13

We have a lot of AWS quicksight reports in one account, which needs to be migrated to another account.

Within the same account, we can use the 'save-as' feature of the dashboard to create a copy of the report, but is there any way to export the analysis from one account and import into another account?

At present, it appears only we way is to recreate all the reports again from scratch in the new account, but anyone has any other options?

yottabrain
  • 2,387
  • 5
  • 23
  • 37

3 Answers3

6

You can do this programmatically through the API:

QuickSight API

However, it will take a bit of scripting. You will need to pull out the pieces with the API, and then rebuild on a new account. For example, DescribeTemplate will pull the JSON defining a template. Then you can use CreateTemplate to create on another account.

Dutch Masters
  • 1,429
  • 17
  • 19
  • 1
    I'm trying to recreate the analysis and following the approach you mentioned. I have the json from DescribeTemplate operation but the CreateTemplate can only be created from an existing template or an analysis from AWS docs(https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateTemplate.html). Am I missing something? – Raviteja Gubba Jan 29 '21 at 14:53
  • No, you're not missing anything. It can't be done, practically, @RavitejaGubba. You need to create an analysis manually, then the template is created from that analysis. Creating an analysis using the API needs the template, so it's circular. They haven't automated that part – oblio Mar 18 '21 at 08:52
2

In my organization, we are using the QuickSight APIs in AWS Lambda Functions and save the Analysis template in JSON format in an S3 bucket. This S3 bucket has access to multiple environments like Dev, QA, Staging, and Production. Leveraging the API again, we create analysis in other environments by using the template JSON file. We also store version information of the templates in a PostgreSQL database.

PS - The dataset in each environment needs to be created prior to migrating the analysis.

aveek
  • 188
  • 6
  • Is it the json of DescribeTemplate operation that you save in s3? – Raviteja Gubba Jan 29 '21 at 14:58
  • @RavitejaGubba - No, we create the template from an analysis and then store the ARN of the template in S3. This allows us to keep multiple versions of the analysis in different templates. – aveek Jan 30 '21 at 15:04
  • Thanks for the reply. The Arn contains the accountId from which it is created. When I try to use the template created from the DEV account in PROD, we get that prod user is not authorized to perform DescribeTemplate on the dev resource. When we try to grant permissions to PROD user for DEV template, it compalins that the user is in a different account. How did you manage to reuse the templates in different environments? – Raviteja Gubba Jan 31 '21 at 04:44
  • May I know how did you provide access between both the accounts? Ideally, it should be done by using the AssumeRole functionality. In that case, the user from the DEV can connect to the other accounts as well and perform the operations. – aveek Feb 01 '21 at 09:29
  • I get this error. An error occurred (AccessDeniedException) when calling the CreateTemplate operation: User: arn:aws:sts:::assumed-role/DataEngineer/botocore-session-1611929426 is not authorize d to perform: quicksight:DescribeTemplate on resource: arn:aws:quicksight:eu-west-1::template/eee94ec4-a038-46b7-1234-612d060d8c8b – Raviteja Gubba Feb 02 '21 at 15:11
  • But when we tried to grant permissions, I got this error An error occurred (InvalidParameterValueException) when calling the UpdateTemplatePermissions operation: Principal arn:aws:quicksight:eu-west-1:: user/default/DataEngineer/23452@xyz.com is part of a different account – Raviteja Gubba Feb 02 '21 at 15:20
  • for dataset creation we will again need console access ? – VGupta Feb 24 '21 at 18:26
  • @user3186866 - No, you can use the APIs to create the data source first and then create the dataset. – aveek Feb 26 '21 at 00:13
  • Hello @aveek it would be nice if you write a blog post on this subject. – user2250206 Apr 27 '21 at 07:03
0
1.Create template in account1 from Analysis
--template.json:
{
  "SourceAnalysis": {
    "Arn": "arn:aws:quicksight:<AccountID-1>:analysis/<Analysis ID>",
    "DataSetReferences": [
      {
        "DataSetPlaceholder": "DS1",
        "DataSetArn": "arn:aws:quicksight:AccountID-1:dataset/<DatasetID>"
      }
    ]
  }
}
aws quicksight create-template --aws-account-id AccountID-1 --template-id <templateId> --source-entity file://template.json --profile default

2.Update Template Permissions in Account1->root(Account2):
--TemplatePermission.json
[{
    "Principal": "arn:aws:iam::AccountID-2:root",
    "Actions": ["quicksight:UpdateTemplatePermissions", "quicksight:DescribeTemplate"]
}]
aws quicksight update-template-permissions --aws-account-id AccountID-1 --template-id <templateId> --grant-permissions file://TemplatePermission.json --profile default


3.Create Analysis in Account2 using Account1 Template
createAnalysis.json
{
"SourceTemplate": {
"DataSetReferences": [
{
"DataSetPlaceholder": "DS1",
"DataSetArn": "arn:aws:quicksight:us-east-1:AccountID-2:dataset/<DatasetID in account 2>"
}
],
"Arn": "arn:aws:quicksight:us-east-1:AccountID-1:template/testTemplate"
}
}

aws quicksight create-analysis --aws-account-id AccountID-2 --analysis-id testanalysis --name test1 --source-entity file://createAnalysis.json

4.Update Permissions to view analysis for your user
UpdateAnalysisPermission.json
[
  {
    "Principal": "arn:aws:quicksight:us-east-1:AccountID-2:user/default/<username>",
    "Actions": [
                "quicksight:RestoreAnalysis",
                "quicksight:UpdateAnalysisPermissions",
                "quicksight:DeleteAnalysis",
                "quicksight:DescribeAnalysisPermissions",
                "quicksight:QueryAnalysis",
                "quicksight:DescribeAnalysis",
                "quicksight:UpdateAnalysis"
            ]
  }
]

aws quicksight update-analysis-permissions --aws-account-id AccountID-2 --analysis-id testanalysis --grant-permissions file://UpdateAnalysisPermission.json
manishal
  • 21
  • 3
  • Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Steven-Carrot Jul 14 '22 at 21:28