Open pziss opened 1 month ago
Hi @pziss, thanks for opening an issue with so much detail and discovery. Your experimentation is much appreciated and will help us in any future designs (it's great to see that only the sharing dashboards presents issues:) ). At the moment we are in the exploration phase on IAM Identity Center and data.all and features are not yet part of our roadmap. We'll keep this issue open and will reach out when we include it in our plan. FYI @petrkalos
Describe the bug
Problem Overview
After switching the QuickSight authentication method from IAM federated identities and QuickSight-managed users to QuickSight using Identity Center, I have encountered an issue with sharing dashboards between different QuickSight accounts. Data.all users who are part of the same team can automatically view a dashboard once it has been imported. However, when data.all users request access to a dashboard created by another team via a share request, they receive the below error message. This functionality works as expected with QuickSight accounts using IAM federated identities and QuickSight-managed users.
“An error occurred (AccessDeniedException) when calling the CreateGroup operation: Operation is disabled for identities managed by IAM Identity Center”
When testing this functionality with QuickSight accounts using IAM federated identities and QuickSight-managed users, I observed that data.all creates a group called
dataall
in the QuickSight account where the dashboard was created. This group includes the email address of the dashboard owner and all other users assigned to that QuickSight account. Additionally, data.all creates a team-specific group named after the requesting team and adds the email address of the data.all account that submitted the share request. This team-specific group is grantedViewer
permissions for the requested dashboard.The error message would indicate that data.all is attempting to create the
dataall
group and/or a group named after the requesting team to facilitate cross-account dashboard sharing. However, this process is failing because users and groups are managed by Identity Center rather than QuickSight. In my case, I am using an external IdP, so user management is technically handled by Okta.Attempted Workaround
I have attempted to manually create the
dataall
group and a group named after the requesting team in Okta/Identity Center. These groups were then mapped to the QuickSight account where the dashboard was created, with the Reader role. I then assignedViewer
permissions to the team-specific group for the requested dashboard, as would normally be configured automatically by data.all. However, I am now encountering the below error message.“An error occurred (AccessDeniedException) when calling the RegisterUser operation: Operation is disabled for identities managed by IAM Identity Center”
The error message would indicate that while data.all has now identified these groups, it is still trying to register users to them.
How to Reproduce
Pre-work (for each QuickSight account)
How to Reproduce
Expected behavior
No response
Your project
No response
Screenshots
No response
OS
n/a
Python version
n/a
AWS data.all version
1.5.6
Additional context
No response