Amazon QuickSight

Sifflet connects to Amazon QuickSight to show which dashboards and analyses depend on the tables you monitor in your data warehouse. When an incident affects an upstream table, you see right away which QuickSight dashboards and analyses are impacted, and from a dashboard you can trace the datasets and warehouse tables that feed it. For the full list of imported assets and metadata, see Amazon QuickSight Collected Data.

Permissions Required

Sifflet gets read-only access to QuickSight metadata through an IAM role that you create in your AWS account. Sifflet assumes this role from its own AWS role (role chaining with sts:AssumeRole): you don't share any access key or password with Sifflet.

All permissions are read-only. Sifflet doesn't read the data in your datasets, and doesn't run queries through QuickSight.

The recommended policy in step 1 grants the read-only wildcards quicksight:List* and quicksight:Describe*.

At each refresh, Sifflet reads every dashboard, analysis, and dataset through the QuickSight API. These calls count toward the QuickSight API quotas of your AWS account.

Requirements

Required Roles for Setup

• In AWS: permission to create IAM policies and roles in the AWS account that hosts QuickSight (for example the IAMFullAccess managed policy or an administrator role).
• In Sifflet: a role that can create sources in Integrations > Sources.

Supported Versions and Editions

Sifflet supports Amazon QuickSight, the AWS-managed service. A source reads one AWS account in one AWS region: if you use QuickSight in several regions, create one source per region.

Network Access

Sifflet calls the public QuickSight API endpoint of your region (https://quicksight.<REGION>.amazonaws.com) with temporary AWS credentials. Access is controlled by the IAM role and its trust policy.

Other Prerequisites

To see lineage from your warehouse tables to QuickSight datasets and dashboards, add the warehouses that QuickSight reads from as sources in Sifflet first. See Lineage for the supported warehouses.

Connect Sifflet to Amazon QuickSight

Step 1: Create an IAM Role in AWS

Before you start, find the ARN of the Sifflet AWS role for your instance: in Sifflet, go to Settings > Integration Preferences and copy the AWS Role ARN value. Your QuickSight role trusts this ARN. If the value shows Pending, contact Sifflet support.

Create the Policy

1. In the AWS console, go to IAM > Policies and click Create policy.

2. Select the JSON editor and paste the following policy. Replace <REGION> with the AWS region where your QuickSight assets are, and <AWS_ACCOUNT_ID> with your 12-digit AWS account ID.

   JSON

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "quicksight:List*",
           "quicksight:Describe*"
         ],
         "Resource": "arn:aws:quicksight:<REGION>:<AWS_ACCOUNT_ID>:*"
       }
     ]
   }

3. Click Next, name the policy (for example sifflet_quicksight_read_policy), and click Create policy.

Create the Role

For more details, see the AWS documentation on creating a role with a custom trust policy.

1. In the AWS console, go to IAM > Roles and click Create role.

2. Select Custom trust policy and paste the following trust policy. Replace <SIFFLET_AWS_ROLE_ARN> with the AWS Role ARN value copied from Settings > Integration Preferences.

   JSON

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "<SIFFLET_AWS_ROLE_ARN>"
         },
         "Action": "sts:AssumeRole"
       }
     ]
   }

3. Click Next, select the policy created above (sifflet_quicksight_read_policy in this example), and click Next.

4. Name the role (for example sifflet_quicksight_read_role) and click Create role.

5. Open the role and copy its ARN, for example arn:aws:iam::123456789101:role/sifflet_quicksight_read_role.

Keep the role ARN, your AWS account ID, and the QuickSight region for step 2. The role doesn't produce any secret to store or rotate.

Step 2: Add the Amazon QuickSight Source in Sifflet

QuickSight doesn't use a Sifflet credential: Sifflet authenticates with the IAM role, so you don't need to create anything in Integrations > Credentials.

1. Go to Integrations > Sources, click New source, and select QuickSight.

2. Fill in the source fields:

   Field	Description	Example
   Source name	The name of the source in Sifflet	QuickSight production
   Account id	Your 12-digit AWS account ID. It is also the number in the role ARN.	123456789101
   AWS region	The AWS region code where your QuickSight assets are	eu-west-1
   AWS role ARN	The ARN of the role created in step 1	arn:aws:iam::123456789101:role/sifflet_quicksight_read_role

3. Sifflet imports all the dashboards, analyses, and datasets of the account and region: there is no scope to select.

4. Click Test Connection. Sifflet assumes the role and lists one dashboard. Then save the source.

Saving the source starts a first run. You can follow its status and logs in the source details, and the assets appear in the Data Catalog when the run completes. For refresh frequency, scheduling, and other source operations, see Integrations Management.

Troubleshooting

Sifflet Can't Assume the IAM Role

Symptom: Test Connection or a run fails with:

Sifflet is not allowed to assume the IAM role <ROLE_ARN>. Check that this role exists, and that its trust policy allows the Sifflet AWS role <SIFFLET_AWS_ROLE_ARN> to assume it.

Cause: the role ARN entered in the source is wrong, or the role's trust policy doesn't list the Sifflet AWS role of your instance.

Fix:

1. Check that the AWS role ARN field of the source matches the ARN of the role created in step 1.
2. In IAM > Roles, open the role, go to the Trust relationships tab, and check that the principal is exactly the AWS Role ARN shown in Sifflet under Settings > Integration Preferences.

Listing QuickSight Resources Fails

Symptom: a run fails with an error such as:

Error when trying to list quicksight resource = dashboards, cause = ...

Cause: the role is missing one of the QuickSight permissions, the policy's Resource uses another region or account, or the AWS region or Account id field of the source is wrong.

Fix:

1. Check that the role's policy grants quicksight:List* and quicksight:Describe*, or every required action of Permissions Required, and that its Resource uses the same region and account ID as the source.
2. Check the Account id and AWS region fields of the source, then run the source again.