Granular permissions

Q&A
, ,
1

Hi,

Is it possible to setup granular permissions for a dataset resource?

It seems like there’s only viewer or author permissions groups available.

We have some datasets that are fully managed thru code, but authors keep messing with them. I want disable that option, but still allow them to change refresh schedules and manually refresh the datasets.

2

Hello,

You can implement granular access control through IAM policies to restrict specific dataset actions

Regards,

3

AWS Support said it was impossible.

4

So, want to confirm one last time, there’s really no way to prevent an author from modifying a dataset?

Seems like a glaring oversight.

5

Hello,

You can define the actions an author can can perform on a dataset using resource permissions- Actions, resources, and condition keys for Amazon QuickSight - Service Authorization Reference

For example, the below defines what actions the author user ( “Principal”: “arn:aws:quicksight:us-east-1:xxxxxxxxxx:user/default/xxxxxxxx.xxxxxxx@gmail.com”] can perform on the data set

aws quicksight update-data-set-permissions
–aws-account-id xxxxxxxxx
–data-set-id xxxxxxxxxxx
–grant-permissions '[{
“Principal”: “arn:aws:quicksight:us-east-1:xxxxxxxxxx:user/default/xxxxxxxx.xxxxxxx@gmail.com”,
“Actions”: [
“quicksight:DescribeDataSet”,
“quicksight:DescribeDataSetPermissions”,
“quicksight:PassDataSet”,
“quicksight:DescribeIngestion”,
“quicksight:ListIngestions”,
]
}]‘

You need to review Actions, resources, and condition keys for Amazon QuickSight - Service Authorization Reference and come up with the combinations of actions that suit your use case.

6

But these permissions aren’t “granular”. The docs may lead you to believe they are, as each individual permission is separately listed. But, in fact, they are treated as a single group. When you add or remove any permissions from the group, CloudFormation will fail to deploy with a validation error saying that it’s not a valid set of permissions.

There are only two (known to me) valid sets of permissions that map directly to viewer and author.

So, thereby it’s not possible to allow, for example, viewer + refresh.

Also, there’s no way to restrict users from creating datasets using a specific naming convention, which could be possible with IAM. E.g. disallowing creation of datasets with a specific prefix.

7

If you’re getting following error when trying to update DataSet permissions:

> InvalidParameterValueException: Unable to map resultant actions to a dataset owner or viewer.

Then read following response from support regarding permissions:

QuickSight uses a role-based permission model where permissions must map to predefined roles (Owner or Viewer) and they must form a complete, valid role set.

Attached below are permission sets for both owners and viewers:

Owner (full permissions):

Actions": [
"quicksight:DeleteDataSet",
"quicksight:UpdateDataSetPermissions",
"quicksight:PutDataSetRefreshProperties",
"quicksight:CreateRefreshSchedule",
"quicksight:CancelIngestion",
"quicksight:PassDataSet",
"quicksight:UpdateRefreshSchedule",
"quicksight:DeleteRefreshSchedule",
"quicksight:ListRefreshSchedules",
"quicksight:DescribeDataSetRefreshProperties",
"quicksight:DescribeDataSet",
"quicksight:CreateIngestion",
"quicksight:DescribeRefreshSchedule",
"quicksight:ListIngestions",
"quicksight:UpdateDataSet",
"quicksight:DescribeDataSetPermissions",
"quicksight:DeleteDataSetRefreshProperties",
"quicksight:DescribeIngestion"
]

Viewer ( minimum permissions) :

[
"quicksight:DescribeRefreshSchedule",
"quicksight:ListIngestions",
"quicksight:ListRefreshSchedules",
"quicksight:PassDataSet",
"quicksight:DescribeDataSetPermissions",
"quicksight:DescribeDataSet",
"quicksight:DescribeIngestion"
]

Unfortunately, this has not been updated in the document yet.