User group Dashboard permissions policy

Question & Answer
,
1

I have an user group and as an author after creating Dashboard I shared dashboard to user group.
Now if I embed this dashboard using register user embedding What is the policy I need to add which allows any dashboard i share to user grup show allow automaticall without adding new dashboardIds in the policy.
In the below example I need to add dashboardIds for all new dashboards I created to allow access. But I don’t want to add erverytime manually in policy if I generate new dashboardId and sahre to usergroup.

{
“Action”: “quicksight:RegisterUser”,
“Resource”: “*”,
“Effect”: “Allow”
},
{
“Effect”: “Allow”,
“Action”: [
“quicksight:GenerateEmbedUrlForRegisteredUser”
],
“Resource”: [
“arn:{{partition}}:quicksight:{{region}}:{{accountId}}:namespace/{{namespace}}”,
“arn:{{partition}}:quicksight:{{region}}:{{accountId}}:dashboard/{{dashboardId-1}}”,
“arn:{{partition}}:quicksight:{{region}}:{{accountId}}:dashboard/{{dashboardId-2}}”
],

2

@sav0819 if user has permission for the quicksight and the dashboard is shared with them, you can generated embeded-url for the dashboard that is already shared with the user, you can use get-embeded-url API and that should be it.

Quicksight will check accordingly how to validate the user.

another way will be, you don’t manage the permission of the dashboard through AWS/QS, instead do that in the native App (where you are planning to embed the dashboard) then if user has permission, generate the 1 time use embedded url through API and that should be it.