Use AMS Self-Service Provisioning (SSP) mode to access Amazon QuickSight capabilities directly in your AMS managed account. Amazon QuickSight is a fast, cloud-powered business intelligence service that delivers insights to everyone
in your organization. As a fully managed service, Amazon QuickSight lets you easily create and publish interactive dashboards
that include machine learning (ML) insights.
To learn more, see Amazon QuickSight
Amazon QuickSight in AWS Managed Services FAQs
Common questions and answers:
Q: How do I request access to Amazon QuickSight in my AMS account?
Request access by submitting a Management | AWS service | Self-provisioned
service | Add change type (ct-1w8z66n899dct). This RFC provisions the
following IAM role to your account:
customer_quicksight_console_admin_role. After it's
provisioned in your account, you must onboard the role in your federation
solution.
Q: What are the restrictions to using Amazon QuickSight in my AMS account?
AWS resource settings on Amazon QuickSight won’t be accessible to you because of the IAM policy dependency. However, the AMS team enables each resource for you in response to your request to enable the service.
Resource access for individual users and groups are not supported in this model because this feature enables users to alter IAM permissions that could compromise AMS infrastructure.
The ability to invite IAM identities from within QuickSight is not supported due to the risk involved altering IAM objects.
Amazon QuickSight service offers two editions: Enterprise and Standard. Both provide a single sign-on (SSO) option that is supported on AMS. However, the Enterprise Edition has an option to integrate Amazon QuickSight with Active Directory (AD). Amazon QuickSight on AMS does not support integration with AD due to incompatibilities between AMS account structure and the Amazon QuickSight trust requirements.
Q: What are the prerequisites or dependencies to using Amazon QuickSight in my AMS account?
When AMS receives this RFC to add Amazon QuickSight, you are sent a service request for additional information; provide them the following:
Amazon QuickSight account name (for example,
CustomerName-quicksightAmazon QuickSight Edition (Standard versus Enterprise)
The AWS Region in which to enable the Amazon QuickSight service (defaults to your AMS AWS Region).
A notification email address for Amazon QuickSight account.
(Optional) The S3 bucket where data files to be analyzed are located.
The VPC and subnet IDs that connect to Amazon QuickSight support a feature to add a VPC connection, which enables private connectivity between Amazon QuickSight and resources inside the account.
An AMS operator performs the sign up process on your behalf and configures two QuickSight functionalities:
Auto discovery to data sources.
Note
These actions need to be performed by an AMS operator because elevated IAM and VPC permissions are required during the sign-in process.
