Can't share Quick Sight connector with non-admin users

Q&A
, ,
1

Hi all,

I built a custom connector in QuickSight backed by a Lambda function (pulls data from a REST API), then built a Quick App on top of it. When I share the app with a user, they can open it, but they can’t access the connector itself - it seems connector access is restricted to Admins only, so the app fails to pull data for them.

Has anyone found a way to share connector access with non-admin users, or a workaround (like for readers)? Any pointers appreciated.

2

Hi @Kalyan_reddy

When you register a custom connector (Lambda backed) in QuickSight, based on observed behavior, the connector and its associated data source appear to require Admin level access for direct management. The data source and dataset created from it are separate assets, each with their own permission model.

The challenge you’re encountering appears to be related to direct query mode in this mode, the data source is invoked at runtime, and non-admin users who haven’t been explicitly granted data source permissions may not be able to retrieve data through the connector.

Note: I was unable to locate official AWS documentation specifically covering custom connector permission behavior or a dedicated guide for building Lambda-backed custom connectors. The information above is based on observed behavior and QuickSight general permissions model.

Workaround - Import data to SPICE: The simplest and most broadly supported solution is to import your data into SPICE rather than using direct query. With SPICE:

  • Users read from the in-memory cache, no connector invocation occurs at runtime.
  • You only need to share the dataset (not the data source) with your users.
  • Both Authors and Readers can access the data without needing connector level permissions.
3

Hi Kalyan,

I had similar issues. I believe you have to go into manage assets in the manage Quick area. In assets find the connection you created and share it there.

Best,

Al

5

@BreachSecure Thanks, but I already tried that. sharing custom connectors with non-admin users isn’t allowed even through Manage Assets. Seems to be a restriction specific to custom connectors.

6

@Xclipse
Thank you. I’m currently using Lambda to pull data from S3 and shape it into an API schema for the quick app - so Lambda sits in front as a custom connector rather than QuickSight connecting to S3 directly. Given this existing architecture, how can I get this data into SPICE while keeping my Lambda transformation logic?

7

Hi @Kalyan_reddy

To get your data into SPICE while preserving your existing Lambda transformation logic, one approach would be. Rather than having QuickSight invoke your Lambda as a custom connector at query time, you could configure your Lambda function to write the transformed output to a designated S3 location (e.g., as CSV or Parquet). QuickSight can then connect to that S3 location directly as a data source and import the data into SPICE.

To keep the data fresh, you could trigger the Lambda on a schedule (e.g., via EventBridge) so the S3 output stays up to date, and configure a corresponding SPICE refresh schedule in QuickSight.

8

Dang, sounds like a huge limitation.. especially when one of the recommendations was to create a custom MCP or REST service when pulling data from RDS. As in Apps, can only render dashboards not direct datasets

9

Thanks @Xclipse . After pointing QuickSight at the S3 output from Lambda, I’m getting: “Connecting to your data source took too long. Retrying this request may help.”

Apps Assistant response:
Unfortunately, I’m not able to connect directly to S3 datasets from this app. Here’s why:

Constraints

  1. Sandbox Restrictions: This app runs inside a sandboxed iframe with a strict Content Security Policy (default-src 'none'), which blocks direct network requests to external services like S3.

  2. Available Integrations: The app can only access data through:

    • Quick Actions (action connectors)
    • Quick Spaces (document/file storage within QuickSight)
    • Quick Dashboards (embedded visuals)
    • App Storage (key-value persistence)

  3. No AWS SDK Access: There’s no AWS SDK or direct S3 client available in this environment.

Alternatives You Can Use

Option How It Works
1. Action Connector (API Gateway → S3) If you have an API Gateway or Lambda that reads from S3, you can register it as an action connector and fetch data through it. This is essentially what your current connector does.
2. Quick Spaces Upload your S3 files to a Quick Space, then read them from the app using the Spaces API.
3. Quick Dashboards If your S3 data is already loaded into a QuickSight dataset/dashboard, I can embed those visuals directly.

Recommendations

  • If your S3 data is behind an API: Let me know the connector details and I can integrate it.
  • If you want to upload CSV/files from S3 into the app: Consider uploading them to a Quick Space first, and I can build a component to read and display them.
  • If the data is already in a QuickSight dataset: I can search for and embed dashboard visuals.
10

If dashboard visuals/tables are all Quick Apps can render, then there’s no real advantage to building this as an App Vs. just sharing a regular QuickSight Dashboard directly - the App layer isn’t adding anything for our use case.

11

Hi @Kalyan_reddy

Sorry, I’m out of ideas. I would recommend filing a case with AWS Support where we can dive into the details so that we can help you further. Here are the steps to open a support case. If your company has someone who manages your AWS account, you might not have direct access to AWS Support and will need to raise an internal ticket to your IT team or whomever manages your AWS account. They should be able to open an AWS Support case on your behalf. Hope this helps!

12

Thank you, will reach out to Support.