How to migrate QuickSight dashboards from one AWS account to another?

Question & Answer
,
1

I have several dashboards in a AWS account. What’s the best and easiest way to migrate the dashboards to the second AWS account?

I

2

This is the best way now. Porting Content :: QuickSight DevOps

There will be new features launching later this fall that will enhance this.

3

Thanks for the link. Very useful.
Regarding the role mentioned in the Jupyter code, which services does it need?
Is there a preset role I can use or do I need to customize it?

4

@Jill_Florant Am trying to follow the code you mentioned

Both account i created IAM users

Am tuck with getting Data Source Id, DataSet ID

Any further guide to follow

5

Adding #qls-embed tag to alert our experts that more detail is needed.

6

@Sajumoni, @gopinathpc

Thank you for your patience. The process of deployment is explained as part of the link provided by Jill.
For permissions and requirements and setting up the Jupyter, please refer to one of our blogs: BIOPS

As for the data-source-id and data-set-id, you can always do a describe datasource and describe dataset api calls.

7

Hi,

Full access role mentioned in the porting content video is a custom role and need to created in both accounts. It looks like this -

{
“Version”: “2012-10-17”,
“Statement”: [
{
“Sid”: “VisualEditor0”,
“Effect”: “Allow”,
“Action”: “quicksight:",
“Resource”: "”
}
]
}

Additionally, you will need to create a trust policy for both of these roles in each account that will establish the trust between accounts. Here is a sample of trust policy in source account -
{
“Version”: “2012-10-17”,
“Statement”: [
{
“Effect”: “Allow”,
“Principal”: {
“AWS”: [
“arn:aws:iam:::root”,
“arn:aws:iam:::root”
]
},
“Action”: “sts:AssumeRole”
}
]
}

You should be able to use these roles to perform the content migration.

Thanks
Deepak

8

Two accounts in the trust policy are the source and target accounts.

9

Thanks for the details of the roles required.
After creating the roles and running the code in Jupyter nodebook, I am getting these errors:

AccessDeniedException Traceback (most recent call last)
/tmp/ipykernel_20907/711851359.py in <cell line: 2>()
1 #Copy data source
----> 2 sourceDataSourceDescribeResponse = sourceQuickSight.describe_data_source(AwsAccountId=sourceAccountId,
3 DataSourceId=‘gl_balances_ex’)
4 JSON(sourceDataSourceDescribeResponse)
5

~/anaconda3/envs/python3/lib/python3.8/site-packages/botocore/client.py in _api_call(self, *args, **kwargs)
393 “%s() only accepts keyword arguments.” % py_operation_name)
394 # The “self” in this scope is referring to the BaseClient.
→ 395 return self._make_api_call(operation_name, kwargs)
396
397 _api_call.name = str(py_operation_name)

~/anaconda3/envs/python3/lib/python3.8/site-packages/botocore/client.py in _make_api_call(self, operation_name, api_params)
723 error_code = parsed_response.get(“Error”, {}).get(“Code”)
724 error_class = self.exceptions.from_code(error_code)
→ 725 raise error_class(parsed_response, operation_name)
726 else:
727 return parsed_response

AccessDeniedException: An error occurred (AccessDeniedException) when calling the DescribeDataSource operation: User: arn:aws:sts::613074250484:assumed-role/QuickSightFullAccess/quicksight is not authorized to perform: quicksight:DescribeDataSource on resource: arn:aws:quicksight:us-west-2:613074250484:datasource/gl_balances_ex because no identity-based policy allows the quicksight:DescribeDataSource action

Do you know how to fix this?

10

I am now getting these errors:

NameError Traceback (most recent call last)
/tmp/ipykernel_6464/711851359.py in <cell line: 2>()
1 #Copy data source
----> 2 sourceDataSourceDescribeResponse = sourceQuickSight.describe_data_source(AwsAccountId=sourceAccountId,
3 DataSourceId=‘gl_balances_ex’)
4 JSON(sourceDataSourceDescribeResponse)
5

NameError: name ‘sourceQuickSight’ is not defined

11

After some struggle, finally I gave on this method to migrate QuickSight objects.

I am now following this document to do the migration

I have a quick question. In my QuickSight source account I do have Themes in my dashboard.
How do I migrate Themes as well?
Is the Themes migration done after migrating template?

I also need the template file for ThemePermission.json.
Thank you!

1 Like
12

I was trying to use the migration document using Jupyter nodebook. I am getting stuck here.
Can you please help me resolve and move on?

KeyError Traceback (most recent call last)
/tmp/ipykernel_13500/726898780.py in <cell line: 2>()
1 #Describe source analysis permissions
2 sourceAnalysisPermsDescribeResponse = sourceQuickSight.describe_analysis_permissions(AwsAccountId=sourceAccountId,
----> 3 AnalysisId=sourceAnalysis[‘9d58f199-5cfa-4f36-bd50-5ef21c584b8d’])
4 JSON(sourceAnalysisPermsDescribeResponse)

KeyError: ‘9d58f199-5cfa-4f36-bd50-5ef21c584b8d’

13

Hi gopinathpc

1/ Please make sure your session is valid and you are passing valid Source Account# and Analysis ID
2/ Few ways to ensure -
a/ Open your analysis with same Analysis id - https://<< Place-your-region-here. >>.quicksight.aws.amazon.com/sn/analyses/9d58f199-5cfa-4f36-bd50-5ef21c584b8d
you should be able to access your analysis id.
b/ execute this step in your notebook you should get valid response and then try for source analysis permission you are planning to execute as part of migration script.
#Describe source analysis
sourceAnalysisDescribeResponse = sourceQuickSight.describe_analysis(AwsAccountId='Provide-SourceAccount#-here,AnalysisId=‘Provide-Analysis-Id-here’)
JSON(sourceAnalysisDescribeResponse)

Hope this information helps you to move forward.

Thanks
Neeraj

14

Thanks for the info. It helped. I could resolve this issue.

However when creating a dashboard on the target account I am seeing this issue:

InvalidParameterValueException: An error occurred (InvalidParameterValueException) when calling the CreateDashboard operation: Principal arn:aws:quicksight:us-west-2:280181752709:user/default/AWSReservedSSO_full_88f15623f8a08ffa/***@abc.com is part of a different account

How do I resolve this?

15

I am getting the following errors when creating a dataset on my target acount.

KeyError Traceback (most recent call last)
/tmp/ipykernel_23970/383644607.py in <cell line: 3>()
1 #Create data set on target account
2 sourceDataSet=sourceDataSetDescribeResponse[‘DataSet’]
----> 3 sourceDataSet[‘PhysicalTableMap’][‘s3PhysicalTable’][‘S3Source’][‘DataSourceArn’]=targetDataSourceDescribeResponse[‘DataSource’][‘Arn’]
4
5 sourceDataSetPerms = sourceDataSetPermsDescribeResponse[‘Permissions’]

KeyError: ‘s3PhysicalTable’

16

@gopinathpc Do you have an s3 table in your other account that you can reference?