Issue with sharing Analysis across account utilizing a role as the Principal

Q&A
1

Hello Quick Sight community!

I was following the great video Quick Sight Automation Using The AWS CLI & CloudFormation: 2023 Amazon Quick Sight Learning Series hosted by Max Engelhard(https://www.youtube.com/watch?v=TcZuNPQ-QlA) and everything was going great until the very last command at the very end of the video where you are attempting to share the analysis to the targeted account.

The json block that needs to be executed looks like this:

{
“AwsAccountId”: “{account_number}”,
“AnalysisId”: “{analysis_id}”,
“GrantPermissions”: [
{
“Principal”: “arn:aws:quicksight:{regions}:{account_number}:user/{namespace}/{user}”,
“Actions”: [
“quicksight:RestoreAnalysis”, “quicksight:UpdateAnalysisPermissions”, “quicksight:DeleteAnalysis”, “quicksight:QueryAnalysis”, “quicksight:DescribeAnalysisPermissions”, “quicksight:DescribeAnalysis”, “quicksight:UpdateAnalysis”
]
}
]
}

Json block with my hypothetical info:

{
“AwsAccountId”: “123412341234”,
“AnalysisId”: “CreateTemplateFromCLI”,
“GrantPermissions”: [
{
“Principal”: “arn:aws:iam::123412341234:role/CLOUDSECADMIN/rocklobster”,
“Actions”: [
“quicksight:RestoreAnalysis”, “quicksight:UpdateAnalysisPermissions”, “quicksight:DeleteAnalysis”, “quicksight:QueryAnalysis”, “quicksight:DescribeAnalysisPermissions”, “quicksight:DescribeAnalysis”, “quicksight:UpdateAnalysis”
]
}
]
}

I am getting the error:

An error occurred (InvalidParameterValueException) when calling the UpdateAnalysisPermissions operation: The principal arn:aws:iam::123412341234:role/CLOUDSECADMIN/rocklobster is invalid

In my environment we do not utilize Users. In the Quick Sight video he was using a user.

Is this process possible utilizing a role? Video was excellent up until I hit the roadblock.. and the very last command lol.

Thanks for your time!
Josh

2

Hi @rocklobster - Welcome to AWS Quick Sight community and thanks for posting the questions. The principal is here either arn of Quick Sight user and group. You can get the details of the group from list_groups api ( if you have allocate users to groups)

You can get the Quick Sight user details from the list_users .

Take one user arn from the above API and try to run the update permission api.

Tagging @Max as well in this post for his advise.

Regards - Sanjeeb