Amazon Q Business with QuickSight Plugin using IAM Identity Provider Federation

Hi Luqman Ahmad

Yes, it is possible to use the QuickSight plugin in Amazon Q Business with your current Q Business application using IAM Identity Provider (IdP) federation. This involves configuring QuickSight for federated users, setting up the QuickSight plugin in Q Business, implementing user context and data security using session tags and RLS/CLS policies, and thoroughly testing the integration.

• Properly configuring IAM roles and RLS/CLS policies is crucial to ensure that users only have access to the data they are authorized to see.
• Integrating federated identities with AWS services can be complex, requiring careful planning and testing.
• Session tags are essential for passing user identity information from the IdP to QuickSight for enforcing RLS/CLS.
• Thorough testing with different federated users is necessary to ensure the integration works correctly and securely.

Step 1: Configure QuickSight for Federated Users Ensure QuickSight is set up to work with your IAM IdP. This involves creating IAM roles that federated users will assume and configuring your IdP to pass necessary attributes in the SAML assertion. Verify that federated users can log in to QuickSight and access dashboards directly.

Step 2: Configure the QuickSight Plugin in Q Business Install the QuickSight plugin within your Q Business application. Specify the AWS Region where your QuickSight instance is located and provide the ARNs of the QuickSight dashboards you want Q Business to access. The IAM role that Q Business assumes needs permissions to access QuickSight dashboards and assume the roles used by your federated users.

Step 3: Implement User Context and Data Security Ensure that Q Business can pass the identity of the federated user to QuickSight when it requests data. Use session tags to pass attributes from your IdP to QuickSight, which can then be used in RLS/CLS policies.

Step 4: Test and Troubleshoot the Integration Thoroughly test the integration with different federated users to ensure that users can ask questions related to QuickSight dashboards, Q Business retrieves the correct data based on the user's identity and permissions, and RLS/CLS policies are correctly enforced. Enable logging in both Q Business and QuickSight to help diagnose any issues.

If the Answer is helpful, please click Accept Answer and up-vote, so that it can help others in the community looking for help on similar topics.

To use the QuickSight plugin with Amazon Q Business, both services must use IAM Identity Center for authentication. Based on your current setup using IAM Identity Provider with federation for your Q Business application, you would need to create a new Amazon Q Business application that uses IAM Identity Center instead.

If you want to test this feature while maintaining your existing setup, you could consider using a different AWS account without a QuickSight subscription. In that account, you would create an Amazon Q Business application configured with IAM Identity Center and then go through the QuickSight integration setup steps in the Amazon Q Business console.

The requirements for using the QuickSight plugin with Amazon Q Business include:

1. Both QuickSight and Amazon Q Business must use IAM Identity Center for authentication
2. Your Amazon Q Business application and Amazon QuickSight account must be in the same AWS Region
3. At least one index must be added to your Amazon Q Business application
4. You must authorize Amazon Q Business to communicate with Amazon QuickSight using a service role
5. The IAM role for your Amazon Q Business web experience must have appropriate QuickSight permissions

Unfortunately, there is no direct way to use the QuickSight plugin with an Amazon Q Business application that uses IAM Identity Provider with federation instead of IAM Identity Center.
Sources
Using the QuickSight plugin to get insights from structured data - Amazon Q Business
Query structured data from Amazon Q Business using Amazon QuickSight integration | AWS Machine Learning Blog