# Asset bundle operations Use Quick Sight asset bundle API operations to export Quick Sight assets from one account to another. Asset bundle operations can be used to back up or restore deleted work, promote new work into a production account, or to duplicate assets within an account or across multiple accounts. Asset bundle import and export operations support the following asset types: + Analyses + Dashboards + Data sources + Datasets + Shared folders + Restricted folders + Refresh schedules + Themes + VPC connections The following data sources and dataset types aren't supported by the asset bundle APIs. + Adobe Analytics + File + GitHub + JIRA + Salesforce + ServiceNow + Twitter **Topics** + [Permissions](assetbundle-permissions.md) + [Asset bundle export operations](assetbundle-export.md) + [Asset bundle import operations](assetbundle-import.md) # Permissions Before you begin, verify that you have an AWS Identity and Access Management role that grants the CLI user access to call the Quick Sight asset bundle API operations. Quick Sight recommends that you use the `AWSQuickSightAssetBundleExportPolicy` and `AWSQuickSightAssetBundleImportPolicy` IAM managed policies to streamline your API usage. You can also choose to explicitly define your oen IAM policy to fit your use case. For more information about IAM managed policies in Quick Sight, see [AWS managed policies for Quick Sight](https://docs.aws.amazon.com/quicksight/latest/user/security-iam-quicksight.html). The following example shows an IAM policy that you can add to an existing IAM role to use the `StartAssetBundleExportJob` operation. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "quicksight:DescribeAssetBundleExportJob", "quicksight:ListAssetBundleExportJobs", "quicksight:StartAssetBundleExportJob", "quicksight:DescribeAnalysis", "quicksight:DescribeDashboard", "quicksight:DescribeDataSet", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSource", "quicksight:DescribeRefreshSchedule", "quicksight:DescribeTheme", "quicksight:DescribeVPCConnection", "quicksight:ListRefreshSchedules", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeThemePermissions", "quicksight:ListTagsForResource" ], "Resource": "*" } ] } ``` ------ The following example shows an IAM policy that you can add to an existing IAM role to use the `StartAssetBundleImportJob` operation. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "quicksight:DescribeAssetBundleImportJob", "quicksight:ListAssetBundleImportJobs", "quicksight:StartAssetBundleImportJob", "quicksight:CreateAnalysis", "quicksight:DeleteAnalysis", "quicksight:DescribeAnalysis", "quicksight:UpdateAnalysis", "quicksight:CreateDashboard", "quicksight:DeleteDashboard", "quicksight:DescribeDashboard", "quicksight:UpdateDashboard", "quicksight:UpdateDashboardLinks", "quicksight:UpdateDashboardPublishedVersion", "quicksight:CreateDataSet", "quicksight:DeleteDataSet", "quicksight:DescribeDataSet", "quicksight:PassDataSet", "quicksight:UpdateDataSet", "quicksight:DeleteDataSetRefreshProperties", "quicksight:DescribeDataSetRefreshProperties", "quicksight:PutDataSetRefreshProperties", "quicksight:CreateRefreshSchedule", "quicksight:DescribeRefreshSchedule", "quicksight:DeleteRefreshSchedule", "quicksight:ListRefreshSchedules", "quicksight:UpdateRefreshSchedule", "quicksight:CreateDataSource", "quicksight:DescribeDataSource", "quicksight:DeleteDataSource", "quicksight:PassDataSource", "quicksight:UpdateDataSource", "quicksight:CreateTheme", "quicksight:DeleteTheme", "quicksight:DescribeTheme", "quicksight:UpdateTheme", "quicksight:CreateVPCConnection", "quicksight:DescribeVPCConnection", "quicksight:DeleteVPCConnection", "quicksight:UpdateVPCConnection", "quicksight:DescribeAnalysisPermissions", "quicksight:DescribeDashboardPermissions", "quicksight:DescribeDataSetPermissions", "quicksight:DescribeDataSourcePermissions", "quicksight:DescribeThemePermissions", "quicksight:UpdateAnalysisPermissions", "quicksight:UpdateDashboardPermissions", "quicksight:UpdateDataSetPermissions", "quicksight:UpdateDataSourcePermissions", "quicksight:UpdateThemePermissions", "quicksight:ListTagsForResource", "quicksight:TagResource", "quicksight:UntagResource", "s3:GetObject", "iam:PassRole" ], "Resource": "*", "Condition": { "StringEquals": { "iam:PassedToService": "quicksight.amazonaws.com" } } } ] } ``` ------ # Asset bundle export operations Quick Sight developers can use asset bundle export operations to export existing Quick Sight assets and download their definitions to be saved in your own storage. Quick Sight doesn't export data contained within the asset. These exported assets can be imported back into Quick Sight whenever you want. To export Quick Sight assets, start a named asynchronous export job. Then, poll for the job's completion, and then download the asset bundle with the download URL that's provided by the Quick Sight API. Assets that are exported with the Quick Sight asset bundle APIs can be exported as a Quick Sight JSON bundle or a CloudFormation JSON file. When you run an export job that generates a Quick Sight JSON file, the job returns a `.qs` zip file. The file can be unzipped to access the exported asset definitions. Use the following sections to learn more about the asset bundle export API operations. ## StartAssetBundleExportJob Export jobs are configured with the `StartAssetBundleExportJobRequest` object. Export jobs are identified by an `AssetBundleExportJobId` that you provide when you create the new export job. This ID is unique while the job is running. After the job is completed, you can reuse this ID for another job. Export jobs include a list of Quick Sight asset ARNs to be exported. You can choose to have all dependencies of the specified asset ARNs to be exported automatically with the rest of the job. For example, if you're creating a job to export a Quick Sight dashboard, you can also choose to export the dashboard's theme, dataset, and data source. Developers can also choose to have all assets in a folder and its subfolders exported automatically to preserve folder hierarchy and folder memberships. Parent folders are considered to be dependencies of subfolders and are included in the export if the `IncludeAllDependencies` parameter is set to `True`. Assets in a folder are considered folder members and are included in the export if the `IncludeFolderMembers` parameter is set to `ONE_LEVEL/RECURSE`. When assets are exported directly, folder membership information can be preserved when the `IncludeFolderMemberships` parameter is set to `True`. To include the folder in the direct export, set `IncludeAllDependencies` to `True`. All export jobs run asynchronously after they are started. Poll the status of an export job with a `DescribeAssetBundleExportJob` call to know is the current status of the job. Callers must have read-only permissions for all of the resource types that are exported, including the optional dependencies that are included in the export job. In some cases, certain Quick Sight assets contain anomalies that don't impact the end user's experience. By default, the `StartAssetBundleExportJob` API operates in `Lenient` mode, which ignores these anomalies. Callers can choose to enforce stricter validations with `Strict` mode during export. To do so, set the value of the optional `StrictModeForAllResources` parameter to `"True”`. The `StartAssetBundleImportJob` API operation follows the validation strategy that is defined in the exported bundle. To import an existing bundle with `Lenient` mode, run a new export job with the optional `StrictModeForAllResources` parameter set to `"False"`. For more information about the `StartAssetBundleExportJob` operation, see [StartAssetBundleExportJob](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_StartAssetBundleExportJob.html) in the *Quick Sight API Reference*. ## DescribeAssetBundleExportJob Use the `DescribeAssetBundleExportJob` operation to obtain the current status of an existing export job that's up to 14 days old. You can also use this operation to review a specified job's configuration. Export jobs that have succeeded return a download URL for the asset bundle file in their description. Failed export jobs return error information in their description. Poll this operation until the export job that you want the status of has succeeded or failed. For more information about the `DescribeAssetBundleExportJob` operation, see [DescribeAssetBundleExportJob](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAssetBundleExportJob.html) in the *Quick Sight API Reference*. ## ListAssetBundleExportJobs Use the `ListAssetBundleExportJobs` operation to retrieve a list of all export jobs that were created in the last 14 days. Export jobs are listed in the order that they were started, starting with the most recently started job. To have multiple lists by this operation, you can choose to specify a maximum page size to be returned and use a pagination token. For more information about the `ListAssetBundleImportJobs` operation, see [ListAssetBundleExportJobs](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListAssetBundleExportJobs.html) in the *Quick Sight API Reference*. ## Examples The following example uses a `StartAssetBundleExportJob` API call to create a CloudFormation JSON file with override parameters. ``` # configure and start the export job aws quicksight start-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID \ --resource-arns '["arn:aws:quicksight:REGION:AWSACCOUNTID:dashboard/RESOURCEID","arn:aws:quicksight:REGION:AWSACCOUNTID:analysis/RESOURCEID"]' \ --cloud-formation-override-property-configuration '{"Dashboards": [{"Arn": "arn:aws:quicksight:REGION:AWSACCOUNTID:dashboard/RESOURCEID","Properties": ["Name"]}]}' \ --include-all-dependencies \ --export-format CLOUDFORMATION_JSON # poll job description until status is success aws quicksight describe-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID # download the provided bundle (wget used here - any tool or browser works as well) wget -O ~/qs-bundle.qs 'https://the-long-url-from-your-job-description...' ``` The following example uses a `StartAssetBundleExportJob` API call to create a Quick Sight asset bundle file. ``` # configure and start the export job aws quicksight start-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID \ --resource-arns '["arn:aws:quicksight:REGION:AWSACCOUNTID:dashboard/RESOURCEID","arn:aws:quicksight:REGION:AWSACCOUNTID:analysis/RESOURCEID"]' \ --include-all-dependencies \ --export-format QUICKSIGHT_JSON # poll job description until status is success aws quicksight describe-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID # download the provided bundle (wget used here - any tool or browser works as well) wget -O ~/qs-bundle.qs 'https://the-long-url-from-your-job-description...' ``` The following example uses a `StartAssetBundleExportJob` API call to include information for tags. By default, tag information is not exported. ``` # Export in QuickSight format aws quicksight start-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID \ --resource-arns '["arn:aws:quicksight:REGION:AWSACCOUNTID:dashboard/RESOURCEID","arn:aws:quicksight:REGION:AWSACCOUNTID:analysis/RESOURCEID"]' \ --include-all-dependencies \ --include-tags \ --export-format QUICKSIGHT_JSON # Export in CloudFormation format, with optional tags overrides aws quicksight start-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID \ --resource-arns '["arn:aws:quicksight:REGION:AWSACCOUNTID:dashboard/RESOURCEID","arn:aws:quicksight:REGION:AWSACCOUNTID:analysis/RESOURCEID"]' \ --include-all-dependencies \ --include-tags \ --export-format CLOUDFORMATION_JSON ``` The following example uses a `StartAssetBundleExportJob` API call to include permissions information. By default, permission information is not exported. Permission overrides are not supported for the CloudFormation format. To import permissions for a CloudFormation format file, make sure that the source and target accounts are the same or have the same principal names for users, groups, and namespaces. ``` # Export in QuickSight format aws quicksight start-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID \ --resource-arns '["arn:aws:quicksight:REGION:AWSACCOUNTID:dashboard/RESOURCEID","arn:aws:quicksight:REGION:AWSACCOUNTID:analysis/RESOURCEID"]' \ --include-all-dependencies \ --include-permissions \ --export-format QUICKSIGHT_JSON # Export in CloudFormation format aws quicksight start-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID \ --resource-arns '["arn:aws:quicksight:REGION:AWSACCOUNTID:dashboard/RESOURCEID","arn:aws:quicksight:REGION:AWSACCOUNTID:analysis/RESOURCEID"]' \ --include-all-dependencies \ --include-permissions \ --export-format CLOUDFORMATION_JSON ``` The following example recusrively exports a folder along with all subfolders and the parent folder tree. ``` aws quicksight start-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID \ --resource-arns '["arn:aws:quicksight:REGION:AWSACCOUNTID:folder/RESOURCEID"]' \ --include-all-dependencies \ --include-folder-members RECURSE \ --export-format QUICKSIGHT_JSON" ``` The following example runs a dashboard export job that preserves the dashboard's folder memberships. ``` aws quicksight start-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID \ --resource-arns '["arn:aws:quicksight:REGION:AWSACCOUNTID:dashboard/RESOURCEID"]' \ --include-folder-memberships \ --export-format QUICKSIGHT_JSON ``` The following example calls the `StartAssetBundleExportJob` API with `Strict` mode. ``` aws quicksight start-asset-bundle-export-job --aws-account-id AWSACCOUNTID \ --asset-bundle-export-job-id JOBID \ --resource-arns '["arn:aws:quicksight:REGION:AWSACCOUNTID:dashboard/RESOURCEID","arn:aws:quicksight:REGION:AWSACCOUNTID:analysis/RESOURCEID"]' \ --include-all-dependencies \ --export-format QUICKSIGHT_JSON ``` # Asset bundle import operations Use asset bundle import operations to import Quick Sight assets from an Quick Sight bundle file that's generated by an earlier export job. The following statements apply to asset bundle import operations. + You can only import Quick Sight JSON bundles with the Quick Sight asset bundle APIs. CloudFormation JSON files can only be imported using the CloudFormation console or APIs. Both Quick Sight JSON and CloudFormation JSON files support property value overrides. If you want to generate a Quick Sight JSON file, property overrides are specified when you use an import API call. If you want to generate a CloudFormation JSON file, property overrides are configured with the `cloud-formation-override-property-configuration` parameter when you create or update the CloudFormation stack. You can import files that were created from your account, or you can import asset bundle files that were generated from other Quick Sight accounts. When you create a new import job, you can choose to provide overrides when you configure the import job. + The asset bundle import operations only support `.qs` format zip files. The `.qs` format file that contains the asset bundle that you want to import is in an Amazon S3 bucket or in a BASE64 encoded file that you can add to the import job directly. The S3 bucket exists in the same AWS account as your QuickSight account. + All import jobs run asynchronously after they are started. Poll the status of an import job with a `DescribeAssetBundleImportJob` API call to know the current status of the job. If an asset bundle import job fails, you can choose to have all assets that were successfully imported during the failed job rollback. Information about the error that caused the job to fail is returned in the job description of a `DescribeAssetBundleImportJob` API call. + All of an imported assets' dependencies must be present for an asset import job to succeed. You can include all dependencies of the asset when you export it. Alternatively, you can configure all dependencies in the QuickSight account that you want to move the asset into. For example, to import a dashboard, the dataset, data source, and theme that the dashboard uses must exist in the account that you're importing the asset into. The caller must have permissions to describe, create, and update all Quick Sight resources located in the asset that you want to import. + After an import job succeeds, grant permissions to all users or user groups that need to access the newly created resource. If you want to override the properties of the `QUICKSIGHT JSON` format export, provide the new values when you start an import job. If you want to override properties in a `CLOUDFORMATION JSON` format export, provide the property names to override when you start an export job. Then and add the new values when the stack is created in the CloudFormation console or with the CloudFormation APIs. Permissions are not propagated through the asset bundles. You can update asset permissions with an `UpdateDashboardPermissions` API call. Use the following sections to learn more about the asset bundle import API operations. ## StartAssetBundleImportJob Import jobs are configured with the `StartAssetBundleImportJobRequest` object. Import jobs are identified by an `AssetBundleImportJobId` that you provide when you create the new import job. This ID is unique while the job is running. After the job is completed, you can reuse this ID for another job. Provide an Amazon S3 uri or a base64-encoded ZIP file to the request. If you use an Amazon S3 uri, the caller must have `GetObject` permissions. All assets contained in the file are imported into the target account. You can choose to configure override values to be applied to specific assets when they are imported. All imported data sources must have credential overrides. You can store asset credentials in AWS Secrets Manager or you can set a username and password directly into an override. If you use Secrets Manager, provide the secret ARN in the data source override. The caller must have `GetSecretValue` and `DescribeSecret` permissions to configure the Secrets Manager secret to the override. All import jobs run asynchronously after they are started. Poll the status of an export job with a `DescribeAssetBundleImportJob` call to know the current status of the job. Callers must have read and write permissions for all of the resource types that are exported, including the optional dependencies that are included in the export job. When an asset import job fails, you can choose to have all assets that were successfully imported during the failed job roll back automatically. If you don't choose to roll back the assets, successfully imported assets will still exist in the account that they are imported to. Information about the error that caused the job to fail is returned in the job description of a `DescribeAssetBundleImportJob` API call. For more information about the `StartAssetBundleImportJob` operation, see [StartAssetBundleImportJob](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_StartAssetBundleImportJob.html) in the *Quick Sight API Reference*. ### VPC overrides When you make a `StartAssetBundleImportJob` API call, provide an override parameter for the VPC connection that's configured to your Quick Sight account. You can find the `OverrideParameters` value in the asset bundle file that was created when the asset was exported. The following example shows an `OverrideParameters` structure that uses the `PrefixForAllResources` value. ``` "OverrideParameters": { "VPCConnections": [ { "VPCConnectionId": " The following statements apply to asset bundle import permissions. + Asset bundle import operations support up to 64 principals. + The final state of an asset bundle's permissions are determined by the following. + If the `OverridePermissions` parameter is provided in the input, all existing permissions are replaced by the permissions that are specified in the `OverridePermissions` parameter. + If the asset bundle was exported with permissions, all existing permissions are replaced by the permissions that are in the exported asset bundle's file. + If neither of the above conditions are met, no changes are made to the asset's permissions. + If the caller executes an asset bundle import job from a different account than the account that the asset bundle was exported from, there are differences in the the user, group, and namespace principal ARNs. When this happens, provide the correct ARN values in the `OverridePermissions` parameter. ### Tags The final state of an asset's tags are determined by the following. + If the `OverrideTags` parameter is provided in the API input, all existing tags are replaced by the tags that are specified in the `OverrideTags` parameter. + If the asset bundle file is exported with tags, all existing tags are replaced by the tags that are in the asset bundle's file. + If neither of the above statements aren't met, no changes are made to the asset's tags. ## DescribeAssetBundleImportJob Use the `DescribeAssetBundleImportJob` operation to obtain the current status of an existing export job that's up to 14 days old. You can also use this operation to review a specified job's configuration. Failed import jobs return error information in their description. Poll this operation until the import job that you want the status of has succeeded or failed. For more information about the `DescribeAssetBundleImportJob` operation, see [DescribeAssetBundleImportJob](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeAssetBundleImportJob.html) in the *Quick Sight API Reference*. ## ListAssetBundleImportJobs Use the `ListAssetBundleImportJobs` operation to retrieve a list of all import jobs that were created in the last 14 days. Import jobs are listed in the order that they were started, starting with the most recently started job. If you expect to have multiple lists by this operation, you can choose to specify a maximum page size to be returned and use a pagination token. For more information about the `ListAssetBundleImportJobs` operation, see [ListAssetBundleImportJobs](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListAssetBundleImportJobs.html) in the *Quick Sight API Reference*. ## Examples The following example creates an asset bundle import job for a file that is located in the caller's Amazon S3 bucket. ``` # upload your bundle to an S3 bucket in your account aws s3 cp ~/qs-bundle.qs s3://bucket/key/qs-bundle.qs aws quicksight start-asset-bundle-import-job --aws-account-id AWSACCOUNTID \ --asset-bundle-import-job-id JOBID \ --asset-bundle-import-source '{"S3Uri": "s3://bucket/key/qs-bundle.qs"}' \ --failure-action ROLLBACK # poll job description until status is success (or failed) aws quicksight describe-asset-bundle-import-job --aws-account-id AWSACCOUNTID \ --asset-bundle-import-job-id JOBID # grant yourself or others permissions to view/modify the imported resources (for more information, see [UpdateDashboardPermissions](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboardPermissions.html) in the Amazon Quick Sight API Reference) # open your Quick Sight site in your browser and confirm the imported resources (important) ``` The following example creates an asset bundle import job with a bundle file that's uploaded directly. This example also uses data source credential overrides. ``` aws quicksight start-asset-bundle-import-job --aws-account-id AWSACCOUNTID \ --asset-bundle-import-job-id JOBID \ --asset-bundle-import-source-bytes fileb://~/qs-bundle.qs \ --asset-bundle-import-source-bytes fileb://~/qs-bundle.qs \ --override-parameters '{"DataSources": [{"DataSourceId": "some-data-source-id", "Credentials": {"CredentialPair": {"Username": "some-username", "Password": "some-password"}}}]}' \ --failure-action ROLLBACK # poll job description until status is success (or failed) aws quicksight describe-asset-bundle-import-job --aws-account-id AWSACCOUNTID \ --asset-bundle-import-job-id JOBID # grant yourself or others permissions to view/modify the imported resources (for more information, see [UpdateDashboardPermissions](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboardPermissions.html) in the Amazon Quick Sight API Reference) # open your Quick Sight site in your browser and confirm the imported resources (important) ``` The `Override` parameters also accept local files, as shown in the example below. ``` --override-parameters file://import-override-parameter-prod.json \ --override-permissions file://import-override-permission-prod.json \ --override-tags file://import-override-tags-prod.json \ ``` If callers want to assign different permissions to exported assets, they can provide an override object at import. There are two ways that this can be done. + Explicitly specify the resource IDs. If a prefix ID is specified, include the prefix in the resource ID. + Use the wildcard `"*"` to represent all resources of a specific type in the asset bundle files. In the example below, all dashboards that are included in the asset bundle file are imported with specified permissions. ``` // import-override-permission-prod.json { "DataSources": [ { "DataSourceIds": ["DATASOURCEID"], "Permissions": { "Principals": ["arn:aws:quicksight:REGION:AWSACCOUNTID:user/default/USERIR"], "Actions": [ "quicksight:UpdateDataSourcePermissions", "quicksight:DescribeDataSourcePermissions", "quicksight:PassDataSource", "quicksight:DescribeDataSource", "quicksight:DeleteDataSource", "quicksight:UpdateDataSource" ] } } ], "DataSets": [ { "DataSetIds": ["DATASETID"], "Permissions": { "Principals": ["arn:aws:quicksight:REGION:AWSACCOUNTID:user/default/USERIR"], "Actions": [ "quicksight:DeleteDataSet", "quicksight:UpdateDataSetPermissions", "quicksight:PutDataSetRefreshProperties", "quicksight:CreateRefreshSchedule", "quicksight:CancelIngestion", "quicksight:PassDataSet", "quicksight:ListRefreshSchedules", "quicksight:UpdateRefreshSchedule", "quicksight:DeleteRefreshSchedule", "quicksight:DescribeDataSetRefreshProperties", "quicksight:DescribeDataSet", "quicksight:CreateIngestion", "quicksight:DescribeRefreshSchedule", "quicksight:ListIngestions", "quicksight:DescribeDataSetPermissions", "quicksight:UpdateDataSet", "quicksight:DeleteDataSetRefreshProperties", "quicksight:DescribeIngestion" ] } } ], "Themes": [ { "ThemeIds": ["THEMEID"], "Permissions": { "Principals": ["arn:aws:quicksight:REGION:AWSACCOUNTID:user/default/USERIR"], "Actions": [ "quicksight:ListThemeVersions", "quicksight:UpdateThemeAlias", "quicksight:DescribeThemeAlias", "quicksight:UpdateThemePermissions", "quicksight:DeleteThemeAlias", "quicksight:DeleteTheme", "quicksight:ListThemeAliases", "quicksight:DescribeTheme", "quicksight:CreateThemeAlias", "quicksight:UpdateTheme", "quicksight:DescribeThemePermissions" ] } } ], "Analyses": [ { "AnalysisIds": ["ANALYSISIDS"], "Permissions": { "Principals": ["arn:aws:quicksight:REGION:AWSACCOUNTID:user/default/USERIR"], "Actions": [ "quicksight:RestoreAnalysis", "quicksight:UpdateAnalysisPermissions", "quicksight:DeleteAnalysis", "quicksight:DescribeAnalysisPermissions", "quicksight:QueryAnalysis", "quicksight:DescribeAnalysis", "quicksight:UpdateAnalysis" ] } } ], "Dashboards": [ { "DashboardIds": ["*"], "Permissions": { "Principals": ["arn:aws:quicksight:REGION:AWSACCOUNTID:user/default/USERIR"], "Actions": [ "quicksight:DescribeDashboard", "quicksight:ListDashboardVersions", "quicksight:UpdateDashboardPermissions", "quicksight:QueryDashboard", "quicksight:UpdateDashboard", "quicksight:DeleteDashboard", "quicksight:DescribeDashboardPermissions", "quicksight:UpdateDashboardPublishedVersion" ] } } ] } ``` If callers want to assign different tags to imported assets, they can provide an override object at import. There are two ways that this can be done. + Explicitly specify the resource IDs. If a prefix ID is specified, include the prefix in the resource ID. + Use the wildcard `"*"` to represent all resources of a specific type in the asset bundle files. In the example below, all dashboards that are included in the asset bundle file are imported with specified tags. ``` // import-override-tags-prod.json { "DataSources": [ { "DataSourceIds": ["DATASOURCEID"], "Tags": [ { "Key": "tagkey_datasource", "Value": "tagvalue_datasource" }, { "Key": "tagkey2_datasource", "Value": "tagvalue2_datasource" } ] } ], "DataSets": [ { "DataSetIds": ["*"], "Tags": [ { "Key": "tagkey_dataset", "Value": "tagvalue_dataset" }, { "Key": "tagkey2_dataset", "Value": "tagvalue2_dataset" } ] } ], "Themes": [ { "ThemeIds": ["*"], "Tags": [ { "Key": "tagkey_theme", "Value": "tagvalue_theme" }, { "Key": "tagkey2_theme", "Value": "tagvalue2_theme" } ] } ], "Analyses": [ { "AnalysisIds": ["*"], "Tags": [ { "Key": "tagkey_analysis", "Value": "tagvalue_analysis" }, { "Key": "tagkey2_analysis", "Value": "tagvalue2_analysis" } ] } ], "Dashboards": [ { "DashboardIds": ["*"], "Tags": [ { "Key": "tagkey_dashboard", "Value": "tagvalue_dashboard" }, { "Key": "tagkey2_dashboard", "Value": "tagvalue2_dashboard" } ] } ] } ``` If you want to import an asset bundle file with `Strict` mode, use the `OverrideValidationStrategy` parameter and set `StrictModeForAllResources` to `True`. The following example calls the `StartAssetBundleImportJob` API with `Strict` mode. ``` aws quicksight start-asset-bundle-import-job --aws-account-id AWSACCOUNTID \ --asset-bundle-import-job-id JOBID \ --asset-bundle-import-source-bytes fileb://~/qs-bundle.qs \ --override-validation-strategy '{"StrictModeForAllResources":true}' ```