Update-data-set issue when implementing RLS

Question & Answer
, ,
1

Hello,

I am trying to import two datasets from a source account, a sales dataset and a RLS rules dataset for the sales dataset.

I call update-data-set to enforce RLS on the sales dataset but come across:

aws quicksight update-data-set \
--aws-account-id $TARGET_ACCOUNT_ID \
--name "Updated RLS Dataset" \
--data-set-id $DATASET_ID \
--physical-table-map "$PHYSICAL_TABLE_MAP" \
--row-level-permission-data-set "$ROW_LEVEL_PERMISSION_DATA_SET" \
--import-mode SPICE 

An error occurred (InvalidParameterValueException) when calling the UpdateDataSet operation: The option to change row-level permissions to deny access is no longer supported for dataset arn:aws:quicksight:*****:******:dataset/dataset-1

Is there something I am missing?

2

when you update the row-level-permission-data-set, except the dataset, you also need to provide other parameters such as permission policy, did you provide in there ?

image
image831×740 73.3 KB

3

yes, i provided this,

ROW_LEVEL_PERMISSION_DATA_SET='{
  "Arn": "'"$RLS_DATASET_ARN"'",
  "PermissionPolicy": "DENY_ACCESS",
  "FormatVersion": "VERSION_2"
}'
4

did you include status ?

image
image773×103 11.1 KB

5

I tried again with a new dataset and included:

ROW_LEVEL_PERMISSION_DATA_SET='{
  "Arn": "'"$RLS_DATASET_ARN"'",
  "PermissionPolicy": "DENY_ACCESS",
  "FormatVersion": "VERSION_2",
  "Status": "ENABLED"
}'

and same error occurs:

An error occurred (InvalidParameterValueException) when calling the UpdateDataSet operation: The option to change row-level permissions to deny access is no longer supported for dataset arn:aws:quicksight:::dataset/****
6

@mitoo DENY_ACCESS is not supported anymore in the RLS setup

image
image956×281 31.6 KB