How do I manage Amazon Quick users?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Manage user access and permissions

Grant user access

To grant user access, see Inviting users to access Amazon Quick.

Change a user's role

Note: When you change a user's role, it takes up to 5 minutes to take effect.

To change a user's role that's integrated with AWS IAM Identity Center, see Changing a user's role.

To change a user's role for Amazon Quick or AWS Identity and Access Management (IAM) accounts, run the following update-user AWS CLI command:

​aws quicksight update-user \ 
​    --aws-account-id 111122223333 \ 
​    --namespace default \ 
​    --user-name USERNAME \ 
​    --email user@example.com \ 
​    --role READER 

Note: Replace 111122223333 with your AWS account ID, user@example.com with your user's email address, and USERNAME with your username.

Restrict access

To prevent unauthorized users from self-provisioning in Amazon Quick, attach IAM policies to restrict the following actions:

• quicksight:CreateUser
• quicksight:CreateAdmin
• quicksight:CreateReader

Example IAM policy to deny self-provisioning:

​{ 
​    "Version": "2012-10-17", 
​    "Statement": [ 
​        { 
​            "Effect": "Deny", 
​            "Action": [ 
​                "quicksight:CreateUser", 
​                "quicksight:CreateAdmin", 
​                "quicksight:CreateReader" 

​            ], 
​            "Resource": "*" 
​        } 
​    ] 
​} 

For accounts integrated with IAM Identity Center, complete the following steps:

1. Open Amazon Quick.
2. In the navigation bar, choose the dropdown list, and then choose Manage account.
3. Choose Manage users, then choose Manage role groups.
4. Use the tables to add or remove IAM Identity Center groups from Admin, Author, or Reader roles.

To restrict dashboard access, complete the following steps:

1. Use the Amazon Quick sharing model.
2. Use row-level security (RLS) to restrict data visibility within dashboards.
3. Use custom permission profiles to restrict specific capabilities.

Delete user account

To delete a user account, see Deleting a Amazon Quick user account.

To delete IAM Identity Center or Active Directory integrated accounts, see Deactivating user accounts.

View users

To view users in the Amazon Quick console, complete the following steps:

1. Open the Amazon Quick console.
2. In the navigation bar, choose the dropdown list, and then choose Manage account.
3. In the navigation pane, choose Manage users.
4. To search for a specific user, enter a username or email in the search box.
5. To view inactive users, choose the Inactive users tab.

To view users with AWS CLI, run the following list-users AWS CLI command:

​aws quicksight list-users \ 
​    --aws-account-id 111122223333 \ 
​    --namespace default 

Note: Replace 111122223333 with your account ID.

Then, to check a specific user's details, run the following describe-user AWS CLI command:

​aws quicksight describe-user \ 
​    --aws-account-id 111122223333 \ 
​    --namespace default \ 
​    --user-name USERNAME 

Note: Replace 111122223333 with your account ID and USERNAME with your user name.

Monitor user activity

Use the Manage users page

The Manage users page displays the last date and time each user accessed the Amazon Quick console in the Last active column.

Use AWS CloudTrail

AWS CloudTrail integrates with Amazon Quick and logs API operations and console actions. You can use CloudTrail to monitor the following events:

• User sign-in events
• Dashboard access
• User management actions
• Data source and dataset operations

To view CloudTrail events for Amazon Quick, complete the following steps:

1. Open the CloudTrail console.
2. Choose Event history.
3. In the Lookup attributes section, choose Event source and then enter: quicksight.amazonaws.com.

For last login information, use the Manage users page or CloudTrail logs.

Identify inactive users for cleanup

To identify inactive users, take the following actions:

• Sort by Last active status in the Manage users page.
• Query CloudTrail logs in the last 90 days to find users with no recent activity.
• Use the ListUsers API operation and cross-reference with CloudTrail data.

Troubleshoot user management issues

User doesn't appear in Amazon Quick

If a user appears in the ListUsers API operation output but doesn't appear in the Amazon Quick console, then the user is in an inactive state or in a non-default namespace. Or, it doesn't appear in the console because you've reached a display quota.

To resolve this issue, use the following list-users AWS CLI command to verify user status:

aws quicksight list-users --aws-account-id 111122223333 --namespace default

Note: Replace 111122223333 with your account ID.

"User already exists" error message when you register a user

If you try to register a user and a user record exists in the system for that user, then you might get the "User already exists" error message.

To resolve this error, check the namespaces for the user. If you deleted the user, then try to register the user after a few minutes. If you continue to experience this issue, then contact AWS Support.

Can't remove a user

If you try to remove a user and you don't have Amazon Quick administrator permissions, the user is the only administrator in the account or the user has resources. You might get an error message.

To resolve the error, take the following actions:

• Make sure that you have configured the quicksight:DeleteUser IAM permission.
• Transfer or delete user-owned resources.
• Make sure that at least one other administrator exists in the account.

Users with an administrator role

If you use IAM Identity Center or single sign-on (SSO), then users might be automatically provisioned with elevated roles. To resolve this issue, complete the following steps:

1. Review your IAM Identity Center group-to-role mappings in Amazon Quick.
2. Make sure that you map the correct groups to the correct roles.
3. Attach an IAM policy to an IAM user group to restrict the quicksight:CreateUser and quicksight:CreateAdmin actions.

ListUsers API operation has no results or latency

The ListUsers API operation has a maximum of 100 results per page. For accounts with many users, take the following actions:

• Use pagination with the NextToken parameter.
• Make sure that you are below the Amazon Quick Sight service quota.
• Implement exponential backoff in your API operations.

Billing for inactive users

Amazon Quick charges are by user and on a monthly basis. If you delete a user in mid-month, then you are still charged for that user for the remainder of the month. Inactive users that appear in the inactive list aren't charged after their removal date.

To avoid unexpected charges, regularly audit your user list and remove unused accounts.

Related information

Managing user access inside Amazon QuickSight

Managing access for Amazon QuickSight and IAM users

Logging Amazon QuickSight operations with AWS CloudTrail

IAM policy examples for Amazon QuickSight