Action Required: Amazon QuickSight Introduces Rules Datasets Flag for Row Level Security (RLS) Datasets
Summary:
On March 31st 2025, Amazon QuickSight launched a new feature that distinguishes between regular datasets and Rules datasets used for Row Level Security (RLS). This distinction for Rules dataset has been automatically flagged (both console and API) for RLS datasets applied to regular datasets before March 31 2025. This change requires action from dataset authors and admins when dealing with existing Rules datasets with ingestion issues or creating new Rules datasets going forward.
Documentation link here
Important Dates:
- March 31, 2025: Feature launch
- May 10, 2025: Deadline for updating API scripts for creating RLS datasets with new parameter UseAs: RLS_RULES
- August 1, 2025: Enforcement of strict ingestion rules begins in QuickSight for Rules datasets that were excluded
What’s Changing?
- Dataset Type Distinction:
QuickSight now differentiates between regular datasets (used for reporting) and Rules datasets (used for RLS). RLS datasets applied to regular datasets (before March 31 2025) will be automatically flagged as ‘Rules Dataset’ on the console.
The DescribeDataset API call will now include a new parameter: UseAs: RLS_RULES for Rules datasets.
2. Creation of New Rules Datasets:
Console: Select the new ‘NEW RULES DATASET’ option under NEW DATASET
Programmatic: Add the parameter UseAs: RLS_RULES when creating datasets.
3. Strict Ingestion Rules for RLS Datasets:
Amazon QuickSight has already identified existing customers with ingestion issues on Rules datasets. Communication will begin the week of April 7th. Starting August 1st 2025, QuickSight will start enforcing stricter ingestion rules in SPICE for those Rules datasets to ensure data integrity.
Previously: Issues like truncated strings or skipped rows were flagged but ingestion proceeded.
Starting August 1st: Such issues will cause ingestion to fail.
Authors must take action to review the ingestion summary report and address any string truncation or skipped row issues on their Rules datasets. Failing to take action will result in ingestion failures starting August 1st 2025 and could result in the RLS data being applied incorrectly.
Who is Affected?
- Dataset authors/admins creating new Rules datasets
- Authors with existing Rules datasets that have string truncation or skipped row issues in ingestion
Other FAQs:
Rules dataset creation:
If I already have an RLS dataset but haven’t applied to a regular dataset (before March 31), how will it be identified? If it is not flagged as a Rules dataset, how to convert it?
If you have an existing RLS dataset that was not applied to any dataset (by March 31st), it will be considered as a regular dataset and not flagged as a Rules dataset. In order to use this as a Rules dataset, duplicate the dataset and in the process of dataset creation, select DUPLICATE AS RULES DATASET option in the console or recreate the dataset with the parameter UseAs: RLS_RULES if creating programmatically
Rules dataset updates:
Once a dataset has been flagged as a Rules Dataset, will programmatically updating the Rules dataset cause any issues?
No. UpdateDataset API will not require UseAs parameter input. As noted earlier, once the dataset has been flagged as Regular vs Rules Dataset, UseAs parameter will be retroactively updated for rules datasets applied before March 31.
Other callouts:
- No impact to already identified Rules datasets without any ingestion issues
- No impact to regular datasets