Granting QuickSight access to Secrets Manager and selected secrets

To grant QuickSight access to Secrets Manager and selected secrets

1. In QuickSight, choose your user icon on the upper right, and then choose Manage QuickSight.

   

2. Choose Security & permissions on the left.

3. Choose Manage in QuickSight access to AWS resources.

   

4. In Allow access and autodiscovery for these resources, choose AWS Secrets Manager, Select secrets.

   The AWS Secrets Manager secrets page opens.

5. Select the secrets that you want to grant QuickSight read-only access to.

   Secrets in your QuickSight sign-up Region are shown automatically. To select secrets outside your home Region, choose Secrets in Other AWS Regions, and then enter the Amazon Resource Names (ARNs) for those secrets.

6. When you're done, choose Finish.

   QuickSight creates an IAM role called aws-quicksight-secretsmanager-role-v0 in your account. It grants users in the account read-only access to the specified secrets and looks similar to the following:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "secretsmanager:GetSecretValue"
         ],
         "Resource": [
           "arn:aws:secretsmanager:region:accountId:secret:secret_name"
         ]
       }
     ]
   }

   When QuickSight users create analyses from or view dashboards that use a data source with secrets, QuickSight assumes this Secrets Manager IAM role. For more information about secret permissions policies, see Authentication and access control for AWS Secrets Manager in the AWS Secrets Manager User Guide.

   The specified secret in the QuickSight IAM role may have an additional resource policy that denies access. For more information, see Attach a permissions policy to a secret in the AWS Secrets Manager User Guide.

   If you're using an AWS managed AWS KMS key to encrypt your secret, QuickSight doesn't require any additional permissions setup in Secrets Manager.

   If you're using a customer managed key to encrypt your secret, ensure that the QuickSight IAM role, aws-quicksight-secretsmanager-role-v0 has kms:Decrypt permissions. For more information, see Permissions for the KMS key in the AWS Secrets Manager User Guide.

   For more information about the types of keys used in AWS Key Management Service, see Customer keys and AWS keys in the AWS Key Management Service guide.