Spent today trying to work out how to embed a Quick Chat agent into our web app and I’ve hit a wall on licensing.
Our setup: data comes from RDS into SPICE, every dataset has a user_id column, and we use RLS on that so each user only sees their own rows. Built a custom chat agent on top of those datasets.
I started with GenerateEmbedUrlForAnonymousUser since our app users don’t exist in Quick at all. Looked perfect - session capacity pricing, and I can pass SessionTags to drive tag-based RLS. But QuickChat isn’t a valid ExperienceConfiguration for the anonymous API, the docs only list Dashboard, DashboardVisual, GenerativeQnA and QSearchBar. So chat agents seem to be registered-user only.
Which means all 500+ of our end users need to be registered Quick users at Reader Pro. That’s ~$10k/month for people who’ll send a handful of messages each. Can’t justify it.
So:
Is anonymous embedding for chat agents on the roadmap, or is there capacity-based pricing for chat anywhere?
With registered-user chat embedding, can I scope data per end user at request time at all, or is RLS just tied to the user identity full stop?
If neither works, what should someone in our position be using instead? Bedrock Agents over the same data?
us-east-1, Quick Enterprise (Admin Pro), embedding via the Quick Suite SDK. Happy to share config if useful.
You’re correct that QuickChat isn’t in the GenerateEmbedUrlForAnonymousUser API. Only Dashboard, DashboardVisual, QSearchBar, and GenerativeQnA are supported (API reference). The embedded chat blog mentions anonymous user support as upcoming but with no timeline.
In the meantime, the Generative Q&A experience can serve as a bridge. It supports anonymous embedding and gives your users a conversational NLQ interface against structured data. You’d call GenerateEmbedUrlForAnonymousUser with ExperienceConfiguration.GenerativeQnA and pass each user’s identity via SessionTags for tag-based RLS. The anonymous Generative Q&A embedding docs have full code samples showing this pattern, and explicitly confirm that “tag-based row-level security can be used for anonymous user embedding of the Q bar.”
Two things to watch for:
For Topic required, The API requires an InitialTopicId. The Topics experience has recently evolved (legacy Topics vs. new-style dataset enrichment + multi-dataset Topics). See Moving from Legacy Topics to Dataset Q&A and Migrating to semantic datasets for the current recommended path.
For RLS reconfiguration, If your current RLS is rules-based (permissions dataset), you’ll need to switch to tag-based RLS (RowLevelPermissionTagConfiguration) for anonymous embedding. You define a tag key mapped to your user_id column, then pass the value via SessionTags at embed URL generation time. RLS with tags docs here.
For pricing, check the “Amazon Q questions Capacity pricing” section on the Quick Sight pricing page. It’s designed for embedded applications without provisioning individual users, so based on what’s listed there it should be significantly more manageable than per-seat Reader Pro. I’d reach out to your AWS account team to confirm how it applies to your expected usage. No need to go the Bedrock Agents route for this.
Hope this helps and let me know if you have any additional questions!