How do I troubleshoot Amazon Quick asset bundle export and import issues?

Resolution

Prerequisite: Use the AWSQuickSightAssetBundleExportPolicy and AWSQuickSightAssetBundleImportPolicy AWS managed policies for asset bundle operations.

Troubleshoot export issues

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

VPC connection issues

You get the following error message:

"NetworkInterfaces should have more than 1 item for VPC connection"

The preceding error occurs when you run an import or export API operation, and you don't have subnets to support Multi-AZ virtual private cloud (VPC) connectivity.

To resolve this issue, you can use the Amazon Quick console to configure multiple subnets across different Availability Zones for your VPC connection. Or, use the UpdateVPCConnection API operation.

It's a best practice to regularly audit VPC connections to make sure that they comply with current requirements.

Unsupported data set type

If you have data sources and datasets that the asset bundle export operations don't support, then you get the following error message:

"The data set type is not supported through API yet"

To resolve this issue, change the dataset to one of the following supported types:

• Amazon Simple Storage Service (Amazon S3)
• Amazon Redshift
• Amazon Relational Database Service (Amazon RDS)

Troubleshoot import issues

Subnets don't exist

If your override parameters reference a VPC resource ID from a destination environment instead of the source environment, then you might get the following error message:

"The provided subnets are invalid. Please make sure all subnets exist."

To resolve this issue, complete the following steps:

1. Check the VpcConnectionId in your override parameters.
2. Replace the ID with the VPC connection ID from the source environment.
3. Make sure that the subnet IDs match the available subnets in the destination environment.
   Note: Override parameters reference source IDs. Before you export, it's a best practice to note the document source IDs.

Source IDs don't match

If your data source ID in the override parameters doesn't match the data source ID in the bundle file, then you might get the following error message:

"DataSourceCredentials field is incorrectly set"

To resolve this issue, provide credentials for bundled data sources in override parameters. Make sure the data source ID in the override matches the ID in the bundle.

Example:

"DataSources": [ 
  { 
    "DataSourceId": "datasource_id", 
    "Credentials": { 
      "CredentialPair": { 
        "Username": "username", 
        "Password": "password" 
      } 
    } 
  } 
] 

Note: Replace datasource_id with your source account data source ID, username with your user name and password with your password.

If you use a prefix, then run the following start-asset-bundle-import-job AWS CLI command to add the prefix to each resource ID in the override parameters:

"ResourceIdOverrideConfiguration": { 
  "PrefixForAllResources": "prefix_" 
}, 
"DataSources": [ 
  { 
    "DataSourceId": "prefix_datasource id", 
    "Credentials": { 
      "CredentialPair": { 
        "Username": "username", 
        "Password": "password" 
      } 
    } 
  } 
], 
"Dashboards": [ 
  { 
    "DashboardId": "myprefix_dashboard id", 
    "Name": "My new dashboard" 
  } 
] 

Note: Replace prefix_ with your prefix, datasource_id with your source account data source ID, and dashboard_id with your source account dashboard ID.

Failed to assume role

You get the following error message:

"Failed to assume your role. Verify the trust relationships of the role in the IAM console."

The preceding error occurs when either the AWS Identity and Access Management (IAM) role for the VPC connection is missing the required IAM trust policy. Or, you didn't create the IAM role with the required permissions in the import account.

To resolve this issue, add the following IAM trust policy to the execution role to allow Amazon Quick Sight to perform Amazon Elastic Compute Cloud (Amazon EC2) operations for VPC connections:

{ 
  "Version": "2012-10-17", 
  "Statement": [ 
    { 
      "Effect": "Allow", 
      "Principal": { 
        "Service": "quicksight.amazonaws.com" 
      }, 
      "Action": "sts:AssumeRole" 
    } 
  ] 
} 

InvalidParameterValueException

If you transfer assets across accounts, then asset bundle imports don't localize the principal for permissions and you might get the following error message:

"An error occurred (InvalidParameterValueException) when calling the CreateTheme operation: Principal is part of a different account"

To resolve this issue, specify the correct principals for the target account in the OverridePermissions parameter when you import. Or, you can manually edit the principal Amazon Resource Name (ARNs) in the JSON files before you import.

Dashboard or analysis error messages

If your dashboard or analysis contains asset-as-code issues that aren't within lenient mode, then you might get an error message.

To resolve this issue, use the lenient mode to export and import the asset. If you still have issues, then contact AWS Customer Support.

Troubleshoot issues after import

New assets have different IDs

If the source asset bundle and target asset bundle have different IDs, then the asset bundle import operation can't replace assets. By default, assets that you created in different accounts have different IDs.

To resolve this issue, take the following actions:

• Export assets from the source account and import them to the target account to establish ID consistency.
• Use only one account for Amazon Quick development.
• Use asset bundles to move changes to other accounts.
• Maintain consistent asset IDs across environments.

It's a best practice to document your asset migration strategy and create a consistent workflow for asset promotion.

Authors can't see imported assets

User, group, and namespace principal ARNs differ between accounts. By default, permissions don't propagate through asset bundles.

To resolve this issue, take the following actions:

• Run the UpdateDashboardPermissions API operation to update asset permissions.
• Use the --include-permissions option to export source permissions.
• For cross-account imports, provide ARN values in the OverridePermissions parameter.

Before you migrate, it's a best practice to document permission structure and create permission templates for consistent application.