Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Amazon QuickSight - READER role cannot see Export toolbar icon (Print / Generate PDF) on interactive dashboards despite no custom permission restrictions at any layer

0

Category/Tags: Amazon QuickSight, Amazon Quick

--- TITLE --- READER role cannot see Export toolbar icon (Print / Generate PDF) on interactive dashboards despite no custom permission restrictions at any layer

--- BODY ---

We have an IAM Identity Center-federated QuickSight user with role READER who is unable to see the dashboard-level Export toolbar icon (which contains Print, Generate PDF, and View exports) on ANY interactive dashboard, across two of our accounts (dev and staging), region ap-southeast-5.

The same user CAN see and use the per-visual "Export to CSV" option from the widget-level context menu ("..." menu on each visual). Only the dashboard-level toolbar Export icon (Print/Generate PDF/View exports) is missing.

When the SAME dashboard is opened by a user with the ADMIN role, the toolbar Export icon with Print/Generate PDF/View exports IS visible and functional.

We have verified the following, all of which confirm no restriction is configured at any customer-controllable layer:

  1. Role-level custom permission (READER):

    aws quicksight describe-role-custom-permission --role READER
    --aws-account-id <ACCOUNT_ID> --namespace default

    Result: ResourceNotFoundException - "Role is not mapped to a custom permission"

  2. User-level custom permission (the affected reader user):

    aws quicksight describe-user --user-name <READER_USERNAME>
    --aws-account-id <ACCOUNT_ID> --namespace default

    Result: No CustomPermissionsName field present in the response

  3. Account-level custom permission:

    aws quicksight describe-account-custom-permission
    --aws-account-id <ACCOUNT_ID>

    Result: ResourceNotFoundException - "Account is not mapped to a custom permission"

  4. List of all custom permission profiles in the account:

    aws quicksight list-custom-permissions --aws-account-id <ACCOUNT_ID>

    Result: Empty list ([])

  5. Dashboard publish option (ExportToCSVOption), checked across all dashboards in both accounts via describe-dashboard-definition:

    Result: ENABLED on every dashboard scanned

  6. Account edition:

    aws quicksight describe-account-subscription --aws-account-id <ACCOUNT_ID>

    Result: Edition = ENTERPRISE (not Standard)

  7. Frontend embedding code (amazon-quicksight-embedding-sdk v2) was also reviewed and correctly sets:

    contentOptions.toolbarOptions = { export: true, undoRedo: true, reset: true }

    (Confirmed this is NOT the cause — the same behavior reproduces in the native QuickSight/Amazon Quick console directly, not just in our embedded application.)

--- QUESTIONS ---

  1. Is it expected/by-design behavior in the current Amazon Quick UI that the READER role does not get the dashboard-level Export toolbar icon (Print/Generate PDF/View exports), while ADMIN (and/or AUTHOR) roles do - independent of any custom permissions configuration?

  2. If this is expected, what is the supported way to grant READER users access to Print/Generate PDF from the dashboard toolbar? (e.g. is a different role such as READER_PRO required, or is there an ALLOW-style custom permission we're missing — the current custom-permissions API only appears to support DENY values?)

  3. If this is NOT expected behavior, could this be a bug/regression? We suspect it may correlate with the recent QuickSight → "Amazon Quick" rebrand/UI update, though we cannot confirm an exact change date.

--- ATTACHMENTS TO CONSIDER (screenshot with any org-identifying info cropped/blurred) ---

  • Screenshot: READER role viewing a dashboard — only "Export to CSV" visible (per-visual menu), no toolbar Export icon
  • Screenshot: ADMIN role viewing the SAME dashboard — Export icon with Print/Generate PDF/View exports visible in the toolbar

--- ENVIRONMENT --- Region: ap-southeast-5 QuickSight Namespace: default Authentication: IAM Identity Center (federated) Affected user role: READER

  • Florian Turnwald EXPERT
    7 days ago

    If my answer was helpful, I would appreciate it if you could mark it as the accepted answer.

Topics
Analytics
Tags
Amazon Quick Sight
Language
English

asked 8 days ago45 views

2 Answers
0
Accepted Answer

Based on the current Amazon QuickSight functionality, the behavior you're experiencing is expected by design. The dashboard-level Export toolbar icon (which provides Print and Generate PDF options) is not available to users with the READER role. This capability is restricted to users with ADMIN or AUTHOR roles.

READER role users can export data from individual visuals to CSV files using the per-visual context menu, which aligns with what you're observing. However, the ability to export or print an entire dashboard as a PDF is a higher-level permission that requires elevated roles.

To grant READER users access to Print/Generate PDF functionality from the dashboard toolbar, you would need to assign them a role with broader permissions, such as AUTHOR. Unfortunately, there isn't a READER_PRO role or an ALLOW-style custom permission that would enable this specific capability while maintaining the READER role. The custom permissions framework in QuickSight primarily supports restriction (DENY) operations rather than granting additional capabilities beyond what the base role provides.

The role-based access model in QuickSight is designed so that:

  • READER role: Can view dashboards and export individual visual data to CSV
  • AUTHOR role: Can create, edit, and export full dashboards to PDF
  • ADMIN role: Has full administrative capabilities including all export functions

If your use case requires READER-level users to have PDF export capabilities, you'll need to evaluate whether upgrading those users to AUTHOR role aligns with your security and governance requirements, keeping in mind that AUTHOR role also grants dashboard creation and editing permissions.
Sources
Exporting and printing interactive Amazon Quick Sight dashboard reports - Amazon Quick
Exporting data from Quick Sight analyses - Amazon Quick
Exporting and printing Amazon Quick Sight reports - Amazon Quick

answered 8 days ago

EXPERT

reviewed 7 days ago

0

My understanding is different to the re:Post Agent’s answer, because as by design, the READER role in QuickSight fully supports exporting dashboards to PDF. You absolutely do not need to upgrade users to an AUTHOR role to enable this native functionality. Since you have already verified via the CLI that no Custom Permissions (DENY policies) are mapped to the user, role, or account, and that the dashboard publish options explicitly have exports enabled, the missing toolbar is not expected behavior.

This heavily points to a UI bug or a regional rendering issue in ap-southeast-5, potentially related to recent console updates.

I recommend opening an AWS Support ticket. Be sure to provide them with your CLI outputs, the screenshots, and reference the layer Amazon QuickSi....txt file if you have those network traces captured. Official AWS documentation confirming Reader export capabilities: https://docs.aws.amazon.com/quicksight/latest/user/export-a-dashboard.html

EXPERT

answered 8 days ago

  • daudbasir
    8 days ago

    Thank you, Florian — this matches our own conclusion exactly. Since the CLI checks (role/user/account-level custom permissions, dashboard publish options) all come back clean, and the docs confirm READER should have export access by default, a UI/rendering bug seems like the most likely explanation rather than a permissions gap.

    A couple of follow-up questions if you don't mind:

    1. Have you seen this specific toolbar-rendering issue (Export icon missing entirely, not just PDF) reported before for ap-southeast-5, or tied to a particular Amazon Quick console release?
    2. Is there a known workaround in the meantime (e.g. forcing a different rendering path, cache-busting, or a specific browser/session reset) while we wait on a Support case?

    We'll go ahead and open an AWS Support ticket with the full CLI output and both screenshots (READER vs ADMIN on the same dashboard) as you suggested, and will post back here with the case outcome in case others hit the same issue.

  • Florian Turnwald EXPERT
    7 days ago

    No, I Never faced that issue and no as I did not faced it I have no workaround.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content