Permissions for the different editions
In the Standard edition, all Amazon QuickSight administrators can manage subscriptions and SPICE capacity. They can also add, modify, and delete accounts.
Additional IAM permissions are required to manage Amazon QuickSight permissions to AWS resources and to unsubscribe from Amazon QuickSight. These tasks can only be performed by an IAM user who also has administrative permissions in Amazon QuickSight, or by the IAM user or AWS account that created the Amazon QuickSight account.
To manage access to AWS resources from Amazon QuickSight, you must be logged in as one of the following:
-
Any IAM user who is an Amazon QuickSight administrator
-
The IAM user or AWS root account that created the Amazon QuickSight account
All IAM Identity Center or Microsoft Active Directory users that are Amazon QuickSight administrators can manage subscriptions and SPICE capacity.
Additional IAM permissions are required to manage access to AWS resources or to unsubscribe from Amazon QuickSight. Administrators need to sign in with IAM permissions to perform these tasks.
The following table summarizes the admin actions that you can perform in QuickSight based on the access type that you choose.
| Admin action | IAM permissions | QuickSight administrator (non-IAM) |
|---|---|---|
|
Manage assets |
Yes |
|
|
Security & permissions |
Yes |
|
|
Manage VPC connections |
Yes |
|
|
KMS keys |
Yes |
|
|
Account settings |
Yes |
|
|
Account customization |
Yes |
|
|
Manage users |
Yes |
|
|
Your subscriptions |
Yes |
|
|
Mobile settings |
Yes |
|
|
Domains and embedding |
Yes |
|
|
SPICE capacity |
Yes |
