Comma

Share what Amazon Q Developer produced

Amazon Q is at its best on the jobs that produce a document: transform this Java 8 service and tell me what changed, review these IAM policies and list the over-broad ones, explain where this bill went. The answer arrives in a CLI session or a side panel, formatted nicely, on your machine.

Everyone who needs it is somewhere else. The platform team wants the transformation summary. Security wants the IAM findings. Finance wants the cost breakdown, and finance does not have a console login — nor should they need one to read a table.

Let Q publish it

Attach Comma's MCP server in .amazonq/mcp.json for the workspace (or in ~/.aws/amazonq/mcp.json for every project) with a scoped token, then write the standing rule once:

<!-- .amazonq/rules/publish-reports.md -->

When you finish something a human needs to read — a transformation summary, an
IAM or security review, a cost analysis, an upgrade plan — publish it to Comma
as an HTML report and reply with the URL. Do not paste the whole document into
the chat.

The report id is in `.comma-report-id`. Update that report rather than creating
a new one.

After that, "review our IAM policies" ends with a link that security can open, comment on, and come back to next quarter.

Why a report and not a pane

  • No AWS account required to read it. The audience for a cost review or a migration plan reaches well past the people with console access.
  • It renders. The file-by-file transformation table stays a table; the policy diff stays aligned. Markup is stored verbatim and served in a sandboxed iframe.
  • Comments land on the finding. "This role is used by the batch job, don't narrow it yet" stays attached to that row — see commenting on HTML.
  • Q can read the replies over the same MCP server, so the follow-up prompt is "address the open comments" — see letting an agent respond to comments.
  • Reruns keep the URL. A quarterly IAM review that updates one report id gives you a revision history of your own posture, at a link you can bookmark.

Worth knowing

  • Publish private first. An IAM review lists your roles; a cost analysis lists your spend. Start private and widen deliberately — see sharing & access control.
  • Scope the token down. reports:write only, unless you want replies. See scoped tokens for AI agents.
  • HTML body: 5 MB, and a transformation summary over a large codebase can get long. Publish the summary and link the full log rather than inlining it.
  • Nothing re-executes. Scheduled refreshes are routines — a monthly posture review that is current when you open it, rather than one somebody remembers to run.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Attach the MCP server →

Related