aws / aws/amazon-q-developer-cli

Feature Request: Add Directory-based File Access Control for `fs_read` in Amazon Q CLI

Open
#2,302 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Rust
Stars
2k
Forks
439
PR merge metrics
No merged PRs in 30d

Description

## Description
Currently, the `/tools untrust fs_read` command applies file access restrictions globally. This feature request proposes implementing granular, directory-based access control to provide a better balance between security and productivity.

## Current Behavior
- File access control is applied globally (all files either require permission or no files require permission)
- No way to specify directory-specific access controls
- Users must choose between unrestricted access or requiring permission for every file

## Proposed Behavior
Implement directory-based file access control with the following characteristics:
- Allow unrestricted file access within designated workspace/project directories
- Require explicit permission for file access outside workspace directories
- Configurable path-specific access controls

### Example Access Patterns:
- `/project-workspace/` → No permission required
- `/home/user/documents/` → Permission required
- `/etc/` → Permission required
- `/var/` → Permission required

## Use Case
This feature would benefit developers working in secure environments who need to:
- Work efficiently within their project directories without constant permission prompts
- Maintain security controls for system files and sensitive areas
- Have granular control over which directories require explicit permission

## Benefits
1. Enhanced security through more precise access control
2. Improved developer productivity within trusted workspaces
3. Better balance between security and usability
4. More flexible configuration options for different security requirements

## Documentation Reference
Current documentation: https://docs.aws.amazon.com/amazonq/latest/qdeveloper-ug/command-line-chat-security.html#command-line-chat-security-file-access

## Additional Context
This request comes from customer feedback in production environments where the current all-or-nothing approach to file access control is not optimal for their security and productivity needs.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.