIST", "DATE", "LONG"]
                    },
                    "dataSourceFieldName": {
                      "type": "string"
                    },
                    "dateFieldFormat": {
                      "type": "string",
                      "pattern": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                    }
                  },
                  "required": [
                    "indexFieldName",
                    "indexFieldType",
                    "dataSourceFieldName"
                  ]
                }
              ]
            }
          },
          "required": ["fieldMappings"]
        }
      }
    },
    "additionalProperties": {
      "type": "object",
      "properties": {
        "isCrawlAcl": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "fieldForUserId": {
          "type": "string"
        },
        "inclusionSpaceKeyFilter": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "exclusionSpaceKeyFilter": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "pageTitleRegEX": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "blogTitleRegEX": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "commentTitleRegEX": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "attachmentTitleRegEX": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "isCrawlPersonalSpace": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlArchivedSpace": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlArchivedPage": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlPage": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlBlog": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlPageComment": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlPageAttachment": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlBlogComment": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlBlogAttachment": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "maxFileSizeInMegaBytes": {
          "type": "string"
        },
        "inclusionFileTypePatterns": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "exclusionFileTypePatterns": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "inclusionUrlPatterns": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "exclusionUrlPatterns": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "proxyHost": {
          "type": "string"
        },
        "proxyPort": {
          "type": "string"
        },
        "enableDeletionProtection": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ],
          "default": false
        },
        "deletionProtectionThreshold": {
          "type": "string",
          "default": "15"
        }
      },
      "required": []
    }
  },
  "version": {
    "type": "string",
    "anyOf": [
      {
        "pattern": "1.0.0"
      }
    ]
  },
  "required": [
    "type",
    "syncMode",
    "secretArn",
    "connectionConfiguration",
    "repositoryConfigurations",
    "additionalProperties"
  ]
}
```

## Confluence (Cloud) JSON schema example
<a name="confluence-cloud-api-json-example"></a>

The following is the Confluence (Cloud) JSON schema example:

```
{
  "type": "CONFLUENCEV2",
  "syncMode": "FULL_CRAWL",
  "secretArn": "arn:aws:secretsmanager:us-west-2:123456789012:secret:my-confluence-secret",
  "enableIdentityCrawler": "true",
  "connectionConfiguration": {
    "repositoryEndpointMetadata": {
      "hostUrl": "https://mycompany.atlassian.net",
      "type": "SAAS",
      "authType": "OAuth2"
    }
  },
  "repositoryConfigurations": {
    "space": {
      "fieldMappings": [
        {
          "indexFieldName": "space_id",
          "indexFieldType": "STRING",
          "dataSourceFieldName": "id",
          "dateFieldFormat": "yyyy-MM-dd'T'HH:mm:ss'Z'"
        }
      ]
    },
    "page": {
      "fieldMappings": [
        {
          "indexFieldName": "page_id",
          "indexFieldType": "STRING",
          "dataSourceFieldName": "id",
          "dateFieldFormat": "yyyy-MM-dd'T'HH:mm:ss'Z'"
        }
      ]
    },
    "blog": {
      "fieldMappings": [
        {
          "indexFieldName": "blog_id",
          "indexFieldType": "STRING",
          "dataSourceFieldName": "id",
          "dateFieldFormat": "yyyy-MM-dd'T'HH:mm:ss'Z'"
        }
      ]
    },
    "comment": {
      "fieldMappings": [
        {
          "indexFieldName": "comment_id",
          "indexFieldType": "STRING",
          "dataSourceFieldName": "id",
          "dateFieldFormat": "yyyy-MM-dd'T'HH:mm:ss'Z'"
        }
      ]
    },
    "attachment": {
      "fieldMappings": [
        {
          "indexFieldName": "attachment_id",
          "indexFieldType": "STRING",
          "dataSourceFieldName": "id",
          "dateFieldFormat": "yyyy-MM-dd'T'HH:mm:ss'Z'"
        }
      ]
    }
  },
  "additionalProperties": {
    "isCrawlAcl": "true",
    "fieldForUserId": "user_id",
    "inclusionSpaceKeyFilter": ["SPACE1", "SPACE2"],
    "exclusionSpaceKeyFilter": ["SPACE3"],
    "pageTitleRegEX": ["^.*$"],
    "blogTitleRegEX": ["^.*$"],
    "commentTitleRegEX": ["^.*$"],
    "attachmentTitleRegEX": ["^.*$"],
    "isCrawlPersonalSpace": "false",
    "isCrawlArchivedSpace": "false",
    "isCrawlArchivedPage": "true",
    "isCrawlPage": "true",
    "isCrawlBlog": "true",
    "isCrawlPageComment": "false",
    "isCrawlPageAttachment": "false",
    "isCrawlBlogComment": "true",
    "isCrawlBlogAttachment": "true",
    "maxFileSizeInMegaBytes": "50",
    "inclusionFileTypePatterns": ["*.pdf", "*.docx"],
    "exclusionFileTypePatterns": ["*.tmp"],
    "inclusionUrlPatterns": ["*"],
    "exclusionUrlPatterns": ["*.tmp"],
    "enableDeletionProtection": "false",
    "deletionProtectionThreshold": "15"
  }
}
```

# Connecting Amazon Q Business to Confluence (Cloud) using AWS CloudFormation
<a name="confluence-cloud-cfn"></a>

You use the [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-datasource.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-datasource.html) resource to connect a data source to your Amazon Q application.

Use the [https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-datasource.html#cfn-qbusiness-datasource-applicationid](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-datasource.html#cfn-qbusiness-datasource-applicationid) property to provide a JSON or YAML schema with the necessary configuration details specific to your data source connector.

To learn more about AWS CloudFormation, see [What is AWS CloudFormation?](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html) in the *CloudFormation User Guide*.

**Topics**
+ [Confluence configuration properties](#confluence-configuration-keys)
+ [Confluence (Cloud) JSON schema for using the configuration property with AWS CloudFormation](#confluence-cloud-cfn-json)
+ [Confluence (Cloud) YAML schema for using the configuration property with AWS CloudFormation](#confluence-cloud-cfn-yaml)

## Confluence configuration properties
<a name="confluence-configuration-keys"></a>

The following provides information about important configuration properties required in the schema.


| Configuration | Description | Type | Required | 
| --- | --- | --- | --- | 
| `connectionConfiguration` | Configuration information for the endpoint for the data source. | `object` This property has a sub-property called `repositoryEndpointMetadata`. | Yes | 
| `repositoryEndpointMetadata` | This is the endpoint information for the data source. This is a sub-property for the connectionConfiguration. | `object` This property has the following sub-properties. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-cfn.html) | Yes | 
| `hostUrl` | The URL for your Confluence instance. For example, https://example.confluence.com. | `string` Specify the URL in the pattern `https://*` | Yes | 
| `type` | The hosting method for your Confluence instance. | `string` The allowed values are `SAAS` or `ON_PREM`. | Yes | 
| `authType` | The authentication method for your Confluence instance. | `string` The allowed values are `Basic` or `OAuth2`. | Yes | 
| `repositoryConfigurations` | Configuration information for the content of the data source. For example, configuring specific types of content and field mappings. | `object` This property has the following sub-properties. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-cfn.html) | Yes | 
|  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-cfn.html)  | A list of objects that map the attributes or field names of your Confluence spaces, pages, blogs, comments, and attachments to Amazon Q index field names. | `object` These properties have the following sub-properties. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-cfn.html) | No | 
| `indexFieldName` | The field name of your Confluence spaces, pages, blogs, comments, or attachments. | `string`  | Yes | 
| `indexFieldType` | The field type of your Confluence spaces, pages, blogs, comments, or attachments. | `string` The allowed values are `STRING`, `STRING_LIST`, and `DATE`.  | Yes | 
| `dataSourceFieldName` | The data source field name of your Confluence spaces, pages, blogs, comments, or attachments. | `string`  | Yes | 
| `dateFieldFormat` | The date format of your Confluence spaces, pages, blogs, comments, or attachments. | `string` Specify the date format in the form `yyyy-MM-dd'T'HH:mm:ss'Z'`  | No | 
| `additionalProperties` | Additional configuration options for your content in your data source. | `object` This property has the following sub-properties. [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-cfn.html) | Yes | 
| `isCrawlAcl` | Specify true to crawl access control information from documents. | `boolean` | No | 
| `isRotateSecret` | Specify true if you want to automatically rotate the secret. | `boolean` | No | 
| `fieldForUserId` | Specify field to use for UserId for ACL crawling. | `string` | No | 
| `proxyHost` | The host where the web proxy is required. The host name should be without protocol (http:// or https://). | `string` | Yes | 
| `proxyPort` | Port used by the host URL transport protocol. The port number should be a numeric value between 0 and 65535. | `string` | Yes | 
| `maxFileSizeInMegaBytes` | Specify the maximum single file size limit in MBs that Amazon Q will crawl. Amazon Q will crawl only the files within the size limit you define. The default file size is 50MB. The maximum file size should be greater than 0MB and less than or equal to 50MB. | `string` The allowed values are numbers between greater than 0 and less than or equal to 50. | No | 
| [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-cfn.html) | A list of regular expression patterns to include and/or exclude certain files in your Confluence data source. Files that match the patterns are included in the index. Files that don't match the patterns are excluded from the index. If a file matches both an inclusion and exclusion pattern, the exclusion pattern takes precedence and the file isn't included in the index. | `array (string)` | No | 
|  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-cfn.html)  | Specify true to index files in your Confluence personal spaces, pages, blogs, page comments, page attachments, blog comments, and blog attachments. | `boolean` | No | 
| `type` | The type of data source. We recommend that you use CONFLUENCEV2 as your data source type. | `string` Valid values are `CONFLUENCEV2` and `CONFLUENCE`. | Yes | 
| `enableIdentityCrawler` | Specify `true` to activate identity crawler. Identity crawler is activated by default. See [Identity crawler](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-concepts.html#connector-identity-crawler) for more information. | `boolean` | Yes | 
| `syncMode` | Specify whether Amazon Q should update your index by syncing all documents or only new, modified, and deleted documents.  | `string` Valid values are `FORCED_FULL_CRAWL` and `FULL_CRAWL`. You can choose between the following options: [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/confluence-cloud-cfn.html) | Yes | 
| `secretARN` | The Amazon Resource Name (ARN) of a Secrets Manager secret that contains the key-value pairs required to connect to your Confluence instance.  | `string` The minimum length is 20 and the maximum length is 2,048 characters. If you use basic authentication, the secret must contain a JSON structure with the following keys: <pre>{<br />    "username": "Confluence account user name",<br />    "password": "Confluence API token"<br />}</pre>If you use OAuth 2.0 authentication, the secret must contain a JSON structure with the following keys: <pre>{<br />    "confluenceAppKey": "app key for your Confluence account",<br />    "confluenceAppSecret": "app secret from your Confluence token",<br />    "confluenceAccessToken": "access token created in Confluence",<br />    "confluenceRefreshToken": "refresh token created in Confluence"<br />}</pre> | Yes | 
| `version` | The version of this template that's currently supported. | `string` | No | 

## Confluence (Cloud) JSON schema for using the configuration property with AWS CloudFormation
<a name="confluence-cloud-cfn-json"></a>

The following is the Confluence (Cloud) JSON schema and examples for the configuration property for AWS CloudFormation.

**Topics**
+ [Confluence (Cloud) JSON schema for using the configuration property with AWS CloudFormation](#confluence-cloud-cfn-json-schema)
+ [Confluence (Cloud) JSON schema example for using the configuration property with AWS CloudFormation](#confluence-cloud-cfn-json-example)

### Confluence (Cloud) JSON schema for using the configuration property with AWS CloudFormation
<a name="confluence-cloud-cfn-json-schema"></a>

The following is the Confluence (Cloud) JSON schema for the configuration property for CloudFormation

```
{
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "enum": ["CONFLUENCEV2", "CONFLUENCE"]
    },
    "syncMode": {
      "type": "string",
      "enum": ["FULL_CRAWL", "FORCED_FULL_CRAWL"]
    },
    "secretArn": {
      "type": "string",
      "minLength": 20,
      "maxLength": 2048
    },
    "enableIdentityCrawler": {
      "anyOf": [
        {
          "type": "boolean"
        },
        {
          "type": "string",
          "enum": ["true", "false"]
        }
      ]
    },
    "connectionConfiguration": {
      "type": "object",
      "properties": {
        "repositoryEndpointMetadata": {
          "type": "object",
          "properties": {
            "hostUrl": {
              "type": "string",
              "pattern": "https:.*"
            },
            "type": {
              "type": "string",
              "enum": ["SAAS"]
            },
            "authType": {
              "type": "string",
              "enum": ["Basic", "OAuth2"]
            }
          },
          "required": ["hostUrl", "type", "authType"]
        }
      },
      "required": ["repositoryEndpointMetadata"]
    },
    "repositoryConfigurations": {
      "type": "object",
      "properties": {
        "space": {
          "type": "object",
          "properties": {
            "fieldMappings": {
              "type": "array",
              "items": [
                {
                  "type": "object",
                  "properties": {
                    "indexFieldName": {
                      "type": "string"
                    },
                    "indexFieldType": {
                      "type": "string",
                      "enum": ["STRING", "STRING_LIST", "DATE"]
                    },
                    "dataSourceFieldName": {
                      "type": "string"
                    },
                    "dateFieldFormat": {
                      "type": "string",
                      "pattern": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                    }
                  },
                  "required": [
                    "indexFieldName",
                    "indexFieldType",
                    "dataSourceFieldName"
                  ]
                }
              ]
            }
          },
          "required": ["fieldMappings"]
        },
        "page": {
          "type": "object",
          "properties": {
            "fieldMappings": {
              "type": "array",
              "items": [
                {
                  "type": "object",
                  "properties": {
                    "indexFieldName": {
                      "type": "string"
                    },
                    "indexFieldType": {
                      "type": "string",
                      "enum": ["STRING", "STRING_LIST", "DATE", "LONG"]
                    },
                    "dataSourceFieldName": {
                      "type": "string"
                    },
                    "dateFieldFormat": {
                      "type": "string",
                      "pattern": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                    }
                  },
                  "required": [
                    "indexFieldName",
                    "indexFieldType",
                    "dataSourceFieldName"
                  ]
                }
              ]
            }
          },
          "required": ["fieldMappings"]
        },
        "blog": {
          "type": "object",
          "properties": {
            "fieldMappings": {
              "type": "array",
              "items": [
                {
                  "type": "object",
                  "properties": {
                    "indexFieldName": {
                      "type": "string"
                    },
                    "indexFieldType": {
                      "type": "string",
                      "enum": ["STRING", "STRING_LIST", "DATE", "LONG"]
                    },
                    "dataSourceFieldName": {
                      "type": "string"
                    },
                    "dateFieldFormat": {
                      "type": "string",
                      "pattern": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                    }
                  },
                  "required": [
                    "indexFieldName",
                    "indexFieldType",
                    "dataSourceFieldName"
                  ]
                }
              ]
            }
          },
          "required": ["fieldMappings"]
        },
        "comment": {
          "type": "object",
          "properties": {
            "fieldMappings": {
              "type": "array",
              "items": [
                {
                  "type": "object",
                  "properties": {
                    "indexFieldName": {
                      "type": "string"
                    },
                    "indexFieldType": {
                      "type": "string",
                      "enum": ["STRING", "STRING_LIST", "DATE", "LONG"]
                    },
                    "dataSourceFieldName": {
                      "type": "string"
                    },
                    "dateFieldFormat": {
                      "type": "string",
                      "pattern": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                    }
                  },
                  "required": [
                    "indexFieldName",
                    "indexFieldType",
                    "dataSourceFieldName"
                  ]
                }
              ]
            }
          },
          "required": ["fieldMappings"]
        },
        "attachment": {
          "type": "object",
          "properties": {
            "fieldMappings": {
              "type": "array",
              "items": [
                {
                  "type": "object",
                  "properties": {
                    "indexFieldName": {
                      "type": "string"
                    },
                    "indexFieldType": {
                      "type": "string",
                      "enum": ["STRING", "STRING_LIST", "DATE", "LONG"]
                    },
                    "dataSourceFieldName": {
                      "type": "string"
                    },
                    "dateFieldFormat": {
                      "type": "string",
                      "pattern": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                    }
                  },
                  "required": [
                    "indexFieldName",
                    "indexFieldType",
                    "dataSourceFieldName"
                  ]
                }
              ]
            }
          },
          "required": ["fieldMappings"]
        }
      }
    },
    "additionalProperties": {
      "type": "object",
      "properties": {
        "isCrawlAcl": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "fieldForUserId": {
          "type": "string"
        },
        "inclusionSpaceKeyFilter": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "exclusionSpaceKeyFilter": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "pageTitleRegEX": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "blogTitleRegEX": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "commentTitleRegEX": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "attachmentTitleRegEX": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "isCrawlPersonalSpace": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlArchivedSpace": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlArchivedPage": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlPage": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlBlog": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlPageComment": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlPageAttachment": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlBlogComment": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "isCrawlBlogAttachment": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ]
        },
        "maxFileSizeInMegaBytes": {
          "type": "string"
        },
        "inclusionFileTypePatterns": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "exclusionFileTypePatterns": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "inclusionUrlPatterns": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "exclusionUrlPatterns": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "proxyHost": {
          "type": "string"
        },
        "proxyPort": {
          "type": "string"
        },
        "enableDeletionProtection": {
          "anyOf": [
            {
              "type": "boolean"
            },
            {
              "type": "string",
              "enum": ["true", "false"]
            }
          ],
          "default": false
        },
        "deletionProtectionThreshold": {
          "type": "string",
          "default": "15"
        }
      },
      "required": []
    }
  },
  "version": {
    "type": "string",
    "anyOf": [
      {
        "pattern": "1.0.0"
      }
    ]
  },
  "required": [
    "type",
    "syncMode",
    "secretArn",
    "connectionConfiguration",
    "repositoryConfigurations",
    "additionalProperties"
  ]
}
```

### Confluence (Cloud) JSON schema example for using the configuration property with AWS CloudFormation
<a name="confluence-cloud-cfn-json-example"></a>

The following is the Confluence (Cloud) JSON schema example for the configuration property for CloudFormation

```
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "CloudFormation CONFLUENCE Data Source Template",
  "Resources": {
    "DataSourceConfluence": {
      "Type": "AWS::QBusiness::DataSource",
      "Properties": {
        "ApplicationId": "app12345-1234-1234-1234-123456789012",
        "IndexId": "indx1234-1234-1234-1234-123456789012",
        "DisplayName": "MyConfluenceDataSource",
        "RoleArn": "arn:aws:iam::123456789012:role/qbusiness-data-source-role",
        "Configuration": {
          "type": "CONFLUENCEV2",
          "syncMode": "FULL_CRAWL",
          "secretArn": "arn:aws:secretsmanager:us-west-2:123456789012:secret:my-confluence-secret",
          "enableIdentityCrawler": "true",
          "connectionConfiguration": {
            "repositoryEndpointMetadata": {
              "hostUrl": "https://mycompany.atlassian.net",
              "type": "SAAS",
              "authType": "OAuth2"
            }
          },
          "repositoryConfigurations": {
            "space": {
              "fieldMappings": [
                {
                  "indexFieldName": "space_id",
                  "indexFieldType": "STRING",
                  "dataSourceFieldName": "id",
                  "dateFieldFormat": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                }
              ]
            },
            "page": {
              "fieldMappings": [
                {
                  "indexFieldName": "page_id",
                  "indexFieldType": "STRING",
                  "dataSourceFieldName": "id",
                  "dateFieldFormat": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                }
              ]
            },
            "blog": {
              "fieldMappings": [
                {
                  "indexFieldName": "blog_id",
                  "indexFieldType": "STRING",
                  "dataSourceFieldName": "id",
                  "dateFieldFormat": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                }
              ]
            },
            "comment": {
              "fieldMappings": [
                {
                  "indexFieldName": "comment_id",
                  "indexFieldType": "STRING",
                  "dataSourceFieldName": "id",
                  "dateFieldFormat": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                }
              ]
            },
            "attachment": {
              "fieldMappings": [
                {
                  "indexFieldName": "attachment_id",
                  "indexFieldType": "STRING",
                  "dataSourceFieldName": "id",
                  "dateFieldFormat": "yyyy-MM-dd'T'HH:mm:ss'Z'"
                }
              ]
            }
          },
          "additionalProperties": {
            "isCrawlAcl": "true",
            "fieldForUserId": "user_id",
            "inclusionSpaceKeyFilter": ["SPACE1", "SPACE2"],
            "exclusionSpaceKeyFilter": ["SPACE3"],
            "pageTitleRegEX": ["^.*$"],
            "blogTitleRegEX": ["^.*$"],
            "commentTitleRegEX": ["^.*$"],
            "attachmentTitleRegEX": ["^.*$"],
            "isCrawlPersonalSpace": "false",
            "isCrawlArchivedSpace": "false",
            "isCrawlArchivedPage": "true",
            "isCrawlPage": "true",
            "isCrawlBlog": "true",
            "isCrawlPageComment": "false",
            "isCrawlPageAttachment": "false",
            "isCrawlBlogComment": "true",
            "isCrawlBlogAttachment": "true",
            "maxFileSizeInMegaBytes": "50",
            "inclusionFileTypePatterns": ["*.pdf", "*.docx"],
            "exclusionFileTypePatterns": ["*.tmp"],
            "inclusionUrlPatterns": ["*"],
            "exclusionUrlPatterns": ["*.tmp"],
            "enableDeletionProtection": "false",
            "deletionProtectionThreshold": "15"
          }
        }
      }
    }
  }
}
```

## Confluence (Cloud) YAML schema for using the configuration property with AWS CloudFormation
<a name="confluence-cloud-cfn-yaml"></a>

The following is the Confluence (Cloud) YAML schema and examples for the configuration property for AWS CloudFormation:

**Topics**
+ [Confluence (Cloud) YAML schema for using the configuration property with AWS CloudFormation](#confluence-cloud-cfn-yaml-schema)
+ [Confluence (Cloud) YAML schema example for using the configuration property with AWS CloudFormation](#confluence-cloud-cfn-yaml-example)

### Confluence (Cloud) YAML schema for using the configuration property with AWS CloudFormation
<a name="confluence-cloud-cfn-yaml-schema"></a>

The following is the Confluence (Cloud) YAML schema for the configuration property for CloudFormation.

```
type: object
properties:
  type:
    type: string
    enum:
      - CONFLUENCEV2
      - CONFLUENCE
  syncMode:
    type: string
    enum:
      - FULL_CRAWL
      - FORCED_FULL_CRAWL
  secretArn:
    type: string
    minLength: 20
    maxLength: 2048
  enableIdentityCrawler:
    anyOf:
      - type: boolean
      - type: string
        enum:
          - "true"
          - "false"
  connectionConfiguration:
    type: object
    properties:
      repositoryEndpointMetadata:
        type: object
        properties:
          hostUrl:
            type: string
            pattern: "https:.*"
          type:
            type: string
            enum:
              - SAAS
          authType:
            type: string
            enum:
              - Basic
              - OAuth2
        required:
          - hostUrl
          - type
          - authType
    required:
      - repositoryEndpointMetadata
  repositoryConfigurations:
    type: object
    properties:
      space:
        type: object
        properties:
          fieldMappings:
            type: array
            items:
              type: object
              properties:
                indexFieldName:
                  type: string
                indexFieldType:
                  type: string
                  enum:
                    - STRING
                    - STRING_LIST
                    - DATE
                dataSourceFieldName:
                  type: string
                dateFieldFormat:
                  type: string
                  pattern: "yyyy-MM-dd'T'HH:mm:ss'Z'"
        required:
          - fieldMappings
      page:
        type: object
        properties:
          fieldMappings:
            type: array
            items:
              type: object
              properties:
                indexFieldName:
                  type: string
                indexFieldType:
                  type: string
                  enum:
                    - STRING
                    - STRING_LIST
                    - DATE
                    - LONG
                dataSourceFieldName:
                  type: string
                dateFieldFormat:
                  type: string
                  pattern: "yyyy-MM-dd'T'HH:mm:ss'Z'"
        required:
          - fieldMappings
      blog:
        type: object
        properties:
          fieldMappings:
            type: array
            items:
              type: object
              properties:
                indexFieldName:
                  type: string
                indexFieldType:
                  type: string
                  enum:
                    - STRING
                    - STRING_LIST
                    - DATE
                    - LONG
                dataSourceFieldName:
                  type: string
                dateFieldFormat:
                  type: string
                  pattern: "yyyy-MM-dd'T'HH:mm:ss'Z'"
        required:
          - fieldMappings
      comment:
        type: object
        properties:
          fieldMappings:
            type: array
            items:
              type: object
              properties:
                indexFieldName:
                  type: string
                indexFieldType:
                  type: string
                  enum:
                    - STRING
                    - STRING_LIST
                    - DATE
                    - LONG
                dataSourceFieldName:
                  type: string
                dateFieldFormat:
                  type: string
                  pattern: "yyyy-MM-dd'T'HH:mm:ss'Z'"
        required:
          - fieldMappings
      attachment:
        type: object
        properties:
          fieldMappings:
            type: array
            items:
              type: object
              properties:
                indexFieldName:
                  type: string
                indexFieldType:
                  type: string
                  enum:
                    - STRING
                    - STRING_LIST
                    - DATE
                    - LONG
                dataSourceFieldName:
                  type: string
                dateFieldFormat:
                  type: string
                  pattern: "yyyy-MM-dd'T'HH:mm:ss'Z'"
        required:
          - fieldMappings
  additionalProperties:
    type: object
    properties:
      isCrawlAcl:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
      fieldForUserId:
        type: string
      inclusionSpaceKeyFilter:
        type: array
        items:
          type: string
      exclusionSpaceKeyFilter:
        type: array
        items:
          type: string
      pageTitleRegEX:
        type: array
        items:
          type: string
      blogTitleRegEX:
        type: array
        items:
          type: string
      commentTitleRegEX:
        type: array
        items:
          type: string
      attachmentTitleRegEX:
        type: array
        items:
          type: string
      isCrawlPersonalSpace:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
      isCrawlArchivedSpace:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
      isCrawlArchivedPage:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
      isCrawlPage:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
      isCrawlBlog:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
      isCrawlPageComment:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
      isCrawlPageAttachment:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
      isCrawlBlogComment:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
      isCrawlBlogAttachment:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
      maxFileSizeInMegaBytes:
        type: string
      inclusionFileTypePatterns:
        type: array
        items:
          type: string
      exclusionFileTypePatterns:
        type: array
        items:
          type: string
      inclusionUrlPatterns:
        type: array
        items:
          type: string
      exclusionUrlPatterns:
        type: array
        items:
          type: string
      proxyHost:
        type: string
      proxyPort:
        type: string
      enableDeletionProtection:
        anyOf:
          - type: boolean
          - type: string
            enum:
              - "true"
              - "false"
        default: false
      deletionProtectionThreshold:
        type: string
        default: "15"
    required: []
version:
  type: string
  anyOf:
    - pattern: 1.0.0
required:
  - type
  - syncMode
  - secretArn
  - connectionConfiguration
  - repositoryConfigurations
  - additionalProperties
```

### Confluence (Cloud) YAML schema example for using the configuration property with AWS CloudFormation
<a name="confluence-cloud-cfn-yaml-example"></a>

The following is the Confluence (Cloud) YAML example for the Configuration property for CloudFormation:

```
AWSTemplateFormatVersion: "2010-09-09"
Description: CloudFormation CONFLUENCE Data Source Template
Resources:
  DataSourceConfluence:
    Type: AWS::QBusiness::DataSource
    Properties:
      ApplicationId: app12345-1234-1234-1234-123456789012
      IndexId: indx1234-1234-1234-1234-123456789012
      DisplayName: MyConfluenceDataSource
      RoleArn: arn:aws:iam::123456789012:role/qbusiness-data-source-role
      Configuration:
        type: CONFLUENCEV2
        syncMode: FULL_CRAWL
        secretArn: arn:aws:secretsmanager:us-west-2:123456789012:secret:my-confluence-secret
        enableIdentityCrawler: "true"
        connectionConfiguration:
          repositoryEndpointMetadata:
            hostUrl: https://mycompany.atlassian.net
            type: SAAS
            authType: OAuth2
        repositoryConfigurations:
          space:
            fieldMappings:
              - indexFieldName: space_id
                indexFieldType: STRING
                dataSourceFieldName: id
                dateFieldFormat: yyyy-MM-dd'T'HH:mm:ss'Z'
          page:
            fieldMappings:
              - indexFieldName: page_id
                indexFieldType: STRING
                dataSourceFieldName: id
                dateFieldFormat: yyyy-MM-dd'T'HH:mm:ss'Z'
          blog:
            fieldMappings:
              - indexFieldName: blog_id
                indexFieldType: STRING
                dataSourceFieldName: id
                dateFieldFormat: yyyy-MM-dd'T'HH:mm:ss'Z'
          comment:
            fieldMappings:
              - indexFieldName: comment_id
                indexFieldType: STRING
                dataSourceFieldName: id
                dateFieldFormat: yyyy-MM-dd'T'HH:mm:ss'Z'
          attachment:
            fieldMappings:
              - indexFieldName: attachment_id
                indexFieldType: STRING
                dataSourceFieldName: id
                dateFieldFormat: yyyy-MM-dd'T'HH:mm:ss'Z'
        additionalProperties:
          isCrawlAcl: "true"
          fieldForUserId: user_id
          inclusionSpaceKeyFilter:
            - SPACE1
            - SPACE2
          exclusionSpaceKeyFilter:
            - SPACE3
          pageTitleRegEX:
            - "^.*$"
          blogTitleRegEX:
            - "^.*$"
          commentTitleRegEX:
            - "^.*$"
          attachmentTitleRegEX:
            - "^.*$"
          isCrawlPersonalSpace: "false"
          isCrawlArchivedSpace: "false"
          isCrawlArchivedPage: "true"
          isCrawlPage: "true"
          isCrawlBlog: "true"
          isCrawlPageComment: "false"
          isCrawlPageAttachment: "false"
          isCrawlBlogComment: "true"
          isCrawlBlogAttachment: "true"
          maxFileSizeInMegaBytes: "50"
          inclusionFileTypePatterns:
            - "*.pdf"
            - "*.docx"
          exclusionFileTypePatterns:
            - "*.tmp"
          inclusionUrlPatterns:
            - "*"
          exclusionUrlPatterns:
            - "*.tmp"
          enableDeletionProtection: "false"
          deletionProtectionThreshold: "15"
```

# How Amazon Q Business connector crawls Confluence (Cloud) ACLs
<a name="confluence-cloud-user-management"></a>

Connectors support crawling ACL and identity information where applicable based on the data source. If you index documents without ACLs, all documents are considered public. Indexing documents with ACLs ensures data security.

Amazon Q Business supports crawling ACLs for document security by default.

When you connect a Confluence (Cloud) data source to Amazon Q Business, Amazon Q Business crawls ACL information attached to a document (user and group information) from your Confluence (Cloud) instance. If you choose to activate ACL crawling, the information can be used to filter chat responses based your end users' document access level.

The connector crawls the following Confluence resources:
+ **Spaces** – A collection of related pages, blogs, and attachments. Space permissions apply to all documents in the space by default.
+ **Pages** – Documents in a space where users create and manage content. Pages can contain text, images, tables, and multimedia elements, and can have nested pages. Each page is considered a single document. Pages can be restricted to specific users and groups in the space. A nested page inherits restrictions from the parent page, and can have its own restrictions.
+ **Blogs** – Content similar to pages, typically used for updates or announcements. Each blog post is considered as a single document. Blogs can be restricted to specific users and groups in the space.
+ **Comments** – Feedback and discussions on pages or blog post content. Comments are visible to viewers of the page or post.
+ **Attachments** – Files uploaded to pages or blog posts, such as images and documents.

The connector also crawls user principal information (local user alias, local group and federated group identity configurations) and its permissions for each configured space. The Confluence (Cloud) connector does not support crawling macros, whiteboards, or databases.

The connector updates ACL changes each time it crawls your data source content. To ensure that the correct users have access to the correct content, regularly re-sync your data source to capture any ACL updates.

You configure user and group access to spaces using the space permissions page. For pages and blogs, you use the restrictions page. For more information about space permissions, see [Space Permissions Overview](https://confluence.atlassian.com/doc/space-permissions-overview-139521.html) on the Confluence Support website. For more information about page and blog restrictions, see [ Page Restrictions ](https://confluence.atlassian.com/doc/page-restrictions-139414.html) on the Confluence Support website.

**Important**  
For user context filtering to work correctly, users' visibility must be set to **Anyone**. For more information, see [Set your email visibility](https://support.atlassian.com/confluence-cloud/docs/configure-user-email-visibility/) in Atlassian Developer Documentation.

The group and user IDs are mapped as follows:
+ `_group_ids` – Group names are present on spaces, pages, and blogs where there are restrictions. They're mapped from the name of the group in Confluence . Group names are always lower case.
+ `_user_id` – User names are present on the space, page, or blog where there are restrictions. They're mapped depending on the type of Confluence instance that you are using.

For Confluence (Cloud) – The `_user_id` is the account ID of the user.

For more information, see:
+ [Authorization](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-concepts.html#connector-authorization)
+ [Identity crawler](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-concepts.html#connector-identity-crawler)
+ [Understanding User Store](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-principal-store.html)

# Amazon Q Business Confluence (Cloud) data source connector field mappings
<a name="confluence-cloud-field-mappings"></a>

To improve retrieved results and customize the end user chat experience, Amazon Q Business enables you to map document attributes from your data sources to fields in your Amazon Q index.

Amazon Q offers two kinds of attributes to map to index fields:
+ **Reserved or default** – Reserved attributes are based on document attributes that commonly occur in most data. You can use reserved attributes to map commonly occurring document attributes in your data source to Amazon Q index fields.
+ **Custom** – You can create custom attributes to map document attributes that are unique to your data to Amazon Q index fields.

When you connect Amazon Q to a data source, Amazon Q automatically maps specific data source document attributes to fields within an Amazon Q index. If a document attribute in your data source doesn't have a attribute mapping already available, or if you want to map additional document attributes to index fields, use the custom field mappings to specify how a data source attribute maps to an Amazon Q index field. You create field mappings by editing your data source after your application environment and retriever are created.

To learn more about document attributes and how they work in Amazon Q, see [Document attributes and types in Amazon Q](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/doc-attributes-types.html).

**Important**  
Filtering using document attributes in chat is only supported through the API.

The Amazon Q Confluence connector supports the following entities and the associated reserved and custom attributes.

**Important**  
If you map any Confluence (Cloud) field to Amazon Q document title and document body fields, Amazon Q will generate responses from data in the document title and body.

**Topics**
+ [Space](#confluence-field-mappings-space)
+ [Page](#confluence-field-mappings-page)
+ [Blog](#confluence-field-mappings-blog)
+ [Comment](#confluence-field-mappings-comment)
+ [Attachment](#confluence-field-mappings-attachment)

## Space
<a name="confluence-field-mappings-space"></a>


| Confluence field name | Index field name | Description | Data type | 
| --- | --- | --- | --- | 
| spaceName | cf\$1sp\$1document\$1title | Custom | String | 
| itemType | \$1category | Default | String | 
| url | \$1source\$1uri | Default | String | 
| spaceKey | cf\$1space\$1key | Custom | String | 
| description | cf\$1description | Custom | String | 
| spaceType | cf\$1type | Custom | String | 

## Page
<a name="confluence-field-mappings-page"></a>


| Confluence field name | Index field name | Description | Data type | 
| --- | --- | --- | --- | 
| title | \$1cf\$1page\$1document\$1title | Custom | String | 
| authors | \$1authors | Default | String list | 
| createdDate | \$1created\$1at | Default | Date | 
| modifiedDate | \$1last\$1updated\$1at | Default | Date | 
| labels | cf\$1labels | Custom | String list | 
| version | cf\$1version | Custom | Long (numeric) | 
| itemType | \$1category | Default | String | 
| spaceKey | cf\$1space\$1key | Custom | String | 
| spaceName | cf\$1space\$1name | Custom | String | 
| url | \$1source\$1uri | Default | String | 
| status | cf\$1status | Custom | String | 
| parentId | cf\$1parent\$1id | Custom | String | 

## Blog
<a name="confluence-field-mappings-blog"></a>


| Confluence field name | Index field name | Description | Data type | 
| --- | --- | --- | --- | 
| title | cf\$1bg\$1document\$1title | Custom | String | 
| author | \$1authors | Default | String list | 
| publishedDate | \$1created\$1at | Default | Date | 
| labels | \$1source\$1uri | Default | String | 
| version | cf\$1version | Custom | Long (numeric) | 
| itemType | \$1category | Custom | String | 
| spaceKey | cf\$1space\$1key | Custom | String | 
| modifiedDate | \$1last\$1updated\$1at | Default | Date | 
| spaceName | cf\$1space\$1name | Custom | String | 
| status | cf\$1status | Custom | String | 
| url | \$1source\$1uri | Default | String | 
| parentId | cf\$1parent\$1id | Custom | String | 

## Comment
<a name="confluence-field-mappings-comment"></a>


| Confluence field name | Index field name | Description | Data type | 
| --- | --- | --- | --- | 
| title | cf\$1cmt\$1document\$1title | Custom | String | 
| author | \$1authors | Default | String list | 
| createdDate | \$1created\$1at | Default | Date | 
| version | cf\$1version | Custom | Long (numeric) | 
| itemType | \$1category | Default | String | 
| spaceKey | cf\$1space\$1key | Custom | String | 
| spaceName | cf\$1space\$1name | Custom | String | 
| contentType | cf\$1content\$1type | Custom | String | 
| url | \$1source\$1uri | Default | String | 
| parentId | cf\$1parent\$1id | Custom | String | 
| status | cf\$1status | Custom | String | 

## Attachment
<a name="confluence-field-mappings-attachment"></a>


| Confluence field name | Index field name | Description | Data type | 
| --- | --- | --- | --- | 
| fileName | cf\$1attachment\$1document\$1title | Custom | String | 
| author | \$1authors | Default | String list | 
| createdDate | \$1created\$1at | Default | Date | 
| labels | cf\$1labels | Custom | String list | 
| version | cf\$1version | Custom | Long (numeric) | 
| itemType | \$1category | Default | String | 
| spaceKey | cf\$1space\$1key | Custom | String | 
| contentType | cf\$1content\$1type | Custom | String | 
| modifiedDate | \$1last\$1updated\$1at | Default | Date | 
| fileSize | cf\$1file\$1size | Custom | Long (numeric) | 
| fileType | cf\$1attachment\$1file\$1type | Custom | String | 
| spaceName | cf\$1space\$1name | Custom | String | 
| documentId | \$1document\$1id | Default | String list | 
| url | \$1source\$1uri | Default | String | 
| parentId | cf\$1parent\$1id | Custom | String | 
| attachmentComment | cf\$1attachment\$1comment | Custom | String | 
| status | cf\$1status | Custom | String | 

# IAM role for Amazon Q Confluence (Cloud) connector
<a name="confluence-cloud-iam-role"></a>

If you use the AWS CLI or an AWS SDK, you must create an AWS Identity and Access Management (IAM) policy before you create an Amazon Q resource. When you call the [CreateDataSource](https://docs.aws.amazon.com/amazonq/latest/api-reference/API_CreateDataSource.html) operation, you provide the Amazon Resource Name (ARN) role with the policy attached.

If you use the AWS Management Console, you can create a new IAM role in the Amazon Q console or use an existing IAM role.

To learn more about IAM roles, see [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) in the *AWS Identity and Access Management User Guide*.

To connect your data source connector to Amazon Q, you must give Amazon Q an IAM role that has the following permissions:
+ Permission to access the `BatchPutDocument` and `BatchDeleteDocument` operations to ingest documents.
+ Permission to access the [User Store](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connector-principal-store.html) API operations to ingest user and group access control information from documents.
+ Permission to access your AWS Secrets Manager secret to authenticate your data source connector instance.
+ **(Optional)** If you're using Amazon VPC, permission to access your Amazon VPC.

```
{
  "Version": "2012-10-17",		 	 	 ,
  "Statement": [
    {
      "Sid": "AllowsAmazonQToGetSecret",
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": [
        "arn:aws:secretsmanager:{{region}}:{{account_id}}:secret:[[secret_id]]"
      ]
    },
    {
      "Sid": "AllowsAmazonQToDecryptSecret",
      "Effect": "Allow",
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": [
        "arn:aws:kms:{{region}}:{{account_id}}:key/[[key_id]]"
      ],
      "Condition": {
        "StringLike": {
          "kms:ViaService": [
            "secretsmanager.*.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "AllowsAmazonQToIngestDocuments",
      "Effect": "Allow",
      "Action": [
        "qbusiness:BatchPutDocument",
        "qbusiness:BatchDeleteDocument"
      ],
      "Resource": [
      "arn:aws:qbusiness:{{region}}:{{source_account}}:application/{{application_id}}",
      "arn:aws:qbusiness:{{region}}:{{source_account}}:application/{{application_id}}/index/{{index_id}}"
      ]
    },
    {
      "Sid": "AllowsAmazonQToIngestPrincipalMapping",
      "Effect": "Allow",
      "Action": [
        "qbusiness:PutGroup",
        "qbusiness:CreateUser",
        "qbusiness:DeleteGroup",
        "qbusiness:UpdateUser",
        "qbusiness:ListGroups"
      ],
      "Resource": [
        "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}",
        "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}",
        "arn:aws:qbusiness:{{region}}:{{account_id}}:application/{{application_id}}/index/{{index_id}}/data-source/*"
      ]
    },
    {
      "Sid": "AllowsAmazonQToCreateAndDeleteNI",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface"
      ],
      "Resource": [
        "arn:aws:ec2:{{region}}:{{account_id}}:subnet/[[subnet_ids]]",
        "arn:aws:ec2:{{region}}:{{account_id}}:security-group/[[security_group]]"
      ]
    },
    {
      "Sid": "AllowsAmazonQToCreateAndDeleteNIForSpecificTag",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:DeleteNetworkInterface"
      ],
      "Resource": "arn:aws:ec2:{{region}}:{{account_id}}:network-interface/*",
      "Condition": {
        "StringLike": {
          "aws:RequestTag/AMAZON_Q": "qbusiness_{{account_id}}_{{application_id}}_*"
        },
        "ForAllValues:StringEquals": {
          "aws:TagKeys": [
            "AMAZON_Q"
          ]
        }
      }
    },
    {
      "Sid": "AllowsAmazonQToCreateTags",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateTags"
      ],
      "Resource": "arn:aws:ec2:{{region}}:{{account_id}}:network-interface/*",
      "Condition": {
        "StringEquals": {
          "ec2:CreateAction": "CreateNetworkInterface"
        }
      }
    },
    {
      "Sid": "AllowsAmazonQToCreateNetworkInterfacePermission",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNetworkInterfacePermission"
      ],
      "Resource": "arn:aws:ec2:{{region}}:{{account_id}}:network-interface/*",
      "Condition": {
        "StringLike": {
          "aws:ResourceTag/AMAZON_Q": "qbusiness_{{account_id}}_{{application_id}}_*"
        }
      }
    },
   {
      "Sid": "AllowsAmazonQToDescribeResourcesForVPC",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeAvailabilityZones",
        "ec2:DescribeNetworkInterfaceAttribute",
        "ec2:DescribeVpcs",
        "ec2:DescribeRegions",
        "ec2:DescribeNetworkInterfacePermissions",
        "ec2:DescribeSubnets"
      ],
      "Resource": "*"
    }
  ]
}
```

**To allow Amazon Q to assume a role, you must also use the following trust policy:**

```
{
  "Version": "2012-10-17",		 	 	 ,
  "Statement": [
    {
      "Sid": "AllowsAmazonQServicePrincipal",
      "Effect": "Allow",
      "Principal": {
        "Service": "qbusiness.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "{{source_account}}"
        },
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:qbusiness:{{region}}:{{source_account}}:application/{{application_id}}"
        }
      }
    }
  ]
}
```

For more information on Amazon Q data source connector IAM roles, see [IAM roles for Amazon Q data source connectors](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/iam-roles.html#iam-roles-ds).

# Understand error codes in the Amazon Q Business Confluence (Cloud) connector
<a name="confluence-cloud-error-codes"></a>

The following table provides information about error codes you may see for the Confluence (Cloud) connector and suggested resolutions.


| Error code | Error message | Suggested resolution | 
| --- | --- | --- | 
|  CNF-5500  |  Null/empty username.  |  Provide username.  | 
|  CNF-5501  |  Error validating credentials due to Invalid username or password.  |  Provide valid username/password  | 
|  CNF-5502  |  Null/empty confluence AppKey.  |  Provide confluence AppKey.  | 
|  CNF-5503  |  Null/empty confluence Secret.  |  Provide confluence Secret.  | 
|  CNF-5504  |  Null/empty Client Access Token.  |  Provide Client Access Token.  | 
|  CNF-5505  |  Null/empty Client Refresh Token  |  Provide Client Refresh Token  | 
|  CNF-5506  |  Incorrect auth type.  |  Auth type should be Basic or OAuth2 or Personal-token.  | 
|  CNF-5507  |  Null/empty auth type.  |  Auth Type should not be null or empty value.  | 
|  CNF-5508  |  Empty/null host URL.  |  Host Url should not be null or empty value.  | 
|  CNF-5509  |  Null/empty crawl type.  |  Crawl Type should not be null or empty value.  | 
|  CNF-5510  |  Null/empty Repository Configurations.  |  Repository Configurations should not be null or empty value.  | 
|  CNF-5511  |  Incorrect type.  |  type should be SAAS or ON\$1PREM.  | 
|  CNF-5512  |  Invalid inclusion file type patterns.  |  Provide the correct inclusion patterns.  | 
|  CNF-5513  |  Invalid exclusion file type patterns.  |  Provide the correct exclusion patterns.  | 
|  CNF-5514  |  Invalid regex patterns.  |  Provide the correct regex patterns.  | 
|  CNF-5515  |  Error validating credentials due to invalid username or password.  |  Provide valid username and password.  | 
|  CNF-5516  |  Error validating credentials due to invalid client id or client secret.  |  Provide valid client id and client secret.  | 
|  CNF-5517  |  Error validating crawl type.  |  Provide valid crawl type.  | 
|  CNF-5518  |  Invalid URI.  |  Provide valid URI.  | 
|  CNF-5519  |  Null/empty DataSourceFieldName in Space Entity.  |  Provide value for DataSourceFieldName in Space Entity.  | 
|  CNF-5520  |  Null/empty IndexFieldName in Blog Entity.  | Provide value for IndexFieldName in Blog Entity.  | 
|  CNF-5521  |  Null/empty IndexFieldType in Space Entity.  |  Provide value for IndexFieldType in Space Entity.  | 
|  CNF-5522  |  Null/empty password.  |  Provide password.  | 
|  CNF-5523  |  Incorrect auth type.  |  Auth type should be Basic or OAuth2.  | 
|  CNF-5524  |  Null/empty DataSourceFieldName in Page Entity.  |  Provide value for DataSourceFieldName in Page Entity.  | 
|  CNF-5525  |  Null/empty DataSourceFieldName in Blog Entity  |  Please provide value for DataSourceFieldName in Blog Entity  | 
|  CNF-5526  |  Null/empty DataSourceFieldName in Comment Entity.  |  Provide value for DataSourceFieldName in Comment Entity.  | 
|  CNF-5527  |  Null/empty DataSourceFieldName in Attachment Entity.  |  Provide value for DataSourceFieldName in Attachment Entity.  | 
|  CNF-5528  |  Null/empty IndexFieldName.  |  IndexFieldName field can't be null or empty value.  | 
|  CNF-5529  |  Null/empty IndexFieldName in Space Entity.  |  Provide value for IndexFieldName in Space Entity.  | 
|  CNF-5530  |  Null/empty IndexFieldName in Page Entity  |  Please provide value for IndexFieldName in Page Entity  | 
|  CNF-5531  |  Invalid isCrawlPersonalSpace value.  |  isCrawlPersonalSpace should be a boolean value true or false.  | 
|  CNF-5532  |  Invalid isCrawlArchivedSpace value.  |  isCrawlArchivedSpace should be a boolean value true or false.  | 
|  CNF-5533  |  Invalid isCrawlArchivedPage value.  |  isCrawlArchivedPage should be a boolean value true or false.  | 
|  CNF-5534  |  Invalid isCrawlPage value.  |  isCrawlPage should be a boolean value true or false.  | 
|  CNF-5535  |  Invalid isCrawlBlogComment value.  |  isCrawlBlogComment should be a boolean value true or false.  | 
|  CNF-5536  |  Invalid isCrawlBlogComment value.  |  isCrawlBlogComment should be a boolean value true or false.  | 
|  CNF-5537  |  Invalid isCrawlBlogAttachment value.  |  isCrawlBlogAttachment should be a boolean value true or false.  | 
|  CNF-5538  |  Error validating on protocol.  |  Provide valid protocol.  | 
|  CNF-5539  |  Null/empty IndexFieldName in Comment Entity.  |  Provide value for IndexFieldName in Comment Entity.  | 
|  CNF-5540  |  Null/empty Personal Access Token.  |  Provide Personal Access Token.  | 
|  CNF-5541  |  Invalid OAuth value.  |  Give a valid OAuth URL.  | 
|  CNF-5542  |  Invalid Space value.  |  Give a valid Space URL.  | 
|  CNF-5543  |  Archived Space Exception.  |  Check Archived Space.  | 
|  CNF-5544  |  JSON Exception for Space.  |  Check Space.  | 
|  CNF-5545  |  JSON Exception for Comment.  |  Check Comment.  | 
|  CNF-5546  |  JSON Exception for Comment.  |  Check Comment.  | 
|  CNF-5547  |  JSON Exception for Comment.  |  Check Comment.  | 
|  CNF-5548  |  JSON Exception for Attachment.  |  Check Attachment.  | 
|  CNF-5549  |  JSON Exception for Blog.  |  Check Blog.  | 
|  CNF-5550  |  JSON Exception for Page.  |  Check Page.  | 
|  CNF-5551  |  JSON Exception for Label.  |  Check Label.  | 
|  CNF-5552  |  JSON Exception for ACL. |  Check ACL.  | 
|  CNF-5553  |  JSON Exception for Groups.  |  Check Groups.  | 
|  CNF-5554  |  JSON Exception for Group Members.  |  Check Group Members.  | 
|  CNF-5555  |  JSON Exception for Space Group.  |  Check Space Group.  | 
|  CNF-5556  |  Exception in CommentItem.  |  Check the CommentItem class.  | 
|  CNF-5557  |  Invalid isCrawlPageComment value.  |  isCrawlPageComment should be a boolean value true or false.  | 
|  CNF-5558  |  Invalid isCrawlPageAttachment value.  |  isCrawlPageAttachment should be a boolean value true or false.  | 
|  CNF-5559  |  Null/empty Repository Configurations.  |  Repository Configurations should not be null or empty value.  | 
|  CNF-5560  |  Null/empty IndexFieldName in Attachment.  |  Please provide value for IndexFieldName in Attachment Entity.  | 
|  CNF-5561  |  Invalid proxy url.  |  Proxy url should not contain http: or https.  | 
|  CNF-5562  |  Null/Empty proxy port.  |  Provide a valid proxy port.  | 
|  CNF-5563  |  Invalid Host URL.  |  Provide valid Host URL.  | 
|  CNF-5564  |  Invalid proxy port value.  |  Provide a valid proxy port.  | 
|  CNF-5565  |  Confluence server not reachable.  |  Provide a valid proxy and server details.  | 
|  CNF-5566  |  Null/empty IndexFieldType in Page Entity.  |  Provide value for IndexFieldType in Page Entity.  | 
|  CNF-5567  |  Null/empty IndexFieldType in Blog Entity.  |  Provide value for IndexFieldType in Blog Entity.  | 
|  CNF-5568  |  Null/empty IndexFieldType in Comment Entity.  |  Provide value for IndexFieldType in Comment Entity.  | 
|  CNF-5569  |  Null/empty IndexFieldType in Attachment.  |  Provide value for IndexFieldType in Attachment. Entity  | 
|  CNF-5570  |  JSON Exception for Content Ancestors.  |  Check your Ancestors.  | 
|  CNF-5571  |  Invalid Host URL Pattern.  |  Provide valid Host URL Pattern.  | 
|  CNF-5572  |  Error validating credentials due to Invalid access or refresh token.  |  Invalid AccessToken/RefreshToken.  | 