New CLI commands with bundles errors

[ineedqshelp]

I’m getting this error about missing VPC connection, even though I have a connection (second picture) any ideas on how to fix this?

[Max]

Can you run this list vpc command to make sure the ARN is correct?

https://docs.aws.amazon.com/cli/latest/reference/quicksight/list-vpc-connections.html

[ineedqshelp]

The VPC connection shows up, but I don’t remember typing in the ARN for the VPC at any point when trying to export and import the bundle. I don’t know how the command decideds which VPC to connect to. I was originally getting this message, so I created this VPC with the same name “AWSQS” that it was looking for to see if that would fix it, but it didn’t.

[rangpava]

looks like the specific datasource you are importing relies on a VPC connection, which should also exist with the same VpcConnectionId in the destination account.
You have 2 options to proceed:

1. Export the bundle with “–include-all-dependencies” set, which will include the VPCConnection in the bundle and you can import it into the destination account with overrides for the subnet and security group ids to match the new account. Syntax for overrides: describe-asset-bundle-import-job — AWS CLI 1.27.159 Command Reference
2. Create a VPC connection with the same ID in the destination account using the CLI/API: Configuring the VPC connection with the QuickSight CLI - Amazon QuickSight

[ineedqshelp]

I get this error when I try to run with “include-all-dependencies” how do I fix this?

[rangpava]

The latest updates makes it invalid to create a VPC connection with one subnet, so we fail exports that have just 1 subnet because we cannot import them. you can add one more subnet to the existing VPC connection through the UI/API and it should go through.

[ineedqshelp]

@rangpava I have two VPC’s with 2 subnets now and I’m getting this error. I’m trying to connect a prod and dev account, prod is in region us-west-2 and dev is in us-east-1 just for more information if that helps you. I saw there was a place to override parameters for VPC connections, would that fix the issue?

[rangpava]

Are you trying to connect a datasource from dev to prod? Its not possible because you can only have a VPC connection to a VPC inside the same account and region as the datasource. (Finding information to connect to a VPC - Amazon QuickSight)
If you’re just trying to migrate a datasource/VPC connection from dev to prod, then yes, you’d need to check the subnets and security group that’s already present in the destination account (from VPC console/APIs) and enter those as overrides.

[ineedqshelp]

I’m trying to move a dataset from prod to dev

[ineedqshelp]

I did a full set of overrides, and I’m getting errors still. I’ve tried the override using the VPC in the dev account and the VPC in the prod account. VPC starting with 963 is the VPC in dev, 91e is the prod. First two image is using the dev VPC in overrides, second is using prod, both had the same error message.

[rangpava]

Here are a few things to verify:

1. Verify that the VPC connection asset is in the exported bundle. You can extract the .qs file as a ZIP file and you will see the individual JSON files for each resource.
2. You cannot override the IDs of the assets, just its parameters. So, when importing, the VPCConnectionId in the override parameters should be the same VPCConnectionId as the one in the bundle.
3. You dont need to provide the override parameters for DataSources if you’re not really changing any parameters for the datasource.
4. The subnets and security group IDs in override parameters for VPC Connection should match the existing subnets and security groups in the destination account (the one you’re importing into).

[Kristin]

Thanks for helping your peers in the QuickSight Community @rangpava!

[ineedqshelp]

1. This is what I see when I extract it as a ZIP file, I believe this means the VPC connections asset is in the bundle.
   
   
2. Thanks for the clarification!
3. Noted
4. I’m unable to have the same subnets and security groups across accounts. Or am I mistaken about that?

[rangpava]

There should be a json file for the VPCConnection separately, in a folder named “vpcConnection”. Only then will it be imported. (It should be there if the datasource was exported using “–include-all-dependencies”)
something like:

{
    "resourceType": "vpcConnection",
    "vpcConnectionId": "abc123-ac123",
    "name": "Test VPC Connection",
    "subnetIds": [
        "subnet-123456",
        "subnet-98765
    ],
    "securityGroupIds": [
        "sg-123456"
    ],
    "roleArn": "arn:aws:iam::123456789012:role/testrole"
}

The subnet IDs being the same was for the destination account and the overide parameter provided in API during import. (not between 2 accounts)

[ineedqshelp]

I see the separate JSON.

And understood, override parameters should be the same as the destination account.

[ineedqshelp]

I’m getting a new error message now, where do I fix this?

[rangpava]

you will need to provide the credentials to talk to your datasource through override parameters. it can be either CredentialPair or SecretArn depending on how you have configured the datasource, like:

{
  "DataSources": [
    {
      "DataSourceId": "<datasource_id>",
      "Credentials": {
        "CredentialPair": {
          "Username": "",
          "Password": ""
        }
      }
    }
  ]
}

[ineedqshelp]

I think I got it. It says successful, where can I find it in quicksight? Should the dataset just appear in the destination account now? Thank you for all your answers so far, it’s very appreciated and helpful.

[rangpava]

the permissions are not applied through the asset bundle API currently, so you will need to update permissions separately unfortunately. example: UpdateDataSetPermissions - Amazon QuickSight, UpdateDataSourcePermissions - Amazon QuickSight, UpdateAnalysisPermissions - Amazon QuickSight

[ineedqshelp]

So this command doesn’t create a duplicate dataset in the other account, it just shares the existing one?