2단계: 인증 코드를 첨부하여 생성 URL

import java.util.List;
        import com.amazonaws.auth.AWSCredentials;
        import com.amazonaws.auth.AWSCredentialsProvider;
        import com.amazonaws.auth.BasicAWSCredentials;
        import com.amazonaws.regions.Regions;
        import com.amazonaws.services.quicksight.AmazonQuickSight;
        import com.amazonaws.services.quicksight.AmazonQuickSightClientBuilder;
        import com.amazonaws.services.quicksight.model.RegisteredUserDashboardEmbeddingConfiguration;
        import com.amazonaws.services.quicksight.model.AnonymousUserEmbeddingExperienceConfiguration;
        import com.amazonaws.services.quicksight.model.GenerateEmbedUrlForAnonymousUserRequest;
        import com.amazonaws.services.quicksight.model.GenerateEmbedUrlForAnonymousUserResult;
        import com.amazonaws.services.quicksight.model.SessionTag;


        /**
        * Class to call QuickSight AWS SDK to generate embed url for anonymous user.
        */
        public class GenerateEmbedUrlForAnonymousUserExample {

            private final AmazonQuickSight quickSightClient;

            public GenerateEmbedUrlForAnonymousUserExample() {
                quickSightClient = AmazonQuickSightClientBuilder
                    .standard()
                    .withRegion(Regions.US_EAST_1.getName())
                    .withCredentials(new AWSCredentialsProvider() {
                            @Override
                            public AWSCredentials getCredentials() {
                                // provide actual IAM access key and secret key here
                                return new BasicAWSCredentials("access-key", "secret-key");
                            }

                            @Override
                            public void refresh() {
                            }
                        }
                    )
                    .build();
            }

            public String GenerateEmbedUrlForAnonymousUser(
                final String accountId, // YOUR AWS ACCOUNT ID
                final String initialDashboardId, // DASHBOARD ID TO WHICH THE CONSTRUCTED URL POINTS.
                final String namespace, // ANONYMOUS EMBEDDING REQUIRES SPECIFYING A VALID NAMESPACE FOR WHICH YOU WANT THE EMBEDDING URL
                final List<String> authorizedResourceArns, // DASHBOARD ARN LIST TO EMBED
                final List<String> allowedDomains, // RUNTIME ALLOWED DOMAINS FOR EMBEDDING
                final List<SessionTag> sessionTags // SESSION TAGS USED FOR ROW-LEVEL SECURITY
            ) throws Exception {
                AnonymousUserEmbeddingExperienceConfiguration experienceConfiguration = new AnonymousUserEmbeddingExperienceConfiguration();
                AnonymousUserDashboardEmbeddingConfiguration dashboardConfiguration = new AnonymousUserDashboardEmbeddingConfiguration();
                dashboardConfiguration.setInitialDashboardId(initialDashboardId);
                experienceConfiguration.setDashboard(dashboardConfiguration);

                GenerateEmbedUrlForAnonymousUserRequest generateEmbedUrlForAnonymousUserRequest = new GenerateEmbedUrlForAnonymousUserRequest()
                    .withAwsAccountId(accountId)
                    .withNamespace(namespace)
                    .withAuthorizedResourceArns(authorizedResourceArns)
                    .withExperienceConfiguration(experienceConfiguration)
                    .withSessionTags(sessionTags)
                    .withSessionLifetimeInMinutes(600L); // OPTIONAL: VALUE CAN BE [15-600]. DEFAULT: 600
                    .withAllowedDomains(allowedDomains);

                GenerateEmbedUrlForAnonymousUserResult dashboardEmbedUrl = quickSightClient.generateEmbedUrlForAnonymousUser(generateEmbedUrlForAnonymousUserRequest);

                return dashboardEmbedUrl.getEmbedUrl();
            }

        }

global.fetch = require('node-fetch');
const AWS = require('aws-sdk');

function generateEmbedUrlForAnonymousUser(
    accountId, // YOUR AWS ACCOUNT ID
    initialDashboardId, // DASHBOARD ID TO WHICH THE CONSTRUCTED URL POINTS
    quicksightNamespace, // VALID NAMESPACE WHERE YOU WANT TO DO NOAUTH EMBEDDING
    authorizedResourceArns, // DASHBOARD ARN LIST TO EMBED
    allowedDomains, // RUNTIME ALLOWED DOMAINS FOR EMBEDDING
    sessionTags, // SESSION TAGS USED FOR ROW-LEVEL SECURITY
    generateEmbedUrlForAnonymousUserCallback, // GENERATEEMBEDURLFORANONYMOUSUSER SUCCESS CALLBACK METHOD
    errorCallback // GENERATEEMBEDURLFORANONYMOUSUSER ERROR CALLBACK METHOD
    ) {
    const experienceConfiguration = {
        "DashboardVisual": {
            "InitialDashboardVisualId": {
                "DashboardId": "dashboard_id",
                "SheetId": "sheet_id",
                "VisualId": "visual_id"
            }
        }
    };
    
    const generateEmbedUrlForAnonymousUserParams = {
        "AwsAccountId": accountId,
        "Namespace": quicksightNamespace,
        "AuthorizedResourceArns": authorizedResourceArns,
        "AllowedDomains": allowedDomains,
        "ExperienceConfiguration": experienceConfiguration,
        "SessionTags": sessionTags,
        "SessionLifetimeInMinutes": 600
    };

    const quicksightClient = new AWS.QuickSight({
        region: process.env.AWS_REGION,
        credentials: {
            accessKeyId: AccessKeyId,
            secretAccessKey: SecretAccessKey,
            sessionToken: SessionToken,
            expiration: Expiration
        }
    });

    quicksightClient.generateEmbedUrlForAnonymousUser(generateEmbedUrlForAnonymousUserParams, function(err, data) {
        if (err) {
            console.log(err, err.stack);
            errorCallback(err);
        } else {
            const result = {
                "statusCode": 200,
                "headers": {
                    "Access-Control-Allow-Origin": "*", // USE YOUR WEBSITE DOMAIN TO SECURE ACCESS TO THIS API
                    "Access-Control-Allow-Headers": "Content-Type"
                },
                "body": JSON.stringify(data),
                "isBase64Encoded": false
            }
            generateEmbedUrlForAnonymousUserCallback(result);
        }
    });
}

import json
import boto3
from botocore.exceptions import ClientError
import time

# Create QuickSight and STS clients
quicksightClient = boto3.client('quicksight',region_name='us-west-2')
sts = boto3.client('sts')

# Function to generate embedded URL for anonymous user
# accountId: YOUR AWS ACCOUNT ID
# quicksightNamespace: VALID NAMESPACE WHERE YOU WANT TO DO NOAUTH EMBEDDING
# authorizedResourceArns: DASHBOARD ARN LIST TO EMBED
# allowedDomains: RUNTIME ALLOWED DOMAINS FOR EMBEDDING
# dashboardId: DASHBOARD ID TO WHICH THE CONSTRUCTED URL POINTS
# sessionTags: SESSION TAGS USED FOR ROW-LEVEL SECURITY
def generateEmbedUrlForAnonymousUser(accountId, quicksightNamespace, authorizedResourceArns, allowedDomains, dashboardId, sessionTags):
    try:
        response = quicksightClient.generate_embed_url_for_anonymous_user(
            AwsAccountId = accountId,
            Namespace = quicksightNamespace,
            AuthorizedResourceArns = authorizedResourceArns,
            AllowedDomains = allowedDomains,
                ExperienceConfiguration = {
                    "Dashboard": {
                        "InitialDashboardId": dashboardId
                    }
                },
            SessionTags = sessionTags,
            SessionLifetimeInMinutes = 600
        )
            
        return {
            'statusCode': 200,
            'headers': {"Access-Control-Allow-Origin": "*", "Access-Control-Allow-Headers": "Content-Type"},
            'body': json.dumps(response),
            'isBase64Encoded':  bool('false')
        }
    except ClientError as e:
        print(e)
        return "Error generating embeddedURL: " + str(e)

다음 예제는 앱 서버에서 내장된 URL 대시보드용 대시보드를 생성하는 데 사용할 수 있는 JavaScript (Node.js) 를 보여줍니다. 웹 사이트 또는 URL 앱에서 이를 사용하여 대시보드를 표시할 수 있습니다.

const AWS = require('aws-sdk');
        const https = require('https');

        var quicksightClient = new AWS.Service({
            apiConfig: require('./quicksight-2018-04-01.min.json'),
            region: 'us-east-1',
        });

        quicksightClient.generateEmbedUrlForAnonymousUser({
            'AwsAccountId': '111122223333',
            'Namespace' : 'default',
            'AuthorizedResourceArns': authorizedResourceArns,
            'AllowedDomains': allowedDomains,
            'ExperienceConfiguration': experienceConfiguration,
            'SessionTags': sessionTags,
            'SessionLifetimeInMinutes': 600

        }, function(err, data) {
            console.log('Errors: ');
            console.log(err);
            console.log('Response: ');
            console.log(data);
        });

//The URL returned is over 900 characters. For this example, we've shortened the string for
        //readability and added ellipsis to indicate that it's incomplete.
            { 
                Status: 200,
                EmbedUrl: 'https://quicksightdomain/embed/12345/dashboards/67890..',
                RequestId: '7bee030e-f191-45c4-97fe-d9faf0e03713' 
            }

다음 예제는 를 보여줍니다. NET앱 서버에서 내장 대시보드를 생성하는 데 사용할 수 있는 /C # 코드입니다. URL 웹 사이트 또는 URL 앱에서 이를 사용하여 대시보드를 표시할 수 있습니다.

using System;
        using Amazon.QuickSight;
        using Amazon.QuickSight.Model;

        var quicksightClient = new AmazonQuickSightClient(
            AccessKey,
            SecretAccessKey,
            sessionToken,
            Amazon.RegionEndpoint.USEast1);
            
        try
        {
            Console.WriteLine(
                quicksightClient.GenerateEmbedUrlForAnonymousUserAsync(new GenerateEmbedUrlForAnonymousUserRequest
                {
                    AwsAccountId = "111122223333",
                    Namespace = default,
                    AuthorizedResourceArns = authorizedResourceArns,
                    AllowedDomains = allowedDomains,
                    ExperienceConfiguration = experienceConfiguration,
                    SessionTags = sessionTags,
                    SessionLifetimeInMinutes = 600,
                }).Result.EmbedUrl
            );
        } catch (Exception ex) {
            Console.WriteLine(ex.Message);
        }

역할을 맡으려면 다음 AWS Security Token Service (AWS STS) API 작업 중 하나를 선택하십시오.

다음 예제는 역할을 설정하는 CLI 명령을 보여줍니다. IAM 역할은 quicksight:GenerateEmbedUrlForAnonymousUser에 대한 권한이 활성화되어 있어야 합니다.

aws sts assume-role \
            --role-arn "arn:aws:iam::11112222333:role/QuickSightEmbeddingAnonymousPolicy" \
            --role-session-name anonymous caller
        

assume-role 작업은 액세스 키, 보안 키 및 세션 토큰의 세 가지 출력 파라미터를 반환합니다.

다음 예제는 에서 이러한 세 가지 매개 변수를 설정하는 방법을 보여줍니다CLI. Microsoft Windows 컴퓨터를 사용하는 경우 export 대신 set을(를) 사용하십시오.

export AWS_ACCESS_KEY_ID     = "access_key_from_assume_role"
        export AWS_SECRET_ACCESS_KEY = "secret_key_from_assume_role"
        export AWS_SESSION_TOKEN     = "session_token_from_assume_role"

이러한 명령을 실행하여 웹 사이트를 방문하는 사용자의 역할 세션 ID를 embedding_quicksight_dashboard_role/QuickSightEmbeddingAnonymousPolicy으로 설정합니다. 역할 세션 ID는 role-arn의 역할 이름과 role-session-name 값으로 구성됩니다. 각 방문 사용자에 대해 적절한 권한을 설정하려면 각 사용자에 대해 고유한 역할 세션 ID를 사용해야 합니다. 또한 각 세션을 분리하고 구분할 수 있습니다. 로드 밸런싱 등을 위해 여러 웹 서버를 사용하는 경우, 세션이 다른 서버에 다시 연결되면 새 세션이 시작됩니다.

대시보드 서명을 URL 받으려면 앱 generate-embed-url-for-anynymous-user 서버에서 호출하십시오. 그러면 내장 가능한 URL 대시보드가 반환됩니다. 다음 예제는 웹 포털 또는 앱을 익명으로 방문하는 사용자에 URL 대해 서버 측 호출을 사용하여 내장된 대시보드를 생성하는 방법을 보여줍니다.

aws quicksight generate-embed-url-for-anonymous-user \
--aws-account-id 111122223333 \
--namespace default-or-something-else \
--session-lifetime-in-minutes 15 \
--authorized-resource-arns '["dashboard-arn-1","dashboard-arn-2"]' \
--allowed-domains '["domain1","domain2"]' \
--session-tags '["Key": tag-key-1,"Value": tag-value-1,{"Key": tag-key-1,"Value": tag-value-1}]' \
--experience-configuration 'DashboardVisual={InitialDashboardVisualId={DashboardId=dashboard_id,SheetId=sheet_id,VisualId=visual_id}}'

이 작업의 사용에 대한 자세한 내용은 GenerateEmbedUrlForAnonymousUser 단원을 참조하세요. 자체 코드에서 이 작업과 기타 API 작업을 사용할 수 있습니다.