AWS Cloud Intelligence dashboard templates blocked by SCPs ?

0

Trying to implement the AWS Cloud Intelligence Dashboards for my organisation. The data collection steps are all proceeding well, but I am unable to install the dashboards. Regardless of whether using CloudFormation or the cli tool, for some reason the QuickSight templates are returning an "Access Denied" error.

Specifically: *CRITICAL - Error: An error occurred (AccessDeniedException) when calling the DescribeTemplate operation: * <user> not authorized to perform: quicksight:DescribeTemplate on resource: arn:aws:quicksight:us-east-1:223485597511:template/cudos_dashboard_v3 with an explicit deny in a service control policy

Does anyone have any suggestions please ?

Shane H
已提問 10 個月前檢視次數 265 次
3 個答案
1

I would review what SCP's you have in place in your ORG/OU's https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

If using control tower, you may have turned on some controls which places SCP's into effect to prevent specific actions. There are mandatory controls inplace https://docs.aws.amazon.com/controltower/latest/userguide/mandatory-controls.html

Here is some documentation which also relates to an SCP to block QuickSight https://docs.aws.amazon.com/quicksight/latest/user/security-scp.html

profile picture
專家
已回答 10 個月前
0

The error you got is typically caused indeed by SCP.

Suggestion is to access or request the account owner/organization to and, modify the explicit SCP deny by allowing your account for instance to perform the quick sight action.

profile picture
專家
已回答 10 個月前
profile pictureAWS
專家
已審閱 10 個月前
0

I am getting the same error, i think this is the issue with AWS account which is in below ARN. That account is owned by AWS and its referred by CFN to get some template. as I dont have anything in us-east-1 and below account is not part of my organisation.

arn:aws:quicksight:us-east-1:223485597511:template/cudos_dashboard_v3 with an explicit deny in a service control policy

profile picture
Sagar
已回答 9 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南