How to properly update AWS account-specific ARNs when importing a QuickSight AssetBundle to a different account?

Question & Answer
, , , ,
1

I’m using Amazon QuickSight’s Asset Bundle feature to move resources from one AWS account to another. Here’s the process I’ve followed:

  1. Exported the asset bundle using StartAssetBundleExportJobRequest, including an analysis and its dependencies (e.g., datasets, datasources, permissions).
StartAssetBundleExportJobRequest.builder() 
                .awsAccountId(awsAccountId)
                .assetBundleExportJobId(exportJobId)
                .resourceArns(List.of("arn:aws:quicksight:us-east-1:" + awsAccountId + ":analysis/131bf5c8-8c55-4af5-86d7-7a51a9b55255")) 
                .includeAllDependencies(true)
                .includePermissions(true)
                .exportFormat(AssetBundleExportFormat.QUICKSIGHT_JSON)
                .build();
  1. Downloaded the .qs file from the export job’s response.
  2. Attempted to import the bundle into another AWS account using StartAssetBundleImportJobRequest.
        var importJobRequest = StartAssetBundleImportJobRequest.builder()
                .awsAccountId(awsAccountId)
                .assetBundleImportJobId(importJobId)
                .assetBundleImportSource(importSource)
                .build();

If a manual change aws account in the asset bundle.qs - it works,
if I am trying to import without changing - the import fails with this error:

JobStatus=FAILED_ROLLBACK_COMPLETED, 
Errors=[AssetBundleImportJobError(Arn=arn:aws:quicksight:us-east-1:<original-account>:datasource/..., 
Type=com.amazonaws.services.quicksight.model.InvalidParameterValueException, 
Message=RoleArn is invalid. Cross-account pass role is not allowed.)]

Is manual modification of the .qs file the only viable option, or is there an automated or supported way to adapt ARNs and role references for the target account?

1 Like
2

Hello @maxim

I have looked around myself and haven’t found a good way to do this reliably besides doing this manually.