I am using boto3 to share a dashboard with our customers that exist in different namespaces. I want to provide each customer with the ability to delete the dashboard if they wish but without the effect of having it deleted for all other customers in the other namespaces. Is something like this possible? With the current persmissions I provide, if a customer deletes the dashboard it is deleted for all the rest. How can I modify the permissions to prevent this from happening?
Hello @Fotis_flex, my initial thought it to utilize the UpdateDashboardPermissions command to revoke permissions for that specific namespace. Based on the documentation, it looks like this specific functionality is possible. I’ll link the documentation as well related to resource permissions that can be revoked:
Alternatively, you could deploy the dashboard and related resources seperately to each namespace rather than sharing the dashboard across namespaces. This way it would be a new resource with a different dashboard ID, and an admin on that namespace could delete it without removing it from the entire QuickSight account. Those are the best options to accomplish this. I hope this helps!
Hello @Fotis_flex, since we have not heard back from you, I will mark my above response as the solution. If you have any remaining questions on this issue, please let me know, and I can help guide you further. Thank you!
Hallo @DylanM Sorry for my late reply - I was away. I am sorry but that link to documentation does not help much on what to do to prevent global deletion of the dashboard when one namespace deletes it. Currently, it’s not possible to share one dashboard per namespace as some API’s don’t work properly and automation can’t happen. I would appreciate if you can describe the steps to do in order to solve my problem. Thanks a lot
Hello @Fotis_flex, if you are sharing a single dashboard across multiple namespaces, I would recommend not providing the option to delete it. It is a single resource so it doesn’t matter where it is deleted from, it will be removed from the account.
You would have 2 alternate options to handle this. You can unshare the dashboard with the namespace from the manage assets tab of QuickSight when your client does not want it to be viewable in their account. This would be the easiest to implement, but it will not be automated.
Alternatively, you can use either the asset_bundle APIs or the APIs for DescribeDashboard and DescribeDashboardDefinition to create a JSON template of the dashboard and create it as a new dashboard in each of the namespaces with CreateDashboard. That would then allow for the resource to be deleted in a single namespace since they will no longer be a shared single asset.