Enable RLS during update datasets with Boto3

Question & Answer
,
1

Hi all,

I have written a script to update datasets automatically by providing a .json file with desired dataset description. I get this .json file by describing my original dataset that has already RLS enabled and linked to a specific file. While the update is successful, I can’t have RLS enabled at the same time therefore my dataset is exposed until I enable it from UI, How can I modify the .json to enable RLS during update from the API? The RLS configuration in the .json I currently use is like below:

"FieldFolders": {},
        "RowLevelPermissionDataSet": {
            "Arn": "arn:aws:quicksight:eu-central-1:179633839895:dataset/4438d15d-cc92-4f71-826d-01a7958ecbe5",
            "PermissionPolicy": "GRANT_ACCESS",
            "FormatVersion": "VERSION_2",
            "Status": "ENABLED"
        },
2

Hello @Fotis_flex, when you run this script, are you updating the same Dataset ID or are you creating a new dataset every time? I also see that you are using "FormatVersion": "VERSION_2", so make sure your RLS dataset set up with UserArn or GroupArn and that you are not utilizing namespaces, otherwise Version_2 will not work.

3

Hi @DylanM . I am updating the same dataset id yes. Regarding the “FormatVersion” indeed I saw in documentation mentioning the UserArn/GroupArn, but I am not sure how to set it like this as I didn’t find any example. Can you elaborate on that?
The RLS dataset I use is under the “default” namespace and each of our customers exists in a different namespace. When I enable RLS from UI and then describe the dataset, the .json comes with the exact RLS description as in my first message. So, I don’t get why this .json will not enable the RLS since it comes from an enabled RLS dataset! I am a bit confused with documentation. Can you maybe explain how I need to modify the .json?

4

Hello @Fotis_flex, okay so I think since you are using namespaces, then you will want to use VERSION_1. Then in your RLS dataset, you want to use the QuickSight UserName or GroupName field as the identifier for each user. That will be the name displayed on the user management list for your QuickSight account. I believe once you make those changes, the RLS should work as expected after the update.

Please mark my response as a solution if it works as anticipated, otherwise let me know of any errors that occur after making the change!

1 Like
5

Hello @Fotis_flex, I will mark my above response as the solution. If you have persistent errors after making that change or a follow-up question, please let me know. Thank you!