Quicksight public access restrictions

Question

Hi, we are trying to share some of our dashboards with external users and so far it looks like GenerateEmbedUrlForAnonymousUser is the way to go to pass session tags and use RLS to restrict data for each individual user (instead of query params that can be manipulated for instance). The issue we are facing is that in order for that API to work we have to set public access for the whole quicksight account and not for individual dashboards. Namespaces do not seem to be an option, to let's say, have one public and another one private.
Is this a valid approach or would something like enabling some sort of SSO integration be better? The main issue in that case being that there is no way to set session tags to filter the dataset using RLS.

Thanks in advance,

Mihir G · Answer

To share QuickSight dashboards with external users while restricting data access using row-level security (RLS) based on individual users, the recommended approach is to use the [GenerateEmbedUrlForAnonymousUser](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_GenerateEmbedUrlForAnonymousUser.html) API with session tags. This allows setting tag values at runtime to filter the dataset based on the specific user accessing the dashboard.

However, a key limitation of this approach is that it requires enabling anonymous (public) access for the entire QuickSight account, not just individual dashboards. This means that anyone with the embed URL can access the dashboards, although data access will be restricted by the RLS rules.

An alternative is to use SSO integration, but this does not support setting session tags for RLS filtering of the dataset based on individual users. SSO integration is suitable if you don't need to filter the dataset based on individual users.

If filtering the dataset using RLS based on individual users is a requirement, the `GenerateEmbedUrlForAnonymousUser` API with session tags is the recommended approach, despite the limitation of enabling public access for the entire QuickSight account. You should carefully evaluate the security implications and implement appropriate access controls to mitigate the risks associated with public access.

* [1] Using row-level security (RLS) with tag-based rules to restrict access to a dataset when embedding dashboards for anonymous users : 
https://docs.aws.amazon.com/quicksight/latest/user/quicksight-dev-rls-tags.html
* [2] Step 2: Generate the URL with the authentication code attached - 
https://docs.aws.amazon.com/quicksight/latest/user/embedded-analytics-dashboards-with-anonymous-users-step-2.html
* [3] Embedding QuickSight data dashboards for anonymous (unregistered) users - 
https://docs.aws.amazon.com/quicksight/latest/user/embedded-analytics-dashboards-for-everyone.html

Quicksight public access restrictions

Contenido relevante