Amazon QuickSight is a fully managed, cloud-native business intelligence (BI) service that makes it easy to connect to your data, create interactive dashboards, and share these with tens of thousands of users, either within the QuickSight interface, or embedded in software as a service (SaaS) applications or web portals.
We’re excited to announce the availability of QuickSight APIs that enable administrators and developers to programmatically create and delete accounts with QuickSight Enterprise and Enterprise + Q editions. This allows developers and administrators to automate the deployment and teardown of QuickSight accounts in their organization at scale.
Feature overview
To create and delete QuickSight accounts programmatically, you can use the following APIs:
You need to have the correct AWS Identity and Access Management (IAM) permissions to sign up for QuickSight. For more information, see IAM policy examples for Amazon QuickSight. If your IAM policy includes both the Subscribe and CreateAccountSubscription actions, make sure that both actions are set to Allow. If either action is set to Deny, the Deny action prevails and your API call fails.
Create a QuickSight account
Use the CreateAccountSubscription API to create a QuickSight account:
POST /account/AwsAccountId HTTP/1.1
Content-type: application/json
{
"AccountName": "string",
"ActiveDirectoryName": "string",
"AdminGroup": [ "string" ],
"AuthenticationMethod": "string",
"AuthorGroup": [ "string" ],
"ContactNumber": "string",
"DirectoryId": "string",
"Edition": "string",
"EmailAddress": "string",
"FirstName": "string",
"LastName": "string",
"NotificationEmail": "string",
"ReaderGroup": [ "string" ],
"Realm": "string"
}
You can choose to subscribe to Enterprise or Enterprise + Q edition of QuickSight. You can choose the user authentication method: IAM only, IAM and QuickSight, or Active Directory. If you choose Active Directory, you need to provide an Active Directory name and an admin group associated with your Active Directory. Provide the notification email address that you want QuickSight to send notifications to regarding your QuickSight account or QuickSight subscription.
The following code shows the response for CreateAccountSubscription:
Describe a QuickSight account
Use the DescribeAccountSubscription API to receive a description of a QuickSight account’s subscription:
GET /account/AwsAccountId HTTP/1.1
A successful API call returns an AccountInfo object that includes an account’s name, subscription status, authentication type, edition, and notification email address:
Update and delete a QuickSight account
To avoid accidental deletion, a termination protection flag has been introduced. When a new QuickSight account is provisioned through the CreateAccountSubscription API or user interface, the termination protection flag is set to True by default. You can use the existing DescribeAccountSettings API to inquire the current value of the termination protection flag:
GET /account/AwsAccountId HTTP/1.1
The following code shows the response for DescribeAccountSettings:
HTTP/1.1 Status
Content-type: application/json
{
"AccountSettings": {
"AccountName": "string",
"Edition": "string",
"DefaultNamespace": "string",
"PublicSharingEnabled": "boolean",
"NotificationEmail": "string",
"TerminationProtectionEnabled": "boolean"
},
"RequestId": "string"
}
Use the UpdateAccountSettings API to disable the termination protection flag before proceeding with deleting the account. Optionally, this API can be used to update notification email:
PUT /accounts/{AwsAccountId}/settings HTTP/1.1
Content-type: application/json
{
"AwsAccountId": "string",
"DefaultNamespace": "string", //Currently only supports default namespace: default
"TerminationProtectionEnabled": "boolean",
"NotificationEmail": "string"
}
After the termination protection has been set to False, use the DeleteAccountSubscription API to delete the QuickSight account:
DELETE /account/{AwsAccountId} HTTP/1.1
Content-type: application/json
Sample use case
Let’s consider a fictional company, AnyCompany, which owns healthcare facilities across the country. The central IT team of AnyCompany is responsible for setting up and maintaining the IT infrastructure and services for all the facilities in each state. Because AnyCompany is scaling their business, they want to automate the onboarding and maintenance of the IT infrastructure as much as possible. QuickSight is one of the services used by AnyCompany sites, and central IT needs to be able to set up and tear down QuickSight accounts automatically.
The following code shows their sample CreateAccountSubscription API call for setting up a QuickSight Enterprise account:
aws quicksight create-account-subscription --edition ENTERPRISE
--authentication-method IAM_AND_QUICKSIGHT --aws-account-id XXXXXXXXXXXX
--account-name quicksight-enterprise-reporting --notification-email XXXXXXXXXX
--region us-west-2
The following screenshot shows the response.
They use the DescribeAccountSubscription API to monitor the status of new QuickSight account’s subscription:
aws quicksight describe-account-subscription --aws-account-id XXXXXXXXXXX
The following screenshot shows the response.
In case of a site closing event, the following code turns off the account protection using the UpdateAccountSettings API call:
aws quicksight update-account-settings --aws-account-id XXXXXXXXXXXX
--default-namespace default --no-termination-protection-enabled
--region us-west-2
The following screenshot shows the response.
The following code deletes the QuickSight account using the DeleteAccountSubscription API call:
aws quicksight delete-account-subscription --aws-account-id XXXXXXXXXXXX
--region us-west-2
The following screenshot shows the response.
Conclusion
Provisioning and deleting QuickSight accounts enables IT teams to automate their deployments of QuickSight instances across their organization. You can scale and keep up with the rapidly growing business, and minimize human error such as choosing the wrong authentication method. For more information, refer to Amazon QuickSight and What’s New in the Amazon QuickSight User Guide.
Try out QuickSight account provisioning and deletion APIs to automate your QuickSight deployments, and share your feedback and questions in the comments.
About the authors
Srikanth Baheti is a Specialized World Wide Sr. Solution Architect for Amazon QuickSight. He started his career as a consultant and worked for multiple private and government organizations. Later he worked for PerkinElmer Health and Sciences & eResearch Technology Inc, where he was responsible for designing and developing high traffic web applications, highly scalable and maintainable data pipelines for reporting platforms using AWS services and Serverless computing.
Raji Sivasubramaniam is a Sr. Solutions Architect at AWS, focusing on Analytics. Raji is specialized in architecting end-to-end Enterprise Data Management, Business Intelligence and Analytics solutions for Fortune 500 and Fortune 100 companies across the globe. She has in-depth experience in integrated healthcare data and analytics with wide variety of healthcare datasets including managed market, physician targeting and patient analytics.
Mayank Agarwal is a product manager for Amazon QuickSight, AWS’ cloud-native, fully managed BI service. He focuses on account administration, governance and developer experience. He started his career as an embedded software engineer developing handheld devices. Prior to QuickSight he was leading engineering teams at Credence ID, developing custom mobile embedded device and web solutions using AWS services that make biometric enrollment and identification fast, intuitive, and cost-effective for Government sector, healthcare and transaction security applications.
This is a companion discussion topic for the original entry at https://aws.amazon.com/blogs/big-data/automate-your-amazon-quicksight-deployment-with-the-new-api-based-account-creation-and-deletion/
