How do I implement RLS in Amazon Quick?

Short description

If your viewers are registered Quick users, then use user-based RLS to match a user or group to a rules dataset. 

Use tag-based RLS only for dashboards that you embedded for anonymous (unregistered) users. Tag-based rules match session tags that you add at runtime through the GenerateEmbedUrlForAnonymousUser API operation.

With the exception of the data preparation page, Quick enforces RLS rules at the analysis and dashboard level for every Quick user. The data preparation pages shows every row only for the dataset owner.

Non-owners can't open the data preparation page. If a non-owner creates a child dataset from an RLS-activated parent, then Quick enforces RLS and the child dataset returns only rows that the user is permitted to view.

To test RLS, it's a best practice to sign in as a target end user and view an analysis or dashboard.

Resolution

Create the rules dataset

Before you begin, review the points that are listed on Using row-level security with user-based rules to restrict access to a dataset.

Datasets that you flag as a rules dataset enforce stricter ingestion validation than regular datasets.

Create the rules dataset from a CSV file or a SQL query that contains one identity column and one column for each restricted field. Identity column values must use the Quick UserName, GroupName or the full Amazon Resource Name (ARN) format. Field names must exactly match the main dataset, and every column must be a string type. To grant values for the field, use NULL or an empty value. Don't include duplicate rows. If a value contains a comma, then wrap it in double quotation marks so that Quick recognizes it as one value.

You can use the Quick console or API operation to create the rules dataset.

Use the console

Complete the following steps:

1. Open the Quick console.
2. In the navigation page, choose Data.
3. On the Create dataset dropdown list, choose Create rules dataset.
4. Select your data source.
5. Connect to the file or query that contains your rules.
6. Choose Save and Publish Rules Dataset.

For more information, see Creating dataset rules for row-level security.

Use AWS API

Run the CreateDataSet API operation and set the UseAs parameter to RLS_RULES.

Note: After you create the dataset, you can't change the flag.

Apply the rules to the main dataset

To apply user-based RLS, complete the following steps:

1. Open the Quick console.
2. In the navigation pane, choose Data.
3. Select the dataset, and then choose Row-level security.
4. Choose User-based rules.
5. Select the rules dataset that you created.
6. For Permissions policy, choose Grant access to dataset.
7. Choose Apply.
8. Choose Apply and activate.

To apply tag-based RLS, complete the following steps:

1. Open the Quick console.
2. In the navigation pane, choose Data.
3. Under the Action column, choose Row-level security.
4. Select the dataset, and then choose Row-level security.
5. Choose Tag-based rules.
6. For Column, select a string column to filter on.
7. For Tag, enter a tag key.
8. (Optional) Set a delimiter to support multiple values for each tag and a match all character to grant access to all values.
9. Choose Add. Repeat steps 6-9 for each column that you want to filter on.
10. Choose Apply.
11. Choose Apply and activate.
12. (Optional) In the Manage rules table, choose the Add OR condition to relate tags with OR instead of the default AND.
13. In your application, call the GenerateEmbedUrlForAnonymousUser API operation. In the SessionTags parameter, add Key and Value pairs for each RLS tag. The values filter the dataset for the session.

If you turned on tag-based RLS, then also create a user-based rules dataset that grants access to Quick authors who must view the data when they're authoring dashboards.

Test as a target end user

To confirm that you correctly assigned the rules, share the dashboard or analysis with a test user account that's listed in the rules dataset. Then, sign in as the test user to confirm that the visuals show only the rows that you granted access to.

Best practices

Implement the following RLS best practices: 

• Manage user identities with Quick groups, and base your rules dataset on GroupName instead of individual UserName values.
• Refresh the rules dataset after every change. If the rules dataset is in SPICE (Super-fast, Parallel, In-memory, Calculation Engine), then schedule regular refreshes so that new users and group changes take effect. Monitor ingestion logs for rules datasets that fail the entire ingestion on a non-valid row.
• Keep restricted columns as strings. You can change values during data preparation.
• Before you change the rules, review the dashboards and analyses that depend on a restricted dataset.

Related information

Using column-level security to restrict access to a dataset

Embedding Amazon Quick Sight dashboards for anonymous (unregistered) users