How do I troubleshoot row-level security issues in Quick Sight?

Short description

When you use RLS on your Quick Sight dataset, you might experience the following issues:

• You can't see any data in the Quick Sight embedded dashboard for anonymous Quick Sight users.
• Restricted users can still see all the data.
• Unrestricted users can't see any data.
• You receive the error code "DatasetRulesInvalidColType" when you apply RLS.
• You receive the error code "DatasetRulesUserDenied" when you create an analysis.

RLS has the following limitations:

• RLS is available only for Amazon Quick Suite Enterprise edition.
• RLS supports only textual data, such as string, char, and varchar for fields in the dataset rule. RLS doesn't work for dates or numeric fields.
• The full set of rule records that you can apply for each user can't exceed 999. Datasets with more than 999 rules might fail to apply RLS rules to the dataset.
• You can't apply RLS to empty rows with the default null value because Quick Sight treats null as an empty field value. However, Quick Sight treats spaces in a field as a literal value, so the dataset rule applies to these rows.
• Only users that you add to the dataset rule can see the data based on the rule that's defined. Other users can't see the data.
• When you use multiple fields in the dataset rules, the rules work as an AND operator. RLS doesn't support the OR operator.
• RLS only supports tag-based rules for embedded dashboards for anonymous users with the GenerateEmbedUrlForAnonymousUser API. If you embedded dashboards for registered users with the GenerateEmbedUrlForRegisteredUser API, then use user-based rules.

Resolution

You can't see any data in the Quick Sight embedded dashboard for anonymous users

If you use tag-based rules for your anonymous embedded dashboard, then you can't see or modify the data. To see the data, you must add user-based RLS rules to the dataset.

In the following example dataset rule, John Stiles can see data from only the Logistics department. Martha Rivera can see all the data from the dataset:

UserName,Department 
JohnStiles,Logistics
MarthaRivera,

Note: You can apply both tag-based rules and user-based RLS rules on your dataset.

Restricted users can still see all data

If a dataset contains too many rules, then even if you successfully applied RLS, restricted users can still see all the data. To resolve this issue, make sure that your dataset contains only 999 or fewer rules. If you restrict users by UserName and have more than 999 users in your dataset rule, then create Quick Sight groups. Add the users to the groups, and use GroupName instead of UserName in the dataset rule.

Unrestricted users can't see any data

Unrestricted users might not see data for the following reasons:

• The user doesn't exist in the dataset rule. Check the dataset rule to verify that all the intended users are there.
• The UserName or GroupName doesn't match the users or groups in Quick Sight. Check the UserName or GroupName from the dataset rule to verify that they match the users or groups in Quick Sight.

You receive the error code "DatasetRulesInvalidColType" when you apply RLS

If you use RLS for dates or numeric fields, then the "DatasetRulesInvalidColType" error occurs.

Check the field that's used to evaluate RLS in the dataset rule to verify that the data type is String. You can also edit the dataset to convert numeric fields to String in Quick Sight.

You receive the error code "DatasetRulesUserDenied" when you create an analysis

If the user isn't in the dataset rule, then the "DataRulesUserDenied" error occurs. To resolve this error, add the user to the dataset rule, and then refresh the dataset.