Copy AWS QuickSight analysis to another account

Question

We have a lot of AWS quicksight reports in one account, which needs to be migrated to another account.

Within the same account, we can use the 'save-as' feature of the dashboard to create a copy of the report, but is there any way to export the analysis from one account and import into another account?

At present, it appears only we way is to recreate all the reports again from scratch in the new account, but anyone has any other options?

Kaleidoscopic

Answer 1

You can do this programmatically through the API:

QuickSight API

However, it will take a bit of scripting. You will need to pull out the pieces with the API, and then rebuild on a new account. For example, DescribeTemplate will pull the JSON defining a template. Then you can use CreateTemplate to create on another account.

Carissacarita

I'm trying to recreate the analysis and following the approach you mentioned. I have the json from DescribeTemplate operation but the CreateTemplate can only be created from an existing template or an analysis from AWS docs(docs.aws.amazon.com/quicksight/latest/APIReference/…). Am I missing something? – Corydalis

No, you're not missing anything. It can't be done, practically, @RavitejaGubba. You need to create an analysis manually, then the template is created from that analysis. Creating an analysis using the API needs the template, so it's circular. They haven't automated that part 🙄 – Skipton

Answer 2

In my organization, we are using the QuickSight APIs in AWS Lambda Functions and save the Analysis template in JSON format in an S3 bucket. This S3 bucket has access to multiple environments like Dev, QA, Staging, and Production. Leveraging the API again, we create analysis in other environments by using the template JSON file. We also store version information of the templates in a PostgreSQL database.

PS - The dataset in each environment needs to be created prior to migrating the analysis.

Whiffen

Is it the json of DescribeTemplate operation that you save in s3? – Corydalis

@RavitejaGubba - No, we create the template from an analysis and then store the ARN of the template in S3. This allows us to keep multiple versions of the analysis in different templates. – Whiffen

Thanks for the reply. The Arn contains the accountId from which it is created. When I try to use the template created from the DEV account in PROD, we get that prod user is not authorized to perform DescribeTemplate on the dev resource. When we try to grant permissions to PROD user for DEV template, it compalins that the user is in a different account. How did you manage to reuse the templates in different environments? – Corydalis

May I know how did you provide access between both the accounts? Ideally, it should be done by using the AssumeRole functionality. In that case, the user from the DEV can connect to the other accounts as well and perform the operations. – Whiffen

I get this error. An error occurred (AccessDeniedException) when calling the CreateTemplate operation: User: arn:aws:sts::<PROD>:assumed-role/DataEngineer/botocore-session-1611929426 is not authorize d to perform: quicksight:DescribeTemplate on resource: arn:aws:quicksight:eu-west-1:<DEV>:template/eee94ec4-a038-46b7-1234-612d060d8c8b – Corydalis

But when we tried to grant permissions, I got this error An error occurred (InvalidParameterValueException) when calling the UpdateTemplatePermissions operation: Principal arn:aws:quicksight:eu-west-1:<PROD>: user/default/DataEngineer/[email protected] is part of a different account – Corydalis

for dataset creation we will again need console access ? – Tjon

@user3186866 - No, you can use the APIs to create the data source first and then create the dataset. – Whiffen

Hello @Whiffen it would be nice if you write a blog post on this subject. – Stellite

Answer 3

1.Create template in account1 from Analysis
--template.json:
{
  "SourceAnalysis": {
    "Arn": "arn:aws:quicksight:<AccountID-1>:analysis/<Analysis ID>",
    "DataSetReferences": [
      {
        "DataSetPlaceholder": "DS1",
        "DataSetArn": "arn:aws:quicksight:AccountID-1:dataset/<DatasetID>"
      }
    ]
  }
}
aws quicksight create-template --aws-account-id AccountID-1 --template-id <templateId> --source-entity file://template.json --profile default

2.Update Template Permissions in Account1->root(Account2):
--TemplatePermission.json
[{
    "Principal": "arn:aws:iam::AccountID-2:root",
    "Actions": ["quicksight:UpdateTemplatePermissions", "quicksight:DescribeTemplate"]
}]
aws quicksight update-template-permissions --aws-account-id AccountID-1 --template-id <templateId> --grant-permissions file://TemplatePermission.json --profile default


3.Create Analysis in Account2 using Account1 Template
createAnalysis.json
{
"SourceTemplate": {
"DataSetReferences": [
{
"DataSetPlaceholder": "DS1",
"DataSetArn": "arn:aws:quicksight:us-east-1:AccountID-2:dataset/<DatasetID in account 2>"
}
],
"Arn": "arn:aws:quicksight:us-east-1:AccountID-1:template/testTemplate"
}
}

aws quicksight create-analysis --aws-account-id AccountID-2 --analysis-id testanalysis --name test1 --source-entity file://createAnalysis.json

4.Update Permissions to view analysis for your user
UpdateAnalysisPermission.json
[
  {
    "Principal": "arn:aws:quicksight:us-east-1:AccountID-2:user/default/<username>",
    "Actions": [
                "quicksight:RestoreAnalysis",
                "quicksight:UpdateAnalysisPermissions",
                "quicksight:DeleteAnalysis",
                "quicksight:DescribeAnalysisPermissions",
                "quicksight:QueryAnalysis",
                "quicksight:DescribeAnalysis",
                "quicksight:UpdateAnalysis"
            ]
  }
]

aws quicksight update-analysis-permissions --aws-account-id AccountID-2 --analysis-id testanalysis --grant-permissions file://UpdateAnalysisPermission.json

Anaphylaxis

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. – Grissel