Access Denied error when creating a QuickSight dataset using boto

Question

Hello!  I'm trying to migrate a QuickSight dashboard from one account to another, working out of [this article](https://aws.amazon.com/blogs/big-data/biops-amazon-quicksight-object-migration-and-version-control/).  It gathers the details of each dataset, including the Physical Table Definition and Logical Table Definition.  Once it has these, it modifies the dataset definition to point to the new data source, and then runs [create_data_set()](https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/quicksight.html#QuickSight.Client.create_data_set) to replicate the dataset in the new account.

When I run create_data_set() it works for 70% of our datasets.  But for a few, it returns this error:

`An error occurred (AccessDeniedException) when calling the CreateDataSet operation: User: arn:aws:iam::12345678910:user/my_user is not authorized to access this resource`

I can't find the reason why it fails for some datasets and works for others. I also can't figure out what resource I'm being denied access to - it's trying to create a dataset, so what resource is it being denied?  For the record, my user has AdministratorAccess.

I would greatly appreciate any information about what permissions are needed to run create_data_set(), and what resources are being accessed, or anything else that could help me figure out what is going on with this error.  Thank you!

Answer

Thank you for posting the question and the detailed explanation, I understand you are trying to  migrate the resources from a source account to destination account and you are facing "AccessDeniedException" when replicating a few datasets.

In order to investigate this issue, you can check the following:

1. If you have access to the data sources for these datasets in the source account.

2.  Is the RLS dataset present in the source account for the failing datasets. If admin role in target account does not have access to that it can cause “AccessDeniedException” error. For more information about row-level security (RLS), please refer [here](https://docs.aws.amazon.com/quicksight/latest/user/row-level-security.html)

3. Check if the users who owned the dataset in the source account are able to create those failing datasets or are they seeing the issue as well?

4. If you have the datasources built for the datasets that are failing to create.

For diving deep into the issue, we will require details that are non-public information. Please open a support case with AWS using the following [link](https://us-east-1.console.aws.amazon.com/support/home?region=us-east-1#/case/create)

Access Denied error when creating a QuickSight dataset using boto

Contenuto pertinente