Pass IAM roles to Quicksight - Enable different user creation depending on IAM group

Hi everyone,

We are setting up an application for our clients which includes a Quicksight dashboard. External users to the dashboard should be invited through Quicksight, but all users of the client who will have some administrative tasks in the operation of the application, and thus also have IAM users, should access Quicksight through their IAM user.

I tried to follow the steps in your documentation on Quicksight and IAM, but I am not sure I understood everything.

What I want is that users within a certain IAM group for readers will only be able to create Reader accounts when first signing in to Quicksight, while those in another group for Quicksight admins will create admin or author accounts.

But when I select "Manage QuickSight access to AWS services" and choose "IAM / Use existing role" I only see the option to select one role. So how would I best design this to get a different treatment for different users? Variables in the policy? Or did I misunderstand and the steps outlined in the documentation on passing the IAM role with Quicksight permissions to Quicksight apply only for the administrator role, but not the users who should only be readers?

Did I understand correctly that at first at least one "normal" login and user creation (with email registration) in Quicksight via the managed service role is needed as one can only change to the use of IAM roles there?

Many thanks for your help!

Best regards