Govern and manage permissions of Amazon QuickSight assets with the new centralized asset management console

Amazon QuickSight is a fully-managed, cloud-native business intelligence (BI) service that makes it easy to connect to your data, create interactive dashboards, and share these with tens of thousands of users, either within the QuickSight interface or embedded in software as a service (SaaS) applications or web portals. With QuickSight providing insights to power daily decisions across the organization, it becomes more important than ever for administrators to ensure they can easily govern and manage permissions of all the assets in their account.

We recently announced the launch of a new admin asset management console in QuickSight, which enables administrators at enterprises and independent software vendors (ISVs) to govern their QuickSight account at scale and have self-service support capabilities by providing easy visibility and access to all the assets across the entire account, including in a multi-tenant setup. In addition, admins can perform actions that were previously possible only via API, such as bulk transfer of assets from one user or group to another, share multiple assets with someone at once, or revoke a user’s access to an asset.

This launch also supports APIs for searching assets which allows administrators to automate and govern at scale. Administrators and developers can programmatically search for assets a user or group has access to and search for assets by name. Additionally, they can describe and manage assets permissions.

In this post, we show how to access this console and some of the administration and governance use cases that you can achieve.

Feature overview

The QuickSight admin asset management console is available for admins with AWS Identity and Access Management (IAM) permissions who have access to QuickSight admin console pages. The following IAM policy allows an IAM user get access to all the features in the asset management console:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [          
                "quicksight:SearchGroups",
                "quicksight:SearchUsers",            
                "quicksight:ListNamespaces",            
                "quicksight:DescribeAnalysisPermissions",
                "quicksight:DescribeDashboardPermissions",
                "quicksight:DescribeDataSetPermissions",
                "quicksight:DescribeDataSourcePermissions",
                "quicksight:DescribeFolderPermissions",
                "quicksight:ListAnalyses",
                "quicksight:ListDashboards",
                "quicksight:ListDataSets",
                "quicksight:ListDataSources",
                "quicksight:ListFolders",
                "quicksight:SearchAnalyses",
                "quicksight:SearchDashboards",
                "quicksight:SearchFolders",
                "quicksight:SearchDataSets",
                "quicksight:SearchDataSources",
                "quicksight:UpdateAnalysisPermissions",
                "quicksight:UpdateDashboardPermissions",
                "quicksight:UpdateDataSetPermissions",
                "quicksight:UpdateDataSourcePermissions",
                "quicksight:UpdateFolderPermissions"
            ],
            "Resource": "*"
        }
    ]
}

APIs

Assets can be searched by using the following public APIs:

• SearchAnalyses
• SearchDashboards
• SearchFolders
• SearchDataSets
• SearchDataSources

Permissions of the assets can be described and managed by using the following public APIs:

• DescribeAnalysisPermissions
• DescribeDashboardPermissions
• DescribeDataSetPermissions
• DescribeDataSourcePermissions
• DescribeFolderPermissions
• UpdateAnalysisPermissions
• UpdateDashboardPermissions
• UpdateDataSetPermissions
• UpdateDataSourcePermissions
• UpdateFolderPermissions

Access the QuickSight asset management console

To access the new QuickSight asset management console, complete the following steps:

1. On the QuickSight console, navigate to the user menu and choose Manage QuickSight.
   
2. In the navigation pane, choose Manage assets.
   

The landing page presents three ways to list assets:

• Search for assets owned by a user or a group in a namespace
• Search for assets by name
• Browse all assets or filter by asset type in the account
  

If you have only one namespace, you won’t see namespace drop-down, as shown in the following screenshot.

Use case overview

Let’s consider a fictional company, AnyCompany, which is an ISV that provides services to thousands of customers across the globe. QuickSight is one of the services used by AnyCompany for providing multi-tenant BI and analytics solutions. They have already implemented multi-tenancy in QuickSight using namespaces to isolate users and groups. Within each tenant, assets are organized using folders.

Previously, there was no single pane of glass view in the QuickSight user interface that could show them all the assets by tenant users or groups and associated permissions. To get a holistic view, they were dependent on IT administrators to run tenant-specific API calls and export that information on a regular basis to validate the asset permissions.

With this feature, AnyCompany is no longer dependent on IT administrators for the asset information, and doesn’t have to go through the tedious task of reconciliation and access validation. This not only removes a dependency on IT administrators’ availability, but also provides a centralized solution for asset governance.

AnyCompany has the following key administration and governance needs that they deem critical:

• Transfer assets – They want to be able to quickly transfer assets from one user or group to another in case the original owner is leaving the company or is on an extended leave
• Onboard new employees – They want to be able to speed up onboarding of new employees by giving them access to assets their teammates have
• Support authors – They want their in-house BI engineers to be able to easily and quickly support authors in other tenants by getting access to their dashboards
• Revoke access – They want the capability to quickly audit and revoke permissions when changes occur

In the following sections, we discuss how AnyCompany meets their asset management needs in more detail.

Transfer assets

One of the business analysts, who was responsible for authoring some the key dashboards for use within the management team in headquarters and common dashboards that were being shared with all the tenants, recently switched organizations within AnyCompany. The central administrator wants to transfer all the assets to another team member and to maintain continuity.

To transfer assets, complete the following steps:

1. Log in to QuickSight and navigate to Manage assets.
2. Choose the namespace of the business analyst who left.
   
3. Enter at least the first three characters of the username or the email of the analyst who left and choose the user from the search results.
   

A list of all the assets that the analyst is owner or viewer of is displayed.

4. Use the filters to list assets of which the analyst is the sole owner.
   
5. You can also choose to list only a single type of asset, such as dashboards.
   
6. Select all the assets on the first page.
   
7. On the Actions menu, choose Transfer.
   
8. Choose the namespace the new user belongs to.
9. Search for the analyst to whom all the assets will be transferred to by entering at least the first three characters of the username or the email.
10. Choose the appropriate user from the search results.
    
11. For Permissions, you can choose to replicate permissions that the analyst had to the new user, or make the new user owner or viewer of all assets being transferred.
12. Choose Transfer.
    
13. When the transfer is complete, choose Done.
    
14. Repeat these steps if there is more than one page of assets listed.

Onboard new employees

A new analyst has joined AnyCompany, and the manager wants this analyst to have access to all QuickSight assets as one of the existing analyst.

To share assets, the administrator takes the following steps:

1. Log in to QuickSight and navigate to Manage assets.
2. Choose the namespace the existing business analyst belongs to.
3. Search for the existing analyst by entering at least the first three characters of the username or the email and choose the user from the search results.
   

A list of all the assets that the analyst is owner or viewer of is displayed.

4. Select all the assets on the first page.
   
5. On the Actions menu, choose Share.
   
6. Choose the namespace the new user belongs to.
7. Search for the analyst who just joined the team by entering at least the first three characters of the username or the email and choose the appropriate user from the search results.
   
8. You can choose to replicate permissions that the analyst had to the new user, or make the new user the owner or viewer of all assets being shared.
9. Choose Share.
   
10. When the share is complete, choose Done.
    

Support authors

AnyCompany often receives support requests from their tenant authors who are creating and sharing dashboards within the boundary of their tenant, which is achieved by namespaces in QuickSight. AnyCompany’s support team wants to get easy access to other tenant authors’ assets and provide the necessary support quickly.

To get access to an author’s assets, complete the following steps:

1. Log in to QuickSight and navigate to Manage assets.
2. For Search by asset name, enter the name of the asset that the support team wants to get access to.
   

A list of assets that contain the search text is displayed.

3. Select the assets you want to give the support team access to.
4. Choose Share.
   
5. Choose the namespace the support team belongs to.
   
6. Choose the group the support team belongs to.
   
7. Choose the Owner permission in order for the support team to have complete access to the asset.
8. Choose Share.
   
9. When the share is complete, choose Done.
   

Revoke access

In case of policy changes or if the central administrator discovers that a QuickSight user shouldn’t have access to certain assets, you can revoke asset access.

To revoke a user’s access to an asset, complete the following steps:

1. Log in to QuickSight and navigate to Manage assets.
2. Choose the namespace the existing business analyst belongs to.
3. Search for the user you want to remove access to by entering at least the first three characters of the username or the email and choose the appropriate user from the search results.

A list of all the assets that the analyst is owner or viewer of is displayed.

4. Choose the menu icon (three vertical dots) in the Actions column of the assets you want to revoke access to and choose Revoke access.
   
5. Choose Revoke.
   
6. After access has been revoked, choose Done.
   

Conclusion

With the asset management console, admins now have easy visibility to all the assets in an account and can govern and manage permissions of all the assets in an account. Try out the asset management console for your centralized governance in QuickSight and share your feedback and questions in the comments. For more information, refer to Asset Management Console user guide.

Stay tuned for more new admin capabilities, and follow What’s New with Analytics for the latest on QuickSight.

About the Authors

Srikanth Baheti is a Specialized World Wide Sr. Solution Architect for Amazon QuickSight. He started his career as a consultant and worked for multiple private and government organizations. Later he worked for PerkinElmer Health and Sciences & eResearch Technology Inc, where he was responsible for designing and developing high traffic web applications, highly scalable and maintainable data pipelines for reporting platforms using AWS services and Serverless computing.

Raji Sivasubramaniam is a Sr. Solutions Architect at AWS, focusing on Analytics. Raji is specialized in architecting end-to-end Enterprise Data Management, Business Intelligence and Analytics solutions for Fortune 500 and Fortune 100 companies across the globe. She has in-depth experience in integrated healthcare data and analytics with wide variety of healthcare datasets including managed market, physician targeting and patient analytics.

Mayank Agarwal is a product manager for Amazon QuickSight, AWS’ cloud-native, fully managed BI service. He focuses on account administration, governance and developer experience. He started his career as an embedded software engineer developing handheld devices. Prior to QuickSight he was leading engineering teams at Credence ID, developing custom mobile embedded device and web solutions using AWS services that make biometric enrollment and identification fast, intuitive, and cost-effective for Government sector, healthcare and transaction security applications.