# Sharing and subscribing to data in Amazon Quick Sight with dashboards and reports Dashboards and reports: Sharing data A *dashboard* is a read-only snapshot of an analysis that you can share with other Amazon Quick Sight users for reporting purposes. A dashboard preserves the configuration of the analysis at the time you publish it, including such things as filtering, parameters, controls, and sort order. The data used for the analysis isn't captured as part of the dashboard. When you view the dashboard, it reflects the current data in the data sets used by the analysis. When you share a dashboard, you specify which users have access to it. Users who are dashboard viewers can view and filter the dashboard data. Any selections to filters, controls, or sorting that users apply while viewing the dashboard exist only while the user is viewing the dashboard, and aren't saved after it's closed. Users who are dashboard owners can edit and share the dashboard, and optionally can edit and share the analysis. If you want them to also edit and share the data set, you can set that up in the analysis. A shared dashboard can also be embedded in a website or app, if you are using Enterprise edition. For more information about embedded dashboards, see [Embedded analytics for Amazon Quick Sight](embedded-analytics.md). Use the following sections to learn how to publish and share dashboards, subscribe to threshold alerts, and send and subscribe to dashboard email reports. **Topics** + [ # Publishing dashboards ](creating-a-dashboard.md) + [ # Sharing Amazon Quick Sight dashboards ](sharing-a-dashboard.md) + [ # Using Quick action connectors in dashboard visuals ](action-connectors-in-dashboard-visuals.md) + [ # Sharing your view of a Amazon Quick Sight dashboard ](share-dashboard-view.md) + [ # Scheduling and sending Quick Sight reports by email ](sending-reports.md) + [ # Subscribing to email reports in Amazon Quick Sight ](subscribing-to-reports.md) + [ # Working with threshold alerts in Amazon Quick Sight ](threshold-alerts.md) + [ # Printing a dashboard or analysis ](printing1.md) + [ # Exporting Amazon Quick Sight analyses or dashboards as PDFs ](export-dashboard-to-pdf.md) + [ # Error codes for failed PDF export jobs ](qs-reports-error-codes.md) + [ # Organizing assets into folders for Amazon Quick Sight ](folders.md) # Publishing dashboards Publishing dashboards When you publish an analysis, that analysis becomes a dashboard that can be shared and interacted with by users of your Amazon Quick account or, in some cases, with anonymous users that aren't on your account. You can choose to publish one sheet of an analysis, all sheets in the analysis, or any other combination of sheets that you want. When you publish an interactive sheet, that sheet becomes an interactive dashboard that users can interact with. When you publish a pixel perfect report sheet, the sheet becomes a pixel perfect report that generates and saves a snapshot of the report's data when you schedule a report in Amazon Quick Sight. You can publish a dashboard that contains any combination of interactive sheets and pixel perfect reports from the same analysis. For more information about scheduling a report, see [Scheduling and sending Quick Sight reports by email](sending-reports.md) . For more information about viewing a report's snapshots, see [Consuming pixel perfect reports in Amazon Quick Sight](qs-reports-consume-reports.md). Use the following procedure to publish and optionally share a dashboard. You can also use this procedure to rename a published dashboard. A renamed dashboard retains its security and emailed report settings. 1. Open the analysis that you want to use. Choose **Publish**. 1. Do one of the following: + To create a new dashboard, choose **New dashboard**, and then type a dashboard name. + To replace an existing dashboard, do one of the following. Replacing a dashboard updates it without altering security or emailed report settings. + To update it with your changes, choose **Replace an existing dashboard** and then choose a dashboard from the list. + To rename it, choose **Replace an existing dashboard**, choose a dashboard from the list, and then select the pencil icon. Enter a new name to rename the existing dashboard and click the checkmark or press enter to confirm. When you publish a dashboard after renaming, it also saves any changes you made to the analysis. Changes to the analysis or dashboard are not persisted until you **Publish**. An initial version of a dashboard must be published in order to rename it. 1. (Optional) Choose the sheets that you want to publish in the **SHEETS** dropdown. When you select sheets to add to the new dashboard, the dropdown shows how many sheets are selected for publishing. The default option is **ALL SHEETS SELECTED**. If you are replacing an existing dashboard, the sheets that are already published to the existing dashboard are pre-selected in the dropdown, unless you are publishing from an analysis you have not previously published from. You can make changes to this by selecting or de-selecting sheets from the dropdown list. 1. (Optional) Add comments on the changes you have made in the notes section, which is available to view under [Version History](publishing-a-previous-dashboard-version.md). 1. (Optional) To allow dashboard readers to share data stories, choose **Allow sharing data stories**. For more information about data stories, see [Working with data stories in Amazon Quick Sight](working-with-stories.md). 1. (Optional) Open **More Settings**. These options are only available if at least one sheet in the new dashboard is an interactive sheet. **Note** This is a scrollable window. Scroll down in the **Publish a dashboard** window to view all available options. There are some options that you can turn off to simplify the experience for this dashboard, as follows: + For **Dashboard options**: + Leave **Expand on-sheet controls by default** cleared to show a simplified view. This is disabled by default. To show the controls by default, turn on this option. + Clear **Enable advanced filtering on the left pane** to remove the ability for dashboard viewers to filter the data themselves. If they create their own filters, the filters exist only while the user is viewing the dashboard. Filters can't be saved or reused. + Clear **Enable on-hover tooltip** to turn off tooltips. + For **Visual options**: + Clear **Enable visual menu**, to turn off the on-visual menu entirely. + Clear **Enable download options** if your dashboard viewers don't need to be able to download data from the visuals in the dashboard. The CSV file includes only what is currently visible in the visual at the time they download it. The viewer downloads data by using the on-visual menu on each individual visual. + Clear **Enable maximize visual option** to turn off the ability to enlarge visuals to fill the screen. + For **Data point options**: + Clear **Enable drill up/down** if your dashboard doesn't offer drillable field hierarchies. + Clear **Enable on-click tooltip** to turn off tooltips that appear when the reader chooses (clicks on) a data point. + Clear **Enable sort options** to turn off sorting controls. 1. Choose **Publish dashboard**. If you renamed the existing dashboard, the top of the screen refreshes to show the new name. 1. (Optional) Do one of the following: + To publish a dashboard without sharing, choose **x** at the upper right of the **Share dashboard with users** screen when it appears. You can always share the dashboard later by choosing **File>Share** from the application bar. + To share the dashboard, follow the procedure in [Sharing Amazon Quick Sight dashboards](sharing-a-dashboard.md). After you complete these steps, you complete creating and sharing the dashboard. Subscribers of the dashboard receive email that contains a link to the dashboard. Groups don't receive invitation emails. # Copying an Amazon Quick Sight dashboard Copying a dashboard If you have co-owner access or **Save as** privileges on an existing dashboard, you can copy it. To do this, create a new analysis from the dashboard and then create a new dashboard from the analysis that you copied. After you save the original dashboard as a new analysis, you can collaborate on it by sharing the new analysis with other users. For example, you can use this workflow to preserve a production version of the dashboard, while also developing or testing a new version of it. **To copy a dashboard** 1. Sign in to Quick and choose **Dashboards** from the homepage. 1. Open the dashboard that you want to duplicate. 1. At upper right, choose **Save As**, and then enter a name for the new analysis. When you save an existing dashboard using **Save As**, it creates an analysis based on the dashboard. **Note** If you can't see **Save as**, check with your administrator that you have the right permissions. 1. (Optional) Make changes to the new analysis. 1. (Optional) Share the analysis with other users so you can collaborate on changes. All users who have access can make changes to the new analysis. To share the analysis with other users, choose **Share** from the top right corner of the page, and then choose **Share analysis**. 1. (Optional) Create a new dashboard with your changes to the new analysis by choosing **Share**, and then choosing **Publish Dashboard**. For more information, see the following: + [Sharing Amazon Quick Sight dashboards](sharing-a-dashboard.md) + [Sharing Quick Sight analyses](sharing-analyses.md) # Deleting an Amazon Quick Sight dashboard Deleting dashboards When you delete an Amazon Quick Sight dashboard, the dashboard is permanently removed from your account and all folders that the dashboard was a part of. You will no longer be able to access the deleted dashboard. You can only delete dashboards that you own or co-own. Use the following procedure to delete a dashboard. **To delete a dashboard** 1. On the **Dashboards** tab of the Amazon Quick homepage, choose the details icon (vertical dots ⋮) on the dashboard that you want to delete. 1. Choose **Delete**. Then choose **Delete** again to confirm that you want to delete the dashboard. Deleting a dashboard permanently deletes the dashboard from your account, and the dashboard will disappear from all folders that it belonged to. You can still access and create other dashboards from the analysis that the deleted dashboard was published from. # Publishing a previous version of an Amazon Quick Sight dashboard Publishing previous dashboard versions Each time you make updates to an analysis and publish it, a new version of the Amazon Quick Sight dashboard is created. To revert back to a previous version of a dashboard, you can search for it under the dashboard’s **Version History** and publish the former version you are interested in. Each dashboard can store up to 1000 versions that are never deleted. Use the following procedure to publish a previous version of a dashboard. **To publish a previous version of a dashboard** 1. On the **Dashboards** tab of the Amazon Quick homepage, choose the dashboard that you want to manage. 1. Choose **Version History** on the toolbar on the right. The version of the dashboard that is currently published, as well as previous available versions, will appear in a list. Any comments that were added in the notes section will appear with the respective version. 1. Select the version of the dashboard you are interested in. You can see when this version was published and which user published it. 1. To revert to this version, select **Publish**. Click **Confirm** to publish the version. # Sharing Amazon Quick Sight dashboards Sharing dashboards By default, dashboards in Amazon Quick Sight aren't shared with anyone and are only accessible to the owner. However, after you publish a dashboard, you can share it with other users or groups in your Amazon Quick account. You can also choose to share the dashboard with everyone in your Quick account and make the dashboard visible on the Quick homepage for all users in your account. Additionally, you can copy a link to the dashboard to share with others who have access to it. **Important** Users who have access to the dashboard can also see the data used in the associated analysis. After you share a dashboard, you can review the other users or groups that have access to it and control the type of access they have. You can revoke access to the dashboard for any user. You can also remove yourself from it. You can also embed interactive dashboards and visuals in websites and apps by copying the dashboard or visual embed code and pasting it in your application. For more information, see [Embedding Amazon Quick Sight visuals and dashboards for registered users with a 1-click embed code](embedded-analytics-1-click.md). # Granting access to a dashboard You can share dashboards and visuals with specific users or groups in your account or with everyone in your Amazon Quick account. Or you share them with anyone on the internet. You can share dashboards and visuals by using the Quick console or the Quick Sight API. Access to a shared visual depends on the sharing settings that are configured for the dashboard that the visual belongs to. To share and embed visuals to your website or application, adjust the sharing settings of the dashboard that it belongs to. For more informaton, see the following: + [Granting individual Amazon Quick Sight users and groups access to a dashboard in Amazon Quick Sight](share-a-dashboard-grant-access-users.md) + [Granting everyone in your Amazon Quick Sight account access to a dashboard](share-a-dashboard-grant-access-everyone.md) + [Granting anyone on the internet access to an Amazon Quick Sight dashboard](share-a-dashboard-grant-access-anyone.md) + [Granting everyone in your Amazon Quick account access to a dashboard with the Quick Sight API](share-a-dashboard-grant-access-everyone-api.md) + .[Granting anyone on the internet access to an Amazon Quick Sight dashboard using the Quick Sight API](share-a-dashboard-grant-access-anyone-api.md) # Granting individual Amazon Quick Sight users and groups access to a dashboard in Amazon Quick Sight With individual users and groups Use the following procedure to grant access to a dashboard. **To grant users or groups access to a dashboard** 1. Open the published dashboard and choose **Share** at upper right. Then choose **Share dashboard**. 1. In the **Share dashboard** page that opens, do the following: 1. For **Invite users and groups to dashboard** at left, enter a user email or group name in the search box. Any users or groups that match your query appear in a list below the search box. Only active users and groups appear in the list. 1. For the user or group that you want to grant access to the dashboard, choose **Add**. Then choose the level of permissions that you want them to have. You can select **Viewer** or **Co-owner**, depending on the user's Quick role. The available permissions for each role are as follows: + **Readers** – Quick readers can only be granted **Viewer** access to dashboards. They can view, export, and print the dashboard, but they can't save the dashboard as an analysis. They can view, filter, and sort the dashboard data. They can also use any controls or custom actions that are on the dashboard. Any changes that they make to the dashboard exist only while they are viewing it, and aren't saved after they close the dashboard. + **Authors** – Quick authors can be granted **Viewer** or **Co-owner** access to dashboards. + Authors with Viewer access can view, export, and print the dashboard. They can view, filter, and sort the dashboard data. They can also use any controls or custom actions that are on the dashboard. Any changes that they make to the dashboard exist only while they are viewing it, and aren't saved after they close the dashboard. However, they can save the dashboard as an analysis, unless the dashboard owner specifies otherwise. This privilege grants them read-only access to the datasets so that they can create new analyses from them. The owner has the option to provide them with the same permissions to the analysis. If the owner wants them also to edit and share the datasets, the owner can set that up inside the analysis. + Authors with Co-owner access can view, export, and print the dashboard. They can also edit, share, and delete it. They can also save the dashboard as an analysis, unless the dashboard owner specifies otherwise. This privilege grants them read-only access to the datasets so that they can create new analyses from them. The owner has the option to provide them with the same permissions to the analysis. If the owner wants them to also edit and share the datasets, the owner can set that up inside the analysis. + **Groups** – Quick groups can only be granted **Viewer** access to dashboards. They can view, export, and print the dashboard, but they can't save the dashboard as an analysis. After you add a user or group to the dashboard, you can see information about them in the **Manage permissions** section, under **Users & Groups**. You can see their user name, email, permission level, and "save as" privileges. To allow a user or group to save the dashboard as an analysis, turn on **Allow "save as"** in the **Save as Analysis** column. 1. To add more users to the dashboard, enter another user email or group name in the search box and repeat steps A and B. # Granting everyone in your Amazon Quick Sight account access to a dashboard With everyone in your account Alternatively, you can share your Amazon Quick Sight dashboard with everyone in your account. When you do this, everyone in your account can access the dashboard, even if they weren't granted access individually and assigned permissions. They can access the dashboard if they have a link to it (shared by you) or if it's embedded. Sharing the dashboard with everyone in your account doesn't affect email reports. For example, suppose that you choose to share the dashboard with everyone in your account. Suppose also that you choose **Send email report to all users with access to dashboard** when setting up an email report for the same dashboard. In this case, the email report is sent only to people who have access to the dashboard. They receive access either through someone explicitly sharing it with them, through groups, or through shared folders. **To grant everyone in your account access to a dashboard** 1. Open the published dashboard and choose **Share** at upper right. Then choose **Share dashboard**. 1. In the **Share dashboard** page that opens, for **Enable access for** at bottom left, toggle on **Everyone in this account**. Accounts that sign in with an Active Directory can't access the **Everyone in this account** switch. Accounts that use Active Directory can enable this setting with an `UpdateDashboardPermissions` API call. For more information on `UpdateDashboardPermissions`, see [UpdateDashboardPermissions](https://docs.aws.amazon.com//quicksight/latest/APIReference/API_UpdateDashboardPermissions.html) in the *Amazon Quick Sight API Reference*. 1. (Optional) Toggle on **Discoverable in Quick Sight**. When you share a dashboard with everyone in the account, owners can also choose to make the dashboard discoverable in Quick Sight. A dashboard that's discoverable appears in everyone's list of dashboards on the **Dashboards** page. When this option is turned on, everyone in the account can see and search for the dashboard. When this option is turned off, they can only access the dashboard if they have a link or if it's embedded. The dashboard doesn't appear on the **Dashboards** page, and users can't search for it. # Granting anyone on the internet access to an Amazon Quick Sight dashboard With anyone on the internet | | | --- | |  Applies to: Enterprise Edition  | You can also share your Amazon Quick Sight dashboard with anyone on the internet from the **Share** menu in the Amazon Quick console. When you do this, anyone on the internet will be able to access the dashboard, even if they aren't a registered user on your Quick account, when you share the dashboard link or embed the dashboard. Use the following sections to grant anyone on the internet access to dashboard when you share it. **Topics** + [ # Before you start ](share-a-dashboard-grant-access-anyone-prerequisites.md) + [ # Granting anyone on the internet access to a dashboard ](share-a-dashboard-grant-access-anyone-access.md) + [ # Updating a publicly shared dashboard ](share-a-dashboard-grant-access-anyone-update.md) + [ # Turning off public sharing settings ](share-a-dashboard-grant-access-anyone-no-share.md) # Before you start Before you can share a dashboard with anyone on the internet, make sure to do the following: 1. Turn on session capacity pricing on your account. If you have not turned on session capacity pricing on your account, you won't be able to update your account's public sharing settings. 1. Assign public sharing permissions to an administrative user in the IAM console. You can add these permissions with a new policy or you can add the new permissions to an existing user. The following sample policy provides permissions for use with `UpdatePublicSharingSettings`. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Action": "quicksight:UpdatePublicSharingSettings", "Resource": "*", "Effect": "Allow" } ] } ``` ------ Accounts that don't want users with administrator access to use this feature can add an IAM policy that denies public sharing permissions. The following sample policy denies permissions for use with `UpdatePublicSharingSettings`. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Action": "quicksight:UpdatePublicSharingSettings", "Resource": "*", "Effect": "Deny" } ] } ``` ------ For more information on using IAM with Quick Sight, see [Using Quick with IAM](security_iam_service-with-iam.md). You can also use the "Deny" policy as a Service Control Policy (SCP) if you don't want any of the accounts in your organization to have the public sharing feature. For more information, see [Service control policies (SCPs)](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html) in the *AWS Organizations User Guide*. 1. Turn on public sharing on your Amazon Quick account. 1. From the Amazon Quick start page, choose your user icon at the upper right of your browser window, and then choose **Manage Quick**. 1. In the page that opens, scroll down to the **Permissions** section. 1. Choose **Public access to dashboards** at left. 1. On the page that opens, choose **Anyone on the internet**. When you turn on this setting, a pop up will appear asking you to confirm your choice. Once you've confirmed your choice, you can grant the public access to specific dashboards and share those dashboards with them with a link or by embedding the dashboard in a public application, wiki, or portal. # Granting anyone on the internet access to a dashboard **To grant anyone on the internet access to a dashboard** 1. In Quick, open the published dashboard that you want to share. You must be the owner or a co-owner of the dashboard. 1. In the published dashboard, choose the **Share** icon at upper-right, and then choose **Share dashboard**. 1. In the **Share dashboard** page that opens, choose **Anyone on the internet (public)** in the **Enable access for** section at bottom-left. This setting allows you to share the dashboard with anyone on the internet with the share link or when embedded. Turning on this switch also automatically turns on the **Everyone in this account** option, which means that the dashboard will be shared with anyone in your Quick account. If you do not want this, turn off this option. 1. In the **Allow public access** pop-up that appears, enter `confirm` in the box to confirm your choice, and then choose **Confirm**. After you confirm your dashboard's access settings, an orange **PUBLIC** tag appears at upper right of your dashboard in the Amazon Quick console. Additionally, an eye icon appears on the dashboard on the Quick Sight Dashboards page, both in tile and list view. Note that when public access is turned on, the dashboard can only be accessed using the link or when embedded using the embed code. For more information about sharing a link to the dashboard, see [Sharing a link a shared dashboard](share-a-dashboard-share-link.md). For more information about embedding dashboards for anyone on the internet, see [Embedding Amazon Quick Sight visuals and dashboards for anonymous users with a 1-click embed code](embedded-analytics-1-click-public.md). # Updating a publicly shared dashboard Use the following procedure to update a shared dashboard that can be accessed by anyone on the internet. **To update a public dashboard:** 1. From the Amazon Quick start page, choose the analysis that is tied to the dashboard that you want to update and make your desired changes. You must be the owner or a co-owner of the analysis. 1. In the analysis, choose **Publish**. 1. In the pop-up that appears, choose **Replace an existing dashboard** and select the public dashboard that you want to update. 1. To confirm your choice, enter `confirm` and then choose **Publish dashboard**. Once you choose **Publish dashboard**, your public dashboard is updated to reflect the new changes. # Turning off public sharing settings You can turn off public sharing settings for dashboards at anytime. You can turn off public sharing for an individual dashboard, or for all dashboards in your account. Visual sharing settings are determined at the dashboard level. If you turn off public sharing settings to a dashboard that holds a visual that you are embedding, users won't be able to access the visual. The following table describes the different scenarios for when a dashboard is publicly available. | Account-level public setting | Dashboard-level public setting | Public access | Visual indicators | | --- | --- | --- | --- | | Off | Off | Off | None | | On | Off | Off | None | | On | On | Yes | An orange badge appears on the dashboard and an eye icon appears on the dashboard in the **Dashboards** page. | | Off | On | No | A grey badge appears on the dashboard and an eye icon with a slash appears on the dashboard in the **Dashboards** page. It can take up to two minutes for a dashboard's public access to be revoked. | **To turn off public sharing for a single dashboard** 1. In Amazon Quick, open the published dashboard that you no longer want to share. You must be the owner or a co-owner of the dashboard. 1. In the published dashboard, choose the **Share** icon at upper-right, and then choose **Share dashboard**. 1. In the **Share dashboard** page that opens, toggle off the **Anyone on the internet (public)** switch in the **Enable access for** section at bottom-left. This action will remove public access to the dashboard. It will now only be accessible to users that it has been shared with. **To turn off public sharing settings for all dashboards in a Quick user account** 1. From the Amazon Quick start page, choose your user icon at upper right of your browser window, and then choose **Manage Quick**. 1. In the page that opens, scroll down to the **Permissions** section. 1. Choose **Public access to dashboards** at left. 1. On the page that opens, toggle off the **Anyone on the internet** switch. When you disable public sharing settings from the **Public sharing** menu, a pop-up will appear asking you to confirm your choice. Select **I have read and acknowledge this change** and then choose **Confirm** to confirm your choice. This action will remove public access to every dashboard on your account. Dashboards that were visible to anyone on the internet will now only be accessible to users that each dashboard has been shared with. Individual dashboards that have their public settings turned on will have a gray badge and the eye icon that appears on the **Dashboards** page will have a strike through it to indicate that the account level public settings are disabled and that the dashboard can't be viewed. It can take up to two minutes for a dashboard's public access to be revoked. If your session capacity pricing subscription has expired, public sharing settings will be automatically removed across your account. Renew your subscription to restore access to public sharing settings. # Granting everyone in your Amazon Quick account access to a dashboard with the Quick Sight API With everyone in your account with the API | | | --- | |    Intended audience: Amazon Quick developers  | Alternatively, you can grant everyone in your account access to the dashboard with the Quick Sight API using the `UpdateDashboardPermissions` operation. The following example API request illustrates how to do so using an AWS CLI command. It grants link permissions on the dashboard in your account, and allows the following operations: `DescribeDashboard`, `QueryDashboard` and `ListDashboard`. ``` aws quicksight update-dashboard-permissions \ --aws-account-id account-id \ --region aws-directory-region \ --dashboard-id dashboard-id \ --grant-link-permissions Principal="arn:aws:quicksight:aws-directory-region:account-id:namespace/default", Actions="quicksight:DescribeDashboard, quicksight:QueryDashboard, quicksight:ListDashboardVersions" ``` The response for the preceding request looks similar to the following. ``` { "Status": 200, "DashboardArn": "arn:aws:quicksight:AWSDIRECTORYREGION:ACCOUNTID:dashboard/ DASHBOARDID", "DashboardId": "DASHBOARDID", "LinkSharingConfiguration": { "Permissions": [ { "Actions": [ "quicksight:DescribeDashboard", "quicksight:ListDashboardVersions", "quicksight:QueryDashboard" ], "Principal": "arn:aws:quicksight:AWSDIRECTORYREGION:ACCOUNTID:namespace/default" } ] }, "Permissions": [ // other dashboard permissions here ], "RequestId": "REQUESTID" } ``` You can also prevent all users in your account from accessing the dashboard using the same API operation. The following example request illustrates how by using a CLI command. ``` aws quicksight update-dashboard-permissions \ --aws-account-id account-id \ --region aws-directory-region \ --dashboard-id dashboard-id \ --revoke-link-permissions Principal="arn:aws:quicksight:aws-directory-region:account-id:namespace/default", Actions="quicksight:DescribeDashboard, quicksight:QueryDashboard, quicksight:ListDashboardVersions" ``` For more information, see [UpdateDashboardPermissions](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboardPermissions.html) in the *Amazon Quick API Reference*. When all users in a Quick user account are granted access to the dashboard, the following snippet is added to AWS CloudTrail log as part of the `eventName` `UpdateDashboardAccess`, and the `eventCategory` `Management`. ``` "linkPermissionPolicies": [ { "principal": "arn:aws:quicksight:AWSDIRECTORYREGION:ACCOUNTID: namespace/default", "actions": [ "quicksight:DescribeDashboard", "quicksight:ListDashboardVersions", "quicksight:QueryDashboard" ] } ] ``` # Granting anyone on the internet access to an Amazon Quick Sight dashboard using the Quick Sight API With anyone on the internet using the API Alternatively, you can grant anyone on the internet access to the dashboard with the Amazon Quick Sight API using the `UpdateDashboardPermissions` operation. Before you begin, make sure to grant everyone in your account access to the dashboard. For more information, see [Granting everyone in your Amazon Quick account access to a dashboard with the Quick Sight API](share-a-dashboard-grant-access-everyone-api.md). The following example API request illustrates how to grant anyone on the internet access to a dashboard using an AWS CLI command. It grants link permissions on the dashboard in your account, and allows the following operations: `DescribeDashboard`, `QueryDashboard` and `ListDashboardVersions`. ``` aws quicksight update-dashboard-permissions --aws-account-id account-id --region aws-directory-region --dashboard-id dashboard-id --grant-link-permissions Principal="arn:aws:quicksight:::publicAnonymousUser/*", Actions="quicksight:DescribeDashboard, quicksight:QueryDashboard, quicksight:ListDashboardVersions" ``` The response for the preceding request looks similar to the following. ``` { "Status": 200, "DashboardArn": "arn:aws:quicksight:AWSDIRECTORYREGION:ACCOUNTID:dashboard/ DASHBOARDID", "DashboardId": "DASHBOARDID", "LinkSharingConfiguration": { "Permissions": [ { "Actions": [ "quicksight:DescribeDashboard", "quicksight:ListDashboardVersions", "quicksight:QueryDashboard" ], "Principal": "arn:aws:quicksight:AWSDIRECTORYREGION:ACCOUNTID:namespace/default" }, "Principal": "arn:aws:quicksight:::publicAnonymousUser/*", "Actions": [ "quicksight:DescribeDashboard", "quicksight:ListDashboardVersions", "quicksight:QueryDashboard" ] } ] }, "Permissions": [ // other dashboard permissions here ], "RequestId": "REQUESTID" } ``` You can also prevent anyone on the internet from accessing the dashboard using the same API operation. The following example request illustrates how by using a CLI command. ``` aws quicksight update-dashboard-permissions \ --aws-account-id account-id \ --region aws-directory-region \ --dashboard-id dashboard-id \ --revoke-link-permissions Principal="arn:aws:quicksight:::publicAnonymousUser/*", Actions="quicksight:DescribeDashboard, quicksight:QueryDashboard, quicksight:ListDashboardVersions" ``` For more information, see [UpdateDashboardPermissions](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboardPermissions.html) in the *Amazon Quick API Reference*. When anyone on the internet is granted access to the dashboard, the following snippet is added to AWS CloudTrail log as part of the `eventName` `UpdateDashboardAccess`, and the `eventCategory` `Management`. ``` "linkPermissionPolicies": [ { "principal": "arn:aws:quicksight:::publicAnonymousUser/*", "actions": [ "quicksight:DescribeDashboard", "quicksight:ListDashboardVersions", "quicksight:QueryDashboard" ] } ] ``` # Sharing a link a shared dashboard After you grant users access to a dashboard, you can copy a link to it and send it to them. Anyone with access to the dashboard can access the link and see the dashboard. **To send users a link to the dashboard** 1. Open the published dashboard and choose **Share** at upper right. Then choose **Share dashboard**. 1. In the **Share dashboard** page that opens, choose **Copy link** at upper left. The link to the dashboard is copied to your clipboard. It's similar to the following, `https://quicksight.aws.amazon.com/sn/accounts/accountid/dashboards/dashboardid?directory_alias=account_directory_alias` Users and groups (or all users on your Quick account) who have access to this dashboard can access it by using the link. If they are accessing Quick for the first time, they will be asked to sign in with their email address or Quick user name and password for the account. After they sign in, they will have access to the dashboard. # View who has access to a shared dashboard View who has access Use the following procedure to see which users or groups have access to the dashboard. 1. Open the published dashboard and choose **Share** at upper right. Then choose **Share dashboard**. 1. In the **Share dashboard** page that opens, under **Manage permissions**, review the users and groups, and their roles and settings. You can search to locate a specific user or group by entering their name or any part of their name in the search box at upper right. Searching is case-sensitive, and wildcards aren't supported. Delete the search term to return the view to all users. # Revoke access to a shared dashboard Revoke access Use the following procedure to revoke user access to a dashboard. **To revoke user access to a dashboard** 1. Open the dashboard and choose **Share** at top right. Then choose **Share dashboard**. 1. In the **Share dashboard** page that opens, under **Manage permissions**, locate the user that you want to remove and choose the delete icon at far right. # Using Quick action connectors in dashboard visuals Use action connectors in dashboards ## Prerequisites Before you begin, make sure to [create at least one action connector](builtin-services-integration.md). The connector must meet these requirements: + Uses the **User Auth** authentication method + Uses one of the following integrations: + Atlassian Jira Cloud + Microsoft Outlook + Microsoft Teams + Salesforce + ServiceNow + Slack ## Enable Quick actions on a dashboard to use action connectors **To enable Quick actions on a dashboard to use action connectors** 1. If a dashboard exists, go to the source analysis of the dashboard. Otherwise, [create a new analysis](quickstart-createanalysis.md). 1. Choose **Publish**. 1. Choose between **New Dashboard** or **Replace existing dashboard**. 1. Choose the **Enable Quick actions** checkbox under **Dashboard options**. 1. Choose **Publish dashboard**. ## Use action connectors on a visual **To use action connectors on a visual** 1. Open a dashboard with the **Enable Quick actions** publishing option turned on. 1. Hover over a visual. 1. Choose the lightening bolt icon. 1. A menu appears with a list of all supported action connectors and actions. 1. Choose the desired action from the list. 1. If you have not used the connector before, or if your previous login credentials have expired, an authentication modal will appear. Log in with appropriate credentials for your organization. 1. An **Action** form appears in the right pane. 1. Enter all the information you need to include with the action. 1. Some fields allow the inclusion of autofill values. Choose **Autofill** to open the menu. Choose the values you need and they will be added to your entered text. + **Today’s date**: Injects today’s date + **Visual name**: Injects visual name + **All**: Injects both of the above 1. Some actions support the ability to include an attachment. You can optionally attach an image of the visual with these actions by selecting the **Visual image** checkbox. 1. Select the action button at the bottom of the form to invoke the action. ## Security and customizations **Custom Permissions/Capability Customization** + **Actions** capability: You cannot see or use actions if your user or role is restricted the permission to use the Actions capability To learn more about custom permissions, see [Creating a custom permissions profile in Amazon Quick](create-custom-permissions-profile.md). **Row Level Security (RLS) / Column Level Security (CLS)** + You cannot see or use actions on visuals that are based on datasets that use RLS or CLS. To learn more about RLS, see [Using row-level security in Amazon Quick](row-level-security.md). To learn more about CLS, see [Using column-level security to restrict access to a dataset](row-level-security.md). **Dashboard publishing options** + Enable Quick actions + You cannot see or use actions on any visuals of a dashboard that was published with the **Enable Quick actions** publishing option disabled. To learn more about dashboard publishing options, see [Publishing dashboards](creating-a-dashboard.md). ## Limitations **Visual Image attachment support** The following visual types do not support image attachments: + High charts (when HTML is used) + ML Insights (when HTML is used) + Textbox and insights (when HTML is used) + Custom content **Note** For these visuals, the **Visual image** checkbox will not appear on the UI. # Sharing your view of a Amazon Quick Sight dashboard Share your view of a dashboard While interacting with a published dashboard, you can choose to share a unique link to the dashboard with only your changes. For example, if you filter the data in the dashboard, you can share what you see with others who have permissions to see the dashboard. That way, they can see what you see, without your having to create a new dashboard. When others access your view of the dashboard by using the link that you sent them, they see the dashboard exactly as it was when the link was created. They see any parameters, filters, or controls that you changed. **To share your view of a dashboard** 1. Open the published dashboard, and make any changes that you want. 1. Choose **Share** at upper right, and then choose **Share this view**. 1. On the **Share using a link** page that opens, choose **Copy link**. 1. Paste the link in an email or IM message to share it with others. Only people with permissions to see the dashboard in Quick Sight can access the link. # Scheduling and sending Quick Sight reports by email Sending reports **Important** Amazon Quick Sight in the Europe (Spain) (eu-south-2) region uses an internal email service (Amazon SES) in the Europe (Ireland) (eu-west-1) to send emails to Quick Sight users. Customer data that's included in scheduled reports, alerts, and other features are passed by email from Europe (Spain) to Europe (Ireland) before it reaches Quick Sight users. As a privacy protection measure, the following features that send customer data in emails have been limited or disabled by default. File attachments and sheet previews in Scheduled Report emails. The [download link option](https://docs.aws.amazon.com/quicksuite/latest/userguide/email-reports-from-dashboard) is the default. Emails that use threshold alerts. Anomaly detection alerts. For more information about AWS privacy features, see [Privacy Features of AWS Services](https://aws.amazon.com/compliance/privacy-features/). In Enterprise edition, you can send a dashboard in report form either once or on a schedule (daily, weekly, monthly, or yearly). You can email the reports to users or groups who share your Amazon Quick subscription. To receive email reports, the users or group members must meet the following conditions: + They are part of your Quick subscription. + You already shared the dashboard with them. + Amazon Quick Sight can't send scheduled emails to more than 5,000 members. Amazon Quick Sight generates a custom email snapshot for each user or group based on their data permissions, which are defined in the dashboard. Row Level Security (RLS), Column Level Security (CLS) and Dynamic Default Parameters for email reports works for both scheduled and ad hoc (one-time) emails. Quick authors can run scheduled reports with the **Report now** button in the Quick console or with the [https://docs.aws.amazon.com//quicksight/latest/APIReference/API_StartDashboardSnapshotJobSchedule.html](https://docs.aws.amazon.com//quicksight/latest/APIReference/API_StartDashboardSnapshotJobSchedule.html) API. Subscribers who are readers see an option for **Reports** on the dashboard when an email report is available for that dashboard. They can use the **Schedules** menu to subscribe to or unsubscribe from the emails. For more information, see [Subscribing to email reports in Amazon Quick Sight](subscribing-to-reports.md). You can create up to five schedules for each dashboard. Quick Sight dashboard viewers can also schedule their own reports for themselves from a Quick Sight dashboard. For more information about reader generated reports, see [Creating a reader generated report in Amazon Quick Sight](reader-scheduling.md). Use the following topics to learn more about email report settings and report billing. **Topics** + [ # Configuring email report settings for a Quick Sight dashboard ](email-reports-from-dashboard.md) + [ # How billing works for email reports ](sending-reports-billing-info.md) # Configuring email report settings for a Quick Sight dashboard Configuring email reports | | | --- | |  Applies to: Enterprise Edition  | In Amazon Quick Enterprise edition, you can email a report from any sheet in a dashboard. You can send reports from interactive dashboards and pixel perfect report sheets. Schedules include settings for when to send them, the contents to include, and who receives the email. You can view a sample report and a list of the datasets used in the report. To set up or change the schedule sent from a dashboard, make sure that you're an owner or co-owner of the dashboard. If you have access to the dashboard, you can change your subscription options by opening your view of the dashboard. For more information on how this works, see [Subscribing to email reports in Amazon Quick Sight](subscribing-to-reports.md). Scheduling options that are available for an email report include the following: + **Once (Does not repeat)** – Sends the report only once at the date and time that you choose. + **Daily** – Repeats daily at the time that you choose. + **Weekly** – Repeats each week on the same day or days at the time that you choose. You can also use this option to send reports in weekly intervals, such as every other week or every three weeks. + **Monthly** – Repeats each month on the same day of the month at the time that you choose. You can also use this option to send reports on specific days of the month, such as the second Wednesday or the last Friday of each month. + **Yearly** – Repeats each year on the same day of the month or months selected at the time that you choose. You can also use this option to send reports on specific days or sets of days in selected months. For example, you can configure a report to be sent on the first Monday of January, March, and September, or on July 14th, or on the second day of February, April, and June each year. + **Custom** – Configure your own scheduled report that best fits your business needs. You can customize the title of the report, the optional email subject, and the body text. Although you can configure the report so that everyone who has access receives a copy, this is not usually the best plan. We recommend limiting automated emails, especially those sent to groups. You can start with a small number of subscribers by choosing specific people from the access list. Verify your company's policy before subscribing anyone to a subscription. You can directly add people to a report subscription in these ways: + (Recommended) Choose recipients from the provided access list to specify and maintain a list of people who you want to email reports to. You can use the search box to find people by email or group name. + To send reports to all of the dashboard's subscribers, choose **Send email report to all users with access to dashboard** when prompted. Anyone else who wants to get the emails can open the dashboard and set their own subscription options to either opt in or opt out. **Important** When you share the dashboard with new Quick user names or groups, they automatically start receiving the email reports. If you don't want this to happen, you need to edit the report settings each time you add people to the dashboard. For existing email schedules, you can pause the schedule in Amazon Quick Sight while you make changes. In the **Schedules** pane, you can pause or resume a scheduled report with the toggle that appears under each report. Pausing a report does not delete the report's schedule from Quick Sight. If your report includes custom visuals, be aware that you can't include images from a private network in an email report, even if you can access the images. If you want to include an image, use a publicly available one. Before you begin, make sure that you are using Amazon Quick Enterprise edition and that you have shared the dashboard with intended recipients. **To create or change an email report** 1. Open Quick and choose **Dashboards** on the navigation pane at left. 1. Open a dashboard to configure its email report. 1. At top right, choose **Schedules**, and then choose **Schedules**. 1. Choose **ADD SCHEDULE**. 1. In the **New schedule** pane that appears, enter the schedule name. Optionally, add a description for the new schedule. 1. In the **Content** tab, toggle the **PDF**, **CSV**, or **Excel** switches to choose the report format. CSV and Excel format are currently supported for pixel perfect reports. 1. In the **Sheet** dropdown on the **Content** tab, choose the sheet that you want to schedule a report for. If you choose **CSV** or **Excel**, choose the table or pivot table visuals from any sheet of the dashboard that you want to include in the report. You can select up to 5 visuals for each schedule. If you choose **Excel**, one Excel workbook is generated as a final output. 1. In the **Dates** tab, choose the frequency for the report in the **Repeat** dropdown. If you're not sure, choose **Send once (Does not repeat)**. 1. For **Start date**, choose the start date and runtime that you want to send the first report on. 1. For **Timezone**, choose the time zone from the dropdown. 1. In the **Email** tab, for ** E-mail subject line**, enter a custom subject line, or leave it blank to use the report title. 1. Enter the email addresses of the Quick group name of the users or groups that you want to receive the report. You can also select the **Send to all users with access** box to send the report to everyone that has access to the dashboard in your account. 1. For **Email header**, enter the header that you want the emal report to show. 1. (Optional) For **E-mail body text**, leave it blank or enter a custom message to display at the beginning of the email. 1. (Optional) For PDF attachments, you can choose **Include sheet in email body** to show the first page of the PDF snapshot in the email's body. 1. Choose the method of attachment that you want the report to use. The following options are available. + **File attachment**– uploads an attachment of the snapshot to the email. The email size can't exceed 10 MB. This limit includes all attachments. + **Download link**– adds a link to the email body that users can access to download the snapshot report. When a user chooses the download link, they are prompted to sign in before the report starts to download. The link expires one year after the report is sent. 1. (Optional, recommended) To send a sample of the report before you save changes, choose **Send test report**. This option displays beside the user name of the owner of the dashboard. 1. Do one of the following: + (Recommended) Choose **Save** to confirm your entries. + To immediately send a report, choose **Save and run now**. The report is sent immediately, even if your schedule's start date is in the future. # How billing works for email reports Report billing Authors and admins can receive any number of email reports at no extra charge. For readers (users in the reader role), it costs one session per report, up to the monthly maximum. After receiving an email report, the reader gets a session credit to access the dashboard at no additional cost during the same month. Reader session credits don't carry over to the next billing month. For a reader, charges for email reports and interactive sessions both accrue up to the monthly maximum charge. For readers who hit the monthly max charge, there are no further charges, and they can receive as many additional email reports as they need. # Subscribing to email reports in Amazon Quick Sight Subscribing to reports In Enterprise edition, Amazon Quick authors can set up subscriptions to a dashboard in report form. For more information, see [Scheduling and sending Quick Sight reports by email](sending-reports.md). Quick readers and authors can then subscribe to a dashboard and adjust their report settings. For more information about subscribing to dashboards as a reader, see [Subscribing to Amazon Quick Sight dashboard emails and alerts](subscriber-alerts.md). Use the following procedure to change your subscription and report settings for a specific dashboard. 1. First, open a dashboard that is shared with you, or a dashboard that you own or co-own. 1. Choose the **Reports** icon at top right. 1. The **Change report preferences** screen appears. This screen shows the current report schedule, in addition to the subscription and optimization options. For **Subscription**, choose **Subscribe** to start receiving reports, or **Unsubscribe** to stop receiving reports. Under **Optimize**, choose the device you prefer to view the report on. + If you usually use a mobile device or you prefer to view reports in a portrait format, choose **Viewing on a mobile device**. When you receive the report, the visuals display in a single vertical column. + If you usually use a desktop or you prefer to view reports in a landscape format, choose **Viewing on a desktop**. When you receive the report, the visuals display in the same layout shown in your dashboard on your desktop. 1. Choose **Update** to confirm your choices, or choose **Cancel** to discard your changes. # Working with threshold alerts in Amazon Quick Sight Threshold alerts | | | --- | |  Applies to: Enterprise Edition  | To stay informed about important changes in your data, you can create threshold alerts using KPI, Gauge, Table, and Pivot table visuals in an Amazon Quick Sight dashboard. With these alerts, you can set thresholds for your data and be notified by email when your data crosses them. You can also view and manage your alerts at anytime in a Quick Sight supported web browser. For example, let's say that you're a customer success manager for a large organization and you want to know when the number of tickets in a support queue exceeds a certain number. Let's say too that you have a dashboard with a KPI, Gauge, Table or Pivot table visual that tracks the number of tickets in this queue. In this case, you can create an alert and be notified by email when the number exceeds the threshold you specified. That way, you can take action as soon as you're notified. You can create multiple alerts for a single visual. If the visual is updated or deleted by the author after you create an alert, your alert settings don't change. When you create an alert, the alert takes on any filters applied to the visual at that time. If you or the author changes the filter, your existing alert doesn't change. However, if you create a new alert, your new alert takes on the new filter settings. For example, let's say you have a dashboard with a filter control that you can use to switch the data for each visual in the dashboard from one US city to another. You have a KPI visual on the dashboard that shows average flight delays, and you're interested in delays for flights leaving from Seattle, Washington, in the US. You change the filter control to Seattle and set an alert on the visual. This alert tracks flight delays from Seattle. Tomorrow, let's say that you want to also track flight delays from Portland, Oregon, so you change the filter control to Portland and create another alert. This new alert tracks flight delays from Portland. You now have two alerts, one on Seattle and one on Portland, working independently. Threshold alerts are not available in the `eu-central-2` Europe (Zurich) region. For more information on KPI, Gauge, Table, or Pivot table visuals, see [Visual types in Amazon Quick Sight](working-with-visual-types.md). **Note** You can't create alerts for visuals in an embedded dashboard or from the Quick mobile app. For table visuals, threshold alerts can't be created for values that are located in the `Group by` field well. Alerts can only be created for values that are located in the `Value` field well. KPI visuals that don't use a date-time field as a trend don't support alerts. An example is a KPI that shows the difference in flights between carriers X and Y instead of a KPI that shows the difference in flights between dates A and B. Use the sections below to create and configure threshold alerts for KPI, Gauge, Table, and Pivot table visuals in Quick Sight. **Topics** + [ # Alert Permissions ](threshold-alerts-permissions.md) + [ # Creating Alerts ](threshold-alerts-creating.md) + [ # Managing Threshold Alerts ](threshold-alerts-managing.md) + [ # Investigating Alert Failures ](threshold-alerts-failures.md) + [ # Alert Scheduling ](threshold-alerts-scheduling.md) + [ # Using Quick action connectors in threshold alerts ](action-connectors-in-threshold-alerts.md) # Alert Permissions If you're an administrator, you can control who in your organization can set threshold alerts in Quick Sight by creating a custom permissions policy. To set custom permissions in Quick, choose your user name at the upper-right corner of any Quick page, choose **Manage Quick**, and then choose **Custom permissions**. # Creating Alerts Use the following procedure to create threshold alerts for KPI or Gauge visuals in a dashboard. **To create an alert** 1. Open Quick and navigate to the dashboard that you want. For more information about viewing dashboards as a dashboard subscriber in Quick, see [Interacting with Amazon Quick Sight dashboards](exploring-dashboards.md). 1. In the dashboard, select the visual that you want to create an alert for, open the menu at the upper-right, and choose **Create alert**. 1. On the menu at upper-right on the visual, choose the **Create alert** icon. Alternatively, you can choose the alert icon in the blue toolbar at upper right. Then, in the **Create alert** page that opens, select the KPI, Gauge, Table or Pivot table visual that you want to create an alert for, and then choose **Next**. You can also create alerts on table or pivot table visuals by selecing a cell and choosing **Create alert**. You can only create alerts for single cells. Alerts can't be created for entire columns or for values that use a custom aggregation. For more information about custom aggregations, see [Aggregate functions](calculated-field-aggregations.md). 1. On the **Create alert** page that opens at right, do the following: 1. For **Name**, enter a name for the alert. By default, the visual name is used for the alert name. You can change it if you want. 1. For **Value to track**, choose a value that you want to set the threshold for. The information presented will vary based on the visual type you're creating an alert for. The values that are available for this option are based on the values the dashboard author sets in the visual. For example, let's say you have a KPI visual that shows a percent difference between two dates. Given that, you see two alert value options: percent difference and actual. If there is only one value in the visual, you can't change this option. It is the current value and it is displayed here so that you can use it as a reference while you choose a threshold. For example, if you're setting an alert on average cost, this value will show you what the current average cost is (say, \$15). With this reference value you can make more informed decisions while setting your threshold. 1. For **Condition**, choose a condition for the threshold. You can choose the following conditions. + **Is above** – Sets a rule that the alert triggers if the alert value goes above the threshold you set. + **Is below** – Sets a rule that the alert triggers if the alert value goes below the threshold that you set. + **Is equal to** – Sets a rule that the alert triggers if the alert value is equal to the threshold you set. 1. For **Threshold**, enter a value to prompt the alert. 1. For **Notification preference**, choose how often you want to be notified about a breach to the threshold you set. You can choose from the following options. + **As frequently as possible** - This option alerts you whenever the threshold is breached. If you choose this option, you might get alerts multiple times a day. + **Daily at most** - This option alerts you once per day when the threshold is breached. + **Weekly at most** - This option alerts you once per week when the threshold is breached. 1. (Optional) Choose **Email me when there is no data** - When you select this option, you're notified when there's no data to check your alert rule against. 1. Choose **Save**. A message at upper-right appears indicating that the alert has been saved. If your data crosses the threshold you set, you get a notification by email at the address that's associated with your Quick account. # Managing Threshold Alerts You can edit your existing alerts, turn them on or off, or view the history of times when the alert was triggered. Use the following procedures to do so. **To edit an existing alert** 1. Open Quick, choose **Dashboards**, and then navigate to the dashboard that you want to edit an alert for. 1. On the Dashboards page, choose **Alerts** at upper-right. 1. On the **Manage alerts** page that opens, find the alert that you want to edit, and then choose **Edit **beneath the alert name. You can edit the alert name, condition, and threshold. 1. Choose **Save**. **To view the history of when an alert was triggered** 1. Open Quick, choose **Dashboards**, and then navigate to the dashboard that you want to view alert history for. 1. On the Dashboards page, choose **Alerts** at upper-right. 1. On the **Manage alerts** page that opens, find the alert that you want to view the history for, and then choose **History** beneath the alert name. **To turn on or turn off an existing alert** 1. Open Quick, choose **Dashboards**, and navigate to the dashboard that you want to turn on or turn off an alert for. 1. On the Dashboards page, choose **Alerts** at upper-right. 1. On the **Manage alerts** page that opens, find the alert that you want to turn on or off, and then select or clear the toggle by the alert name. The alert is turned on when the toggle is blue, and turned off when the toggle is gray. **To delete an existing alert** 1. Open Quick, choose **Dashboards**, and navigate to the dashboard that you want to delete an alert from. 1. On the Dashboards page, choose **Alerts** at upper-right. 1. On the **Manage alerts** page that opens, find the alert that you want to turn on or off, choose the three-dot menu next to the alert, and then choose **Delete** from the dropdown. # Investigating Alert Failures When an alert fails, Quick sends you an email notification about the failure. Alerts can fail for many reasons, including the following: + The dataset the alert is using was deleted. + The owner of the alert lost permissions to the dataset or to certain rows or columns in the dataset. + The owner of the alert lost access to the dashboard. + There is no data for the data tracked by the alert. When a failure occurs, Quick sends you a notification and disables the alert if the reason for the failure isn't likely to be fixed. For example, if the alert fails due to the loss of access to a dashboard, or if the dashboard was deleted. Otherwise, Quick attempts to check your data for threshold breaches again. After four failures, Quick turns off the alert and notifies you that the alert is turned off. If the alert can be checked again, Quick sends you a notification. To investigate why an alert failed, check that you still have access to the dashboard. Also check that you have permissions to the correct dataset and to the correct rows and columns in the dataset. If you have lost access or permissions, contact the dashboard owner. If you have the necessary access and permissions, you might need to edit your alert to avoid future alert failures. # Alert Scheduling When you create an alert, Quick checks your data for any breaches against the thresholds you set based on when your dataset is scheduled to refresh. The information presented in the alert varies based on the visual type that you're creating an alert for. For SPICE datasets, alert rules are checked after a successful refresh of your SPICE dataset. For direct query datasets, alert rules are checked at a random time between 6:00 PM and 8:00 AM in the AWS Region that holds the dataset by default. If you're a dataset owner, you can set an alert evaluation schedule in the dataset settings. See the following procedure to learn how. **To set an alert evaluation schedule for a dataset** 1. In Quick, choose **Data** in the navigation bar at left. 1. Choose the dataset that you want to schedule alert evaluations for. 1. Choose **Set alert schedule**. 1. In the **Set alert schedule** page that opens, do the following. + For **Time zone**, choose a time zone. + For **Repeats**, choose how often you want the data to be evaluated. + For **Starts**, enter the time that you want the alert evaluation to start. # Using Quick action connectors in threshold alerts Use action connectors in threshold alerts ## Prerequisites Before you begin, make sure to [create at least one action connector](builtin-services-integration.md). The connector must meet these requirements: + Uses the **Service Auth** authentication method + Uses one of the following integrations: + Atlassian Jira Cloud + Microsoft Outlook + Salesforce + ServiceNow ## Enable Quick actions on a dashboard to use action connectors **To enable Quick actions on a dashboard to use action connectors** 1. If a dashboard exists, go to the source analysis of the dashboard. Otherwise, [create a new analysis](quickstart-createanalysis.md). 1. Choose **Publish**. 1. Choose between **New Dashboard** or **Replace existing dashboard**. 1. Choose the **Enable Quick actions** checkbox under **Dashboard options**. 1. Choose **Publish dashboard**. ## Use action connectors in a threshold alert **To use action connectors in a threshold alert** 1. Open a dashboard with the **Enable Quick actions** publishing option turned on. 1. Hover over a visual that supports threshold alerts. The types of visuals that support alerts can be found [here](threshold-alerts.md). 1. Choose the bell icon. 1. The **Create alert** pane opens at right. 1. Choose **Add Action**. 1. A menu appears with a list of all supported action connectors and actions. 1. Choose the desired action from the list. 1. An **Action** form appears in the right pane. 1. Enter all the information you need to include with the action. 1. Some fields allow the inclusion of autofill values. Choose **Autofill** to open the menu. Choose the values you need and they will be added to your entered text. + **Value**: Injects the current value that was used by the alert to evaluate the alert condition + **Alert name**: Injects the alert name + **Condition**: Injects the alert condition + **Threshold**: Injects the threshold value + **All**: Injects all of the above 1. Some actions support the ability to include an attachment. You can optionally attach a PDF of the current dashboard sheet with these actions by selecting the **Include this sheet as PDF** checkbox. 1. Choose **Add action** to add the action to the alert. 1. Back at the **Create alert** pane, the configured action is added to the alert at the bottom. 1. Configure all the other desired fields of the alert and choose **Save**. 1. When your configured threshold is breached, this action should get invoked. To learn more about when a threshold alert is evaluated, see [Alert Scheduling](threshold-alerts-scheduling.md). ## Security and customizations **Custom Permissions/Capability Customization** + **Actions** capability: You cannot see or use actions if your user or role is restricted the permission to use the Actions capability + **Export To PDF** capability: + New actions on alerts: You will not see the option to attach a PDF of the sheet while adding a new action to an alert if your user or role is restricted the permission to use the **Export To PDF** capability. + Existing actions on alerts: If you have existing alerts with actions containing PDF attachments then those actions will be sent out without the PDF attachments when your user or role gets restricted from using the **Export To PDF** capability. To learn more about custom permissions, see [Creating a custom permissions profile in Amazon Quick](create-custom-permissions-profile.md). **Row Level Security (RLS) / Column Level Security (CLS)** + New actions on alerts: If your dashboard contains a dataset with RLS or CLS, then + You cannot add actions to new alerts that track the dataset with RLS or CLS + You can add actions to new alerts that track a different dataset without RLS or CLS, but you cannot include PDF attachments in these actions + Existing actions on alerts: If you add RLS or CLS to a dataset after creating alerts with actions, then + Existing actions on alerts tracking that dataset will stop working completely + Existing actions on alerts tracking a different dataset on the same dashboard will be sent out without any PDF attachments To learn more about RLS, see [Using row-level security in Amazon Quick](row-level-security.md). To learn more about CLS, see [Using column-level security to restrict access to a dataset](row-level-security.md). **Dashboard publishing options** + Enable PDF generation for interactive sheets + New actions on alerts: You will not see the option to attach a PDF of the sheet while adding a new action on alert if your dashboard has the **Enable PDF generation for interactive sheets** publishing option disabled. + Existing actions on alerts: If you have existing alerts with actions containing PDF attachments, then those actions will be sent out without the PDF attachments when the **Enable PDF generation for interactive sheets** publishing option gets disabled on your dashboard. + Enable Quick actions + New actions on alerts: You will not see the option to add an action to the alert if your dashboard has the **Enable Quick actions** publishing option turned off. + Existing actions on alerts: Your existing actions on alerts will stop working completely when the **Enable Quick actions** publishing option gets disabled on your dashboard. To learn more about dashboard publishing options, see [Publishing dashboards](creating-a-dashboard.md). # Printing a dashboard or analysis Print a dashboard or analysis You can print a dashboard or an analysis in Amazon Quick Sight. Use the following procedure to print. 1. Open the dashboard or the analysis that you want to print. 1. Choose the **Print** icon at top right. 1. On the **Prepare for printing** screen, choose the paper size and orientation that you want to use. 1. Choose **Go to Preview**. 1. Do one of the following: + To proceed to printing, choose **Print** to open your operating system's print dialog. + To make changes to the paper size or orientation, choose **Configure**. 1. To exit the preview screen, choose **Exit preview**. # Exporting Amazon Quick Sight analyses or dashboards as PDFs Exporting as PDFs You can export content from a dashboard into a Portable Document Format file (PDF). Similar to a print-out, this format provides a snapshot of the current sheet as it appears on-screen at the time of download. **To export a dashboard sheet as a PDF** 1. Open Quick and choose **Dashboards** on the navigation pane at left. 1. Open the dashboard that you want to export. 1. At upper right, choose **Export**, **Download as PDF**. The download is prepared in the background. When the file is ready to download, a message appears saying **Your PDF is ready.**. 1. Choose **Download now** to download the file. Choose **Close** to close without downloading. If you close this dialog box without downloading the file and want to recreate the file, repeat the previous step. Also, the downloadable file is available only temporarily for five minutes. If you wait too long to download it, the file expires. If this happens, Quick Sight instead displays an error message saying that the request has expired. 1. Repeat the previous steps for each sheet that you want to export. You can also attach PDFs to dashboard email reports. For more information, see [Scheduling and sending Quick Sight reports by email](sending-reports.md). # Error codes for failed PDF export jobs PDF Error codes When you generate PDF reports in Amazon Quick Sight, you may encounter instances where your request to generate a PDF report fails. There are many reasons why a failure might occur. Quick Sight provides error codes that can help you understand why the error occurred and provide guidance to troubleshoot the issue. The following table lists the error codes that Quick Sight returns when a PDF export job fails. | Error code | Guidance | | --- | --- | | INVALID\$1DATAPREP\$1SYNTAX | Check the syntax for your calculated fields, and try again. | | POST\$1AGGREGATED\$1METRIC\$1AS\$1DIMENSION | Aggregated metrics/operands can't be used as visual's grouping dimensions. Choose a valid visual's grouping dimensions, and try again. | | SPICE\$1TABLE\$1NOT\$1FOUND | The dataset has been deleted or is unavailable. Import a valid dataset, and try again. | | FIELD\$1NOT\$1FOUND | A field is no longer available. Update or replace the missing fields in this dataset, and try again. | | FIELD\$1ACCESS\$1DENIED | You don't have access to some fields in this dataset. Request access, and try again. | | PERMISSIONS\$1DATASET\$1INVALID\$1COLUMN\$1VALUE | An invalid row level permission column value was found. Check your parent dataset rules, and try again. | | COLUMN\$1NOT\$1FOUND | Replace the missing columns in your filters or parameters, and try again. | | INVALID\$1COLUMN\$1TYPE | Some fields' data types have been changed and can not be automatically updated. Adjust these fields in your dataset, and try again. | | PERMISSIONS\$1DATASET\$1USER\$1DENIED | You don't have access to this dataset. Request access to this dataset, and try again. | | DATA\$1SOURCE\$1TIMEOUT | Your query has timed out. Reduce the amount of data, or import the data into SPICE, and try again. | | MAX\$1PAGE\$1EXCEEDED\$1ERROR | Your file is ready but content is not complete. PDFs have a 1,000 page limit. Choose a shorter PDF, and try again. | | INSUFFICIENT\$1BODY\$1HEIGHT\$1ERROR | Adjust the header and footer to be less than the page height, and try again. | | FIRST\$1PAGE\$1HEIGHT\$1TOO\$1SMALL\$1ERROR | Adjust sections to make room for your tables, and try again. | | INTERNAL\$1ERROR | We can't create your PDF right now. Wait a few minutes, and try again. | # Organizing assets into folders for Amazon Quick Sight Organizing assets into folders | | | --- | |  Applies to: Enterprise Edition  | In Quick Enterprise edition, your team members can create personal and shared folders to add hierarchical structure to Quick Sight asset management. Using folders, people can more easily organize, navigate through, and discover dashboards, analyses, datasets, data sources, and topics. Within a folder, you can still use your usual tools to search for assets or to add assets to your favorites list. You can use the following types of folders with Quick Sight: + Personal folders to organize work for yourself. Personal folders are visible only to the person who owns them. You can't transfer ownership of personal folders to anyone else. + Shared folders: + **Shared folders** organize work and simplify sharing among multiple people. To create and manage shared folders, you need to be a Quick Sight administrator. + **Shared restricted folders** are a type of shared folder in Quick Sight that ensure that assets remain in the shared folder. Assets that are created from assets that exist within a shared restricted folder must also stay in the restricted folder. Assets that are located in restricted folders can't be moved or shared outside of the restricted folder. For example, if you create a dataset that uses a data source that's located in a shared restricted folder, the new dataset can't be moved outside of that shared restricted folder. Assets that are located in a restricted folder can be moved within the restricted folder tree into one or more subfolders. Subfolders of restricted folders behave like restricted folders, but dependent assets can exist in different subfolders under the same root restricted folder. The root restricted folder acts as a boundary that all assets in all subfolders can exist in as long as they remain within the root folder tree. For example, a dataset that is located in one subfolder can use a data source that is located either another subfolder in the same folder tree or in the root folder. Any supported asset type can be created in a root folder or in any of its subfolders. Users can have different roles in different subfolders. Subfolder permissions are inherited from the parent folders of that subfolder. Restricted folders can only be created with the Quick Sight [https://aws.amazon.com/quicksight/latest/APIReference/API_CreateFolder.html](https://aws.amazon.com/quicksight/latest/APIReference/API_CreateFolder.html) API operation. + Users that are viewers on a folder and have the Author or Admin role in Quick can view all asset types that are in the folder. Users that are viewers on a folder and have the Reader role in Quick can only see dashboards and stories that are in the folder. All shared folders are visible to people who have access to them. Use the following topics to learn more about creating and configuring a folder or subfolder in Quick Sight. **Topics** + [ # Considerations for Quick Sight folders ](folders-limitations.md) + [ # Overview of Quick Sight folders ](folders-functionality.md) + [ # Permissions for Quick Sight shared folders ](folders-security.md) + [ # Create and manage membership permissions for Quick Sight shared folders ](sharing-folders.md) + [ # Creating Quick Sight scaled folders with the Quick Sight APIs ](folders-scaled.md) # Considerations for Quick Sight folders Considerations Before you get started creating and modifying folders in Amazon Quick Sight, review the following limitations that apply to Quick Sight folders. + You can't share folders in your AWS account with people in other AWS accounts. + For people who have Quick reader permissions, the following limitations apply: + Readers can't own a personal or shared folder. + Readers can't create or manage folders or folder content. + Readers can't have the *contributor* access level. + In shared folders, readers can only see dashboard assets. In addition, these limitations apply specifically to shared folders: + The name of a shared folder (at the top level of the tree) must be unique in your AWS account. + In a single folder, multiple assets can't have the same name. For example, in your top-level folder, you can't create two subfolders with the same name. In the same folder, you can't add two assets with the same name, even if they have different asset IDs. The path to each asset behaves like an Amazon S3 key name. It must be unique in your AWS account. + Restricted shared folders can only be created with the Quick Sight CLI. See [Overview of Quick Sight folders](folders-functionality.md) to learn more about the different types of folder available in Amazon Quick Sight. # Overview of Quick Sight folders In Quick Sight, you can create personal and shared folders. You can also favorite your personal or shared folders for quick access by choosing the favorite ( ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/favorite-icon.png)) icon next to it. You can do the following with personal folders: + Create subfolders. + Add assets to your folder, including analyses, dashboards, datasets, and data sources. To add assets to a personal folder, you must already have access to the assets. Multiple assets can have the same name. **Shared folders (unrestricted)** Quick administrators can perform the following tasks with shared folders. + Create or delete a shared folder and subfolders inside of it. You can move either of these around within the top-level folder. + Add or remove owners, contributors, and viewers. When you make a person an *owner* of the folder, you give them ownership of every asset in the folder. For more information, see [Permissions for Quick Sight shared folders](folders-security.md). The following table summarizes the actions that a Quick user can take when working with unrestricted shared folders based on their role. **** | Action | Owner | Contributor | Viewer | | --- | --- | --- | --- | | Share an asset in a folder with users that don't have access to the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Modify folder permissions | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Create assets in the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Modify assets in the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Delete assets in the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Add an existing asset to a folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Remove an asset from a shared folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | View assets in the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | | Create downstream assets outside of the shared folder that use assets that are located in the shared folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes\$1 | | Create downstream assets in the folder that use assets that are located outside of the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Create subfolders | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Delete subfolders | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Manage subfolder permissons | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Add existing assets to subfolders | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Create new assets in subfolders | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Delete assets in subfolders | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | \$1The user must be assigned an admin or author role to create assets. **Restricted shared folders** Restricted shared folders provide an additional security boundary that restricts the sharing of data outside of the folder. Administrators with the appropriate IAM permissions can perform the following tasks with restricted shared folders. + Restricted folders can be created using the `CreateFolder` API operation. For more information about the `CreatFolder` API operation, see [CreateFolder](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateFolder.html). + The contributor role is assigned to users that can create and edit assets within the restricted folders. Contributors can't manage the permissions of the folder or of the assets that are in the restricted folder. + Administrators can assign folder contributor and viewer permissions to users with the `UpdateFolderPermissions` API operation. For more information about the `UpdateFolderPermissions` API operation, see [UpdateFolderPermissions](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateFolderPermissions.html). The following table summarizes the actions that a Quick Sight user can take when working with restricted shared folders based on their role. **** | Action | Contributor | Viewer | | --- | --- | --- | | Share an asset in a folder with users that don't have access to the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Modify folder permissions | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Create assets in the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Modify assets in the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Delete assets from the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Add an existing asset to a folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Remove an asset from a shared folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | View assets in the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | | Create downstream assets outside of the shared folder that use assets that are located in the shared folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Create downstream assets in the folder that use assets that are located outside of the folder | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Create subfolders | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Delete subfolders | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Manage subfolder permissions | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Add existing assets to subfolders | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Create new assets in subfolders | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | | Delete assets from subfolders | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/success_icon.svg) Yes | ![\[alt text not found\]](http://docs.aws.amazon.com/quick/latest/userguide/images/negative_icon.svg) No | The owner role is not supported for restricted shared folders. After you choose which folder type best fits your use case, see [Permissions for Quick Sight shared folders](folders-security.md) and [Create and manage membership permissions for Quick Sight shared folders](sharing-folders.md) to create folders and set up folder permissions. # Permissions for Quick Sight shared folders Permissions Shared folders have three permission levels. To set folder-level permissions for a user or group, see [Create and manage membership permissions for Quick Sight shared folders](sharing-folders.md). + **Owners** - The folder *owner* owns everything (folders, analyses, dashboards, datasets, data sources, topics) inside of the folder. They can create, edit, and delete the assets in the folder, modify permissions on the folder and its assets, and delete the folder entirely. The owner role is not supported for restricted shared folders. + **Contributors** - A *contributor* can create, edit, and delete assets in a folder just like an owner. They can't delete the folder or modify permissions on the folder or on assets where they have contributor access that they inherited from the folder. + **Viewers** - A *viewer* can only view the assets (folders, dashboards, datasets, data sources, topics) in the folder. A viewer can't edit or share those assets. The following rules also apply to security for shared folders: + Quick readers' sharing status for a folder gets shared with the folder. However, a reader gets only read access to folders, and only dashboard access to visuals. + AWS security is enforced on every object within a folder. The folder applies the same type of security to the assets of whoever the folder is shared with according to their access level (admin, author, or reader). + The *top-level folder* is the root folder of any subfolders. When a subfolder is shared at any level, the person whom the folder was shared with sees the root folder in the top-level folders view. + The folder permission is the permission on the current folder, combined with permissions of all the folders leading to the root folder. + A *shared asset* inherits its permission from the folder. A shared asset is created when an asset that belongs to the folder owner is added to a shared folder. + If you own an unrestricted shared folder, you can transfer ownership of the folder to another Quick admin. + The owner role is not supported for restricted folders. The contributor role is assigned to authors that create and edit assets within the restricted folders. Folder contributors can't manage the permissions of the restricted folder or its assets. + The correct IAM permissions are required to update the permissions of a restricted shared folder with the `UpdateFolderPermissions` API. To create and manage permissions of a shared folder, see [Create and manage membership permissions for Quick Sight shared folders](sharing-folders.md). # Create and manage membership permissions for Quick Sight shared folders Create a shared folder **Shared folders (unrestricted)** To create a shared folder and to share the folder with one or more groups in the Quick console, you must be an Amazon QuickSight administrator. You can also create a shared folder with the `CreateFolder` API operation. Use the following procedure to share or modify the membership permissions of a shared folder. 1. From the left navigation, choose **Folders** then **Shared Folders**. Find the folder that you want to share or manage permissions for. 1. To open the actions menu for that folder's row, choose the ellipsis (three dots). 1. Choose **Share**. 1. In the **Share folder** modal, add the groups and users with whom you want to share the contents of the folder. 1. For each user and group that you add, choose a permission level from the **Permissions** menu in that row. 1. To update the permission type for an existing user, choose **Manage folder access**. 1. When you're done setting user and group permissions for the folder, choose **Share**. Users are not notified that they now have access to the folder. **Restricted shared folders** Restricted shared folders can only be created with the `CreateFolder` API operation. The following example creates a restricted shared folder. ``` aws quicksight create-folder \ --aws-account-id AWSACCOUNTID \ --region us-east-1 \ --folder-id example-folder-name \ --folder-type RESTRICTED \ --name "Example Folder" \ ``` After you create a restricted shared folder, assign folder contributor and viewer permissions with a `UpdateFolderPermissions` API call. The following example updates the permissions of a restricted shared folder to grant contributor permissions to a user. ``` aws quicksight update-folder-permissions \ --aws-account-id AWSACCOUNTID \ --region us-east-1 \ --folder-id example-folder-name \ --grant-permissions Principal=arn:aws:quicksight::us-east- 1::AWSACCOUNTID:user/default/:username,Actions=quicksight:CreateFolder ,quicksight:DescribeFolder, \ quicksight:CreateFolderMembership,quicksight:DeleteFolderMembership,qu icksight:DescribeFolderPermissions \ ``` The permissions that you pass to the user depend on the type of folder role that you want to grant them. Use the following lists to determine which permissions are needed for the user that you want to grant folder access to. **Folder owner** + quicksight:CreateFolder + quicksight:DescribeFolder + quicksight:UpdateFolder + quicksight:DeleteFolder + quicksight:CreateFolderMembership + quicksight:DeleteFolderMembership + quicksight:DescribeFolderPermissions + quicksight:UpdateFolderPermissions **Folder contributor** + quicksight:CreateFolder + quicksight:DescribeFolder + quicksight:CreateFolderMembership + quicksight:DeleteFolderMembership + quicksight:DescribeFolderPermissions **Folder viewer** + quicksight:DescribeFolder After you create a shared folder, you can begin using the folder in Quick Sight. You can also use the Quick Sight APIs to create special scaled folders that can be shared with up to 3000 namespaces. To learn more about creating a scaled folder, see [Creating Quick Sight scaled folders with the Quick Sight APIs](folders-scaled.md). # Creating Quick Sight scaled folders with the Quick Sight APIs Creating scaled folders with the Quick Sight APIs You can use the Amazon Quick Sight APIs to create special scaled folders that can be shared with up to 3000 namespaces. Each namespace that is added to a folder can contain up to 100 principals. A *principal* is a user or a group of users. After you create a scaled folder and add the principals that you want, any QuickSight asset can be added to the folder. It can then be shared to every principal in the namespaces that the folder principals are assigned to. This streamlines the process to share Quick Sight assets with thousands of users. Scaled folders can only be created with the Quick Sight APIs. When you create a scaled folder, you can share the folder with up to 100 principals that are in the same namespace. You can add principals that belong to a different namespace with an `UpdateFolderPermissions` API call. After the folder is created, you can add and remove assets from the folder with the Quick Sight APIs or the Quick console. Each Amazon Quick Sight account holds up 100 scaled folders. You can add up to 100 assets to a scaled folder. If you want to share a scaled folder with more than 3000 namespaces, contact [AWS support](https://aws.amazon.com/contact-us/). ## Examples The following examples show how to create a scaled folder with the Quick Sight APIs. **Prerequisites** Before you begin, verify that you have an AWS Identity and Access Management role that grants the API user access to call the Quick Sight API operations. The following example shows an IAM policy that you can add to an existing IAM role to create, delete, or modify a scaled folder. With the sample policy, users can add dashboards, analyses, and datasets to a scaled folder. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "quicksight:CreateFolder", "quicksight:CreateFolderMembership", "quicksight:DeleteFolderMembership", "quicksight:DeleteFolder", "quicksight:DescribeFolderPermissions", "quicksight:DescribeFolderResolvedPermissions", "quicksight:UpdateFolderPermissions", "quicksight:UpdateDashboardPermissions", "quicksight:UpdateAnalysisPermissions", "quicksight:UpdateDataSetPermissions" ], "Resource": "*" } ] } ``` ------ The following example creates a scaled folder. ``` aws quicksight create-folder \ --aws-account-id "AWSACCOUNTID" \ --region "us-east-1" \ --name "eastcoast-users" \ --sharing-model "NAMESPACE" \ --folder-id "eastcoast-users" ``` After you create a scaled folder, share the folder with a principal in your account. You can only grant or revoke permissions to users and groups that are within the same namespace in each API call. The following example shares a scaled folder with a user in the same account that the folder exists in. ``` aws quicksight update-folder-permissions \ --aws-account-id "AWSACCOUNTID" \ --region "us-east-1" \ --folder-id "eastcoast-users" \ --grant-permissions \ '[ {"Actions": ["quicksight:DescribeFolder", "quicksight:UpdateFolder", "quicksight:DeleteFolder", "quicksight:DescribeFolderPermissions", "quicksight:UpdateFolderPermissions", "quicksight:CreateFolderMembership", "quicksight:DeleteFolderMembership", "quicksight:CreateFolder" ], "Principal":"arn:aws:quicksight:us-east-1:AWSACCOUNTID:user/default/my-user" } ]' ``` After you share the folder with a new principal, validate the new folder permissions with a `describe-folder-permissions` API call. ``` aws quicksight describe-folder-permissions \ --aws-account-id "AWSACCOUNTID" \ --region "us-east-1" \ --folder-id "eastcoast-users" \ --namespace "default" ``` After you validate the new folder permissions, create a subfolder within the scaled folder. The subfolder inherits the permissions of the scaled folder that it's created in. ``` aws quicksight create-folder \ --aws-account-id "AWSACCOUNTID" \ --region "us-east-1" \ --name "new-york-users" \ --sharing-model "NAMESPACE" \ --folder-id "new-york-users" \ --parent-folder-arn "arn:aws:quicksight:us-east-1:AWSACCOUNTID:folder/eastcoast-users" ``` The following example validates the inherited permissions of the new subfolder. ``` aws quicksight describe-folder-resolved-permissions \ --aws-account-id "AWSACCOUNTID" \ --region "us-east-1" \ --folder-id "new-york-users" \ --namespace "default" ``` After you validate the permissions of the subfolder, add the Quick Sight asset that you want to share to the folder. After you add the asset to the subfolder, the asset is shared with every principal that the subfolder is shared with. The following example adds a dashboard to a subfolder. ``` aws quicksight create-folder-membership \ --aws-account-id "AWSACCOUNTID" \ --folder-id "new-york-users" \ --member-id "my-dashboard" \ --member-type "DASHBOARD" \ --region "us-east-1" ```