AWS Cloud Intelligence dashboard templates blocked by SCPs ?

0

Trying to implement the AWS Cloud Intelligence Dashboards for my organisation. The data collection steps are all proceeding well, but I am unable to install the dashboards. Regardless of whether using CloudFormation or the cli tool, for some reason the QuickSight templates are returning an "Access Denied" error.

Specifically: *CRITICAL - Error: An error occurred (AccessDeniedException) when calling the DescribeTemplate operation: * <user> not authorized to perform: quicksight:DescribeTemplate on resource: arn:aws:quicksight:us-east-1:223485597511:template/cudos_dashboard_v3 with an explicit deny in a service control policy

Does anyone have any suggestions please ?

Shane H
asked 10 months ago265 views
3 Answers
1

I would review what SCP's you have in place in your ORG/OU's https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html

If using control tower, you may have turned on some controls which places SCP's into effect to prevent specific actions. There are mandatory controls inplace https://docs.aws.amazon.com/controltower/latest/userguide/mandatory-controls.html

Here is some documentation which also relates to an SCP to block QuickSight https://docs.aws.amazon.com/quicksight/latest/user/security-scp.html

profile picture
EXPERT
answered 10 months ago
0

The error you got is typically caused indeed by SCP.

Suggestion is to access or request the account owner/organization to and, modify the explicit SCP deny by allowing your account for instance to perform the quick sight action.

profile picture
EXPERT
answered 10 months ago
profile pictureAWS
EXPERT
reviewed 10 months ago
0

I am getting the same error, i think this is the issue with AWS account which is in below ARN. That account is owned by AWS and its referred by CFN to get some template. as I dont have anything in us-east-1 and below account is not part of my organisation.

arn:aws:quicksight:us-east-1:223485597511:template/cudos_dashboard_v3 with an explicit deny in a service control policy

profile picture
Sagar
answered 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions