Actions, resources, and condition keys for Amazon QuickSight
Amazon QuickSight (service prefix:
quicksight
) provides the following service-specific resources, actions, and condition context
keys for use in IAM permission policies.
References:
-
Learn how to configure this service .
-
View a list of the API operations available for this service .
-
Learn how to secure this service and its resources by using IAM permission policies.
Topics
Actions defined by Amazon QuickSight
You can specify the following actions in the
Action
element of an IAM policy statement. Use policies to grant permissions to perform
an operation in AWS. When you use an action in a policy, you usually allow or
deny access to the API operation or CLI command with the same name. However,
in some cases, a single action controls access to more than one operation. Alternatively,
some operations require several different actions.
The
Resource types
column indicates whether each action supports resource-level permissions. If
there is no value for this column, you must specify all resources ("*") in the
Resource
element of your policy statement. If the column includes a resource type, then
you can specify an ARN of that type in a statement with that action. Required
resources are indicated in the table with an asterisk (*). If you specify a resource-level
permission ARN in a statement using this action, then it must be of this type.
Some actions support multiple resource types. If the resource type is optional (not
indicated as required), then you can choose to use one but not the other.
For details about the columns in the following table, see The actions table .
Actions | Description | Access level | Resource types (*required) | Condition keys | Dependent actions |
---|---|---|---|---|---|
CancelIngestion | Grants permission to cancel a SPICE ingestions on a dataset | Write | |||
CreateAccountCustomization | Grants permission to create an account customization for QuickSight account or namespace | Write | |||
CreateAdmin [permission only] | CreateAdmin enables the user to provision Amazon QuickSight administrators, authors, and readers. | Write | |||
CreateAnalysis | Creates an analysis from a template | Write | |||
CreateCustomPermissions [permission only] | Grants permission to create a custom permissions resource for restricting user access | Write | |||
CreateDashboard | Creates a dashboard from a template | Write | |||
CreateDataSet | Grants permission to create a dataset | Write | |||
CreateDataSource | Grants permission to create a data source | Write | |||
CreateGroup | Create a QuickSight group. | Write | |||
CreateGroupMembership | Add a QuickSight user to a QuickSight group. | Write | |||
CreateIAMPolicyAssignment | Creates an assignment with one specified IAM Policy ARN that will be assigned to specified groups or users of QuickSight. | Write | |||
CreateIngestion | Grants permission to start a SPICE ingestion on a dataset | Write | |||
CreateNamespace | Grants permission to create an QuickSight namespace | Write | |||
CreateReader [permission only] | CreateReader enables the user to provision Amazon QuickSight readers. | Write | |||
CreateTemplate | Creates a template from an existing QuickSight analysis or template | Write | |||
CreateTemplateAlias | Creates a template alias for a template | Write | |||
CreateTheme | Creates a QuickSight theme | Write | |||
CreateThemeAlias | Creates a theme alias for a theme | Write | |||
CreateUser [permission only] | CreateUser enables the user to provision Amazon QuickSight authors and readers. | Write | |||
DeleteAccountCustomization | Grants permission to delete an account customization for QuickSight account or namespace | Write | |||
DeleteAnalysis | Deletes an analysis | Write | |||
DeleteDashboard | Deletes a dashboard | Write | |||
DeleteDataSet | Grants permission to delete a dataset | Write | |||
DeleteDataSource | Grants permission to delete a data source | Write | |||
DeleteGroup | Remove a user group from QuickSight. | Write | |||
DeleteGroupMembership | Remove a user from a group so that he/she is no longer a member of the group. | Write | |||
DeleteIAMPolicyAssignment | Update an existing assignment. | Write | |||
DeleteNamespace | Grants permission to delete a QuickSight namespace | Write | |||
DeleteTemplate | Deletes a template | Write | |||
DeleteTemplateAlias | Deletes the item that the specified template alias points to | Write | |||
DeleteTheme | Deletes a theme | Write | |||
DeleteThemeAlias | Deletes the item that the specified theme alias points to | Write | |||
DeleteUser | Delete the QuickSight user that is associated with the identity of the IAM user/role making the call. The IAM user is not deleted as a result of this call. | Write | |||
DeleteUserByPrincipalId | Deletes a user identified by its principal ID. | Write | |||
DescribeAccountCustomization | Grants permission to describe an account customization for QuickSight account or namespace | Read | |||
DescribeAccountSettings | Grants permission to describe the administrative account settings for QuickSight account | Read | |||
DescribeAnalysis | Provides a summary for an analysis | Read | |||
DescribeAnalysisPermissions | Describes read and write permissions for an analysis | Read | |||
DescribeCustomPermissions [permission only] | Grants permission to describe a custom permissions resource in a QuickSight account | Write | |||
DescribeDashboard | Provides a summary for a dashboard | Read | |||
DescribeDashboardPermissions | Describes read and write permissions for a dashboard | Read | |||
DescribeDataSet | Grants permission to describe a dataset | Read | |||
DescribeDataSetPermissions | Grants permission to describe the resource policy of a dataset | Permissions management | |||
DescribeDataSource | Grants permission to describe a data source | Read | |||
DescribeDataSourcePermissions | Grants permission to describe the resource policy of a data source | Permissions management | |||
DescribeGroup | Return a QuickSight group’s description and ARN. | Read | |||
DescribeIAMPolicyAssignment | Describe an existing assignment. | Read | |||
DescribeIngestion | Grants permission to describe a SPICE ingestion on a dataset | Read | |||
DescribeNamespace | Grants permission to describe a QuickSight namespace | Read | |||
DescribeTemplate | Describes a template's metadata | Read | |||
DescribeTemplateAlias | Describes the template alias for a template | Read | |||
DescribeTemplatePermissions | Describes read and write permissions on a template | Read | |||
DescribeTheme | Describes a theme's metadata | Read | |||
DescribeThemeAlias | Describes the theme alias for a theme | Read | |||
DescribeThemePermissions | Describes read and write permissions on a theme | Read | |||
DescribeUser | Return information about a user, given the user name. | Read | |||
GetAuthCode [permission only] | Return an auth code representing a QuickSight user. | Read | |||
GetDashboardEmbedUrl | Return a QuickSight dashboard embedding URL. | Read | |||
GetGroupMapping [permission only] | GetGroupMapping is used only in Amazon QuickSight Enterprise edition accounts. It enables the user to use Amazon QuickSight to identify and display the Microsoft Active Directory (Microsoft Active Directory) directory groups that are mapped to roles in Amazon QuickSight. | Read | |||
GetSessionEmbedUrl | Grants permission to get a URL to embed QuickSight console experience. | Read | |||
ListAnalyses | Lists analyses in an AWS account | List | |||
ListCustomPermissions [permission only] | Grants permission to list custom permissions resources in QuickSight account | Write | |||
ListDashboardVersions | Lists all the versions of the dashboards in the QuickSight subscription | List | |||
ListDashboards | Lists dashboards in an AWS account | List | |||
ListDataSets | Grants permission to list all datasets | List | |||
ListDataSources | Grants permission to list all data sources | List | |||
ListGroupMemberships | Return a list of member users in a group. | List | |||
ListGroups | Get a list of all user groups in QuickSight. | List | |||
ListIAMPolicyAssignments | List all assignments in the current Amazon QuickSight account. | List | |||
ListIAMPolicyAssignmentsForUser | List all assignments assigned to a user and the groups it belongs | List | |||
ListIngestions | Grants permission to list all SPICE ingestions on a dataset | Read | |||
ListNamespaces | Grants permission to lists all namespaces in a QuickSight account | Write | |||
ListTagsForResource | List tags of a QuickSight resource. | List | |||
ListTemplateAliases | Lists all the aliases of a template | List | |||
ListTemplateVersions | Lists all the versions of the templates in the current Amazon QuickSight account | List | |||
ListTemplates | Lists all the templates in the current Amazon QuickSight account | List | |||
ListThemeAliases | Lists all the aliases of a theme | List | |||
ListThemeVersions | Lists all the versions of a theme | List | |||
ListThemes | Lists all the themes in the current Amazon QuickSight account | List | |||
ListUserGroups | Return a list of groups that a given user is a member of. | List | |||
ListUsers | Return a list of all of the QuickSight users belonging to this account. | List | |||
PassDataSet [permission only] | Grants permission to use a dataset for a template | Read | |||
PassDataSource [permission only] | Grants permission to use a data source for a data set | Read | |||
RegisterUser | Create a QuickSight user, whose identity is associated with the IAM identity/role specified in the request. | Write | |||
RestoreAnalysis | Restores a deleted analysis | Write | |||
SearchAnalyses | Searches for analyses that belong to the user specified in the filter | List | |||
SearchDashboards | Searches for dashboards that belong to a user | List | |||
SearchDirectoryGroups [permission only] | SearchDirectoryGroups is used only in Amazon QuickSight Enterprise edition accounts. It enables the user to use Amazon QuickSight to display your Microsoft Active Directory directory groups so that you can choose which ones to map to roles in Amazon QuickSight. | Write | |||
SetGroupMapping [permission only] | SearchDirectoryGroups is used only in Amazon QuickSight Enterprise edition accounts. It enables the user to use Amazon QuickSight to display your Microsoft Active Directory directory groups so that you can choose which ones to map to roles in Amazon QuickSight. | Write | |||
Subscribe [permission only] | Subscribe enables the user to subscribe to Amazon QuickSight. Enabling this action also allows the user to upgrade the subscription to Enterprise edition. | Write | |||
TagResource | Add tags to a QuickSight resource | Tagging | |||
Unsubscribe [permission only] | Unsubscribe enables the user to unsubscribe from Amazon QuickSight, which permanently deletes all users and their resources from Amazon QuickSight. | Write | |||
UntagResource | Remove tags from a QuickSight resource. | Tagging | |||
UpdateAccountCustomization | Grants permission to update an account customization for QuickSight account or namespace | Write | |||
UpdateAccountSettings | Grants permission to update the administrative account settings for QuickSight account | Write | |||
UpdateAnalysis | Updates an analysis in an AWS account | Write | |||
UpdateAnalysisPermissions | Updates read and write permissions on an analysis | Write | |||
UpdateCustomPermissions [permission only] | Grants permission to update a custom permissions resource | Write | |||
UpdateDashboard | Updates a dashboard in an AWS account | Write | |||
UpdateDashboardPermissions | Updates read and write permissions on a dashboard | Write | |||
UpdateDashboardPublishedVersion | Updates the published version of a dashboard | Write | |||
UpdateDataSet | Grants permission to update a dataset | Write | |||
UpdateDataSetPermissions | Grants permission to update the resource policy of a dataset | Permissions management | |||
UpdateDataSource | Grants permission to update a data source | Write | |||
UpdateDataSourcePermissions | Grants permission to update the resource policy of a data source | Permissions management | |||
UpdateGroup | Change group description. | Write | |||
UpdateIAMPolicyAssignment | Update an existing assignment. | Write | |||
UpdateTemplate | Updates a template from an existing Amazon QuickSight analysis or another template | Write | |||
UpdateTemplateAlias | Updates the template alias of a template | Write | |||
UpdateTemplatePermissions | Updates the resource permissions for a template | Write | |||
UpdateTheme | Updates a theme | Write | |||
UpdateThemeAlias | Updates the theme alias of a theme | Write | |||
UpdateThemePermissions | Updates the resource permissions for a theme | Write | |||
UpdateUser | Updates an Amazon QuickSight user. | Write |
Resource types defined by Amazon QuickSight
The following resource types are defined by this service and can be used in the
Resource
element of IAM permission policy statements. Each action in the
Actions table
identifies the resource types that can be specified with that action. A resource
type can also define which condition keys you can include in a policy. These
keys are displayed in the last column of the table. For details about the columns
in the following table, see
The resource types table
.
Resource types | ARN | Condition keys |
---|---|---|
user |
arn:$
{
Partition}:quicksight:$
{
Region}:$
{
Account}:user/$
{
ResourceId}
|
|
group |
arn:$
{
Partition}:quicksight:$
{
Region}:$
{
Account}:group/$
{
ResourceId}
|
|
analysis |
arn:$
{
Partition}:quicksight:$
{
Region}:$
{
Account}:analysis/$
{
ResourceId}
|
|
dashboard |
arn:$
{
Partition}:quicksight:$
{
Region}:$
{
Account}:dashboard/$
{
ResourceId}
|
|
template |
arn:$
{
Partition}:quicksight:$
{
Region}:$
{
Account}:template/$
{
ResourceId}
|
|
datasource |
arn:$
{
Partition}:quicksight:$
{
Region}:$
{
Account}:datasource/$
{
ResourceId}
|
|
dataset |
arn:$
{
Partition}:quicksight:$
{
Region}:$
{
Account}:dataset/$
{
ResourceId}
|
|
ingestion |
arn:$
{
Partition}:quicksight:$
{
Region}:$
{
Account}:dataset/$
{
DatasetId}/ingestion/$
{
ResourceId}
|
|
theme |
arn:$
{
Partition}:quicksight:$
{
Region}:$
{
Account}:theme/$
{
ResourceId}
|
|
assignment |
arn:$
{
Partition}:quicksight::$
{
Account}:assignment/$
{
ResourceId}
|
|
customization |
arn:$
{
Partition}:quicksight::$
{
Account}:customization/$
{
ResourceId}
|
|
namespace |
arn:$
{
Partition}:quicksight::$
{
Account}:namespace/$
{
ResourceId}
|
Condition keys for Amazon QuickSight
Amazon QuickSight defines the following condition keys that can be used in the
Condition
element of an IAM policy. You can use these keys to further refine the conditions
under which the policy statement applies. For details about the columns in the
following table, see
The condition keys table
.
To view the global condition keys that are available to all services, see Available global condition keys .
Condition keys | Description | Type |
---|---|---|
aws:RequestTag/${TagKey} | Filters actions based on the presence of tag key-value pairs in the request | String |
aws:ResourceTag/${TagKey} | Filters actions based on tag key-value pairs attached to the resource | String |
aws:TagKeys | Filters actions based on the presence of tag keys in the request | String |
quicksight:IamArn | IAM user ARN or role ARN. | String |
quicksight:SessionName | The session name. | String |
quicksight:UserName | The user name. | String |