Quicksight groups mapped with data.all groups about aws-dataall HOT 4 OPEN

i do see high value for the implementation of the proposals especially for an enterprise environment. The current 'one-fits-all' approach with managing access to data via quicksight management control is not workable on a larger scale.

from aws-dataall.

Hi @enr0c thanks for the response! We will try to prioritize this feature. Can you describe more in depth how do you currently use Quicksight?

• What type of Quicksight users do you used? How are they created/mapped to IdP?
• How many AWS accounts do they use?
• How do you manage data access control to the teams?

from aws-dataall.

We are not using data.all currently, but we are assessing if we will use it in the future. One challenge we do currently see is the usage of quicksight and the fact that user that belong to an environment do have access to all dashboards, regardless if the underlying data is not accessible to them. Furthermore one needs to manually select Athena sources for users per environment.

We foresee many thousand QS users from 20-40 AWS account. Identify will be delivered by an external IdP, leveraging SAML or OIDC.
Data Access Control shall be implemented with Lakeformation

Thank you for asking :)

from aws-dataall.

One further clarification - The ticket says:
That means that when users start a Quicksight session they should start a session with a team and in this session they see only the data owned or shared with that data.all team.

This is already an improvement, however for our case not sufficient.

Our requirement

We foresee a multi-Account setup. In this ecosystem, multiple roles (delivered via external IdP via SAML) can be assigned to a user. Permissions are "additive", the union of the permission shall be applied.
I can be in a team, but that should not determine if I have now access to data or not. And the data permission should not be related to any team I belong to…

For important components (e.g. Quicksight or Sagemaker Studios) it is currently not working in data.all.

Example with Sagemaker Studio, can be applied 1:1 to Quicksight

• User A creates a ML Studio, leveraging role $\color{blue}{\textsf{playersRW}}$ The ML studio is only accessible by users that has the role $\color{blue}{\textsf{playersRW}}$

Than there are two tables (in glue for example sitting in two different accounts:

• goalkeepers, which is readable by users that have $\color{blue}{\textsf{playersRW}}$
• fouls that is readable for users with $\color{green}{\textsf{sanctionsRW}}$
• Sagemaker studio execution role is: $\color{blue}{\textsf{playersRW}}$

Current behavior

• User A, having $\color{blue}{\textsf{playersRW}}$ and $\color{green}{\textsf{sanctionsRW}}$ is not able to access fouls table from within sagemaker

Expected behavior for the two users:

from aws-dataall.