MDAA quicksight-project module
npm install @aws-mdaa/quicksight-projectThe QuickSight Project CDK application is used to configure and deploy:
1. QuickSight Shared Folders and Permissions
2. Quicksight Data Sources
*
!quicksight-project-high-level
!quicksight-project-shared-folders
!quicksight-project-shared-folders
*
QuickSight SharedFolders - Creates QuickSight Shared Folders(Root and Child Folders with Permissions to QS Groups)
* Each shared folder can have read or read/write permissions granted for QS principals
* Each shared folder can have child folders with their own permissions
QuickSight Data Sources - QS data sources which can be used within QS Datasets and Analysis
*
Add the following snippet to your mdaa.yaml under the modules: section of a domain/env in order to use this module:
``yaml`
quicksight-project: # Module Name can be customized
module_path: "@aws-caef/quicksight-project" # Must match module NPM package name
module_configs:
- ./quicksight-project.yaml # Filename/path can be customized
`yamlThe set of QS principals which can be referenced in folder and data source permissions.
Note that each principal arn references a QuickSight user or group,
not an IAM Principal.
principals:
Lob1_READERS_GROUP: "arn:{{partition}}:quicksight:{{region}}:{{account}}:group/lob1-qs-ns/lob1-qs-ns-READERS"
Lob1_AUTHORS_GROUP: "arn:{{partition}}:quicksight:{{region}}:{{account}}:group/lob1-qs-ns/lob1-qs-ns-AUTHORS"
Lob1_PUBLISHERS_GROUP: "arn:{{partition}}:quicksight:{{region}}:{{account}}:group/lob1-qs-ns/lob1-qs-ns-PUBLISHERS"
Lob1_ALLUSERS_GROUP: "arn:{{partition}}:quicksight:{{region}}:{{account}}:group/lob1-qs-ns/lob1-qs-ns-ALLUSERS"
Lob2_READERS_GROUP: "arn:{{partition}}:quicksight:{{region}}:{{account}}:group/lob2-qs-ns/lob2-qs-ns-READERS"
Lob2_AUTHORS_GROUP: "arn:{{partition}}:quicksight:{{region}}:{{account}}:group/lob2-qs-ns/lob2-qs-ns-AUTHORS"
Lob2_PUBLISHERS_GROUP: "arn:{{partition}}:quicksight:{{region}}:{{account}}:group/lob2-qs-ns/lob2-qs-ns-PUBLISHERS"
Lob2_ALLUSERS_GROUP: "arn:{{partition}}:quicksight:{{region}}:{{account}}:group/lob2-qs-ns/lob2-qs-ns-ALLUSERS"
section of config
permissions:
# Supported actions and mapped permissions:
# {
# "READER_DATA_SOURCE": [
# "quicksight:DescribeDataSource",
# "quicksight:DescribeDataSourcePermissions",
# "quicksight:PassDataSource"
# ],
# "AUTHOR_DATA_SOURCE": [
# "quicksight:DescribeDataSource",
# "quicksight:DescribeDataSourcePermissions",
# "quicksight:PassDataSource","quicksight:UpdateDataSource",
# "quicksight:DeleteDataSource",
# "quicksight:UpdateDataSourcePermissions"
# ]
# };
- actions: "READER_DATA_SOURCE"
principal: "Lob1_PUBLISHERS_GROUP"
vpcConnectionProperties:
vpcConnectionArn: 'arn:{{partition}}:quicksight:{{region}}:{{account}}:vpcConnection/sampled2ecluster' #should be present, created manually, double check for new available API's
sharedFolders:
Lob1_dev: ##Name of the Folder to be visible in Quicksight
# Permissions granted to this folder
permissions:
- principal: Lob1_AUTHORS_GROUP # Principal name from 'principals' section of config
actions: "READER_FOLDER" # granted permissions
# Available action values and mapped permissions:
# {
# "READER_FOLDER": [ "quicksight:DescribeFolder" ],
# "AUTHOR_FOLDER": [
# "quicksight:CreateFolder",
# "quicksight:DescribeFolder",
# "quicksight:UpdateFolder",
# "quicksight:DeleteFolder",
# "quicksight:CreateFolder",
# "quicksight:CreateFolderMembership",
# "quicksight:DeleteFolderMembership",
# "quicksight:DescribeFolderPermissions",
# "quicksight:UpdateFolderPermissions"
# ]
# };
- principal: Lob1_PUBLISHERS_GROUP
actions: "READER_FOLDER"
# List of child folders
# Each child folder has the same available config options
folders:
working: # Each child folder name should be unique
permissions:
- principal: Lob1_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob1_PUBLISHERS_GROUP
actions: "AUTHOR_FOLDER"
publishing:
permissions:
- principal: Lob1_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob1_PUBLISHERS_GROUP
actions: "AUTHOR_FOLDER"
Lob1_test:
permissions:
- principal: Lob1_AUTHORS_GROUP
actions: "READER_FOLDER"
- principal: Lob1_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob1_READERS_GROUP
actions: "READER_FOLDER"
folders:
working:
permissions:
- principal: Lob1_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob1_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob1_READERS_GROUP
actions: "READER_FOLDER"
publishing:
permissions:
- principal: Lob1_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob1_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob1_READERS_GROUP
actions: "READER_FOLDER"
Lob1_prod:
permissions:
- principal: Lob1_AUTHORS_GROUP
actions: "READER_FOLDER"
- principal: Lob1_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob1_READERS_GROUP
actions: "READER_FOLDER"
folders:
working:
permissions:
- principal: Lob1_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob1_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob1_READERS_GROUP
actions: "READER_FOLDER"
publishing:
permissions:
- principal: Lob1_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob1_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob1_READERS_GROUP
actions: "READER_FOLDER"
Lob1_self_serve:
permissions:
- principal: Lob1_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob1_PUBLISHERS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob1_READERS_GROUP
actions: "READER_FOLDER"
Lob1_datasets:
permissions:
- principal: Lob1_ALLUSERS_GROUP
actions: "READER_FOLDER"
Lob2_dev:
permissions:
- principal: Lob2_AUTHORS_GROUP
actions: "READER_FOLDER"
- principal: Lob2_PUBLISHERS_GROUP
actions: "READER_FOLDER"
folders:
working:
permissions:
- principal: Lob2_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob2_PUBLISHERS_GROUP
actions: "AUTHOR_FOLDER"
publishing:
permissions:
- principal: Lob2_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob2_PUBLISHERS_GROUP
actions: "AUTHOR_FOLDER"
Lob2_test:
permissions:
- principal: Lob2_AUTHORS_GROUP
actions: "READER_FOLDER"
- principal: Lob2_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob2_READERS_GROUP
actions: "READER_FOLDER"
folders:
working:
permissions:
- principal: Lob2_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob2_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob2_READERS_GROUP
actions: "READER_FOLDER"
publishing:
permissions:
- principal: Lob2_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob2_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob2_READERS_GROUP
actions: "READER_FOLDER"
Lob2_prod:
permissions:
- principal: Lob2_AUTHORS_GROUP
actions: "READER_FOLDER"
- principal: Lob2_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob2_READERS_GROUP
actions: "READER_FOLDER"
folders:
working:
permissions:
- principal: Lob2_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob2_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob2_READERS_GROUP
actions: "READER_FOLDER"
publishing:
permissions:
- principal: Lob2_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob2_PUBLISHERS_GROUP
actions: "READER_FOLDER"
- principal: Lob2_READERS_GROUP
actions: "READER_FOLDER"
Lob2_self_serve:
permissions:
- principal: Lob2_AUTHORS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob2_PUBLISHERS_GROUP
actions: "AUTHOR_FOLDER"
- principal: Lob2_READERS_GROUP
actions: "READER_FOLDER"
Lob2_datasets:
permissions:
- principal: Lob2_ALLUSERS_GROUP
actions: "READER_FOLDER"
``