How to give permission to multiple principals on a shared Folder

Question & Answer
,
1

I am using Terraform to automate the creation of a shared folder and then adding users to share the assets using the permissions.

locals {
 owners = ["user1","user2","user3"]
}

data "aws_quicksight_user" "owners" {
  for_each = toset(local.owners)
  user_name = each.key
}

resource "aws_quicksight_folder" "example" {
  folder_id = "asset"
  name      = "folder_for_asset"
  folder_type = "SHARED"
  for_each = toset(local.owners)
  permissions {
    actions = [
      "quicksight:CreateFolder",
      "quicksight:DescribeFolder",
      "quicksight:UpdateFolder",
      "quicksight:DeleteFolder",
      "quicksight:CreateFolderMembership",
      "quicksight:DeleteFolderMembership",
      "quicksight:DescribeFolderPermissions",
      "quicksight:UpdateFolderPermissions",
    ]
    principal = data.aws_quicksight_user.owners[each.key].arn
  }
}

The problem here is that the principal does not allow list and I am limited to only one user.
OR I am doing some thing wrong ?

Do I need to switch to python( boto3) or cli ?

Thank you !

2

Hi @larry
the the principal logic within the permissions looks like:

"Permissions": [
    {
        "Principal": "arn:aws:quicksight:us-east-1:accountID:user/default/user1",
        "Actions": [
            "quicksight:RestoreAnalysis",
            "quicksight:UpdateAnalysisPermissions",
            "quicksight:DeleteAnalysis",
            "quicksight:DescribeAnalysisPermissions",
            "quicksight:QueryAnalysis",
            "quicksight:DescribeAnalysis",
            "quicksight:UpdateAnalysis"
        ]
    },
    {
        "Principal": "arn:aws:quicksight:us-east-1:accountID:user/default/admin/user2",
        "Actions": [
            "quicksight:RestoreAnalysis",
            "quicksight:UpdateAnalysisPermissions",
            "quicksight:DeleteAnalysis",
            "quicksight:DescribeAnalysisPermissions",
            "quicksight:QueryAnalysis",
            "quicksight:DescribeAnalysis",
            "quicksight:UpdateAnalysis"
        ]
    }
],

Is you code is producing the same?

BR

3

@ErikG Thanks for your quick response. That exactly is the problem ( I think) because it is not allowing me to pass a list to the Principal, which is limiting to only one user. I have multiple alternatives to get an output like you suggested –

  1. Use CLI
  2. Use Python(boto3)
  3. create a group and add users ( Don’t know if this will work ?)

Any guidance to pick an alternative will be helpful.

4

@larry ,

The permissions block is a list which will have actions defined for each principal. Based on your code, for_each is outside of this block. Wouldn’t this create a folder for each user ?

resource "aws_quicksight_folder" "example" {
  folder_id = "asset"
  name      = "folder_for_asset"
  folder_type = "SHARED"
  for_each = toset(local.owners)
  permissions {
    actions = [
      "quicksight:CreateFolder",
      "quicksight:DescribeFolder",
      "quicksight:UpdateFolder",
      "quicksight:DeleteFolder",
      "quicksight:CreateFolderMembership",
      "quicksight:DeleteFolderMembership",
      "quicksight:DescribeFolderPermissions",
      "quicksight:UpdateFolderPermissions",
    ]
    principal = data.aws_quicksight_user.owners[each.key].arn
  }
}

1/ Can you create the permissions block which has the principals and their actions initially and then reference it ?
2/ Or maybe dynamically building it ? [ Dynamic Blocks - Configuration Language | Terraform | HashiCorp Developer ]

5

Hi @larry,
It’s been awhile since we last heard from you, did you have any additional questions regarding your initial post?

If we do not hear back within the next 3 business days, I’ll close out this topic.

Thank you!

6

Hi @larry,
Since we haven’t heard back, I’ll go ahead and close out this topic. However, if you have any additional questions, feel free to create a new post in the community and link this discussion for relevant information if needed.

Thank you!