QuickSight / Client / update_resource_permissions

update_resource_permissions

QuickSight.Client.update_resource_permissions(**kwargs)

Updates the service role configuration that Amazon Quick Sight uses to access resources in your Amazon Web Services account. To use this operation, you must have the quicksight:UpdateResourcePermissions and iam:PassRole permissions.

Call this operation in the Amazon Web Services Region where your Amazon Quick Sight account is registered (the home Region). You can switch from a role managed by Amazon Quick Sight to a customer-managed role, or replace one customer-managed role with another. You can’t use this operation to switch back to a role managed by Amazon Quick Sight.

See also: AWS API Documentation

Request Syntax

response = client.update_resource_permissions(
    AwsAccountId='string',
    RoleType='QUICKSIGHT_MANAGED'|'CUSTOMER_MANAGED',
    CustomerManagedRoleArn='string'
)
Parameters:

  • AwsAccountId (string) –

    [REQUIRED]

    The ID of the Amazon Web Services account whose service role configuration you want to update.

  • RoleType (string) –

    [REQUIRED]

    The type of service role that you want Amazon Quick Sight to use. The only supported value for this operation is CUSTOMER_MANAGED. Requests that specify QUICKSIGHT_MANAGED are rejected.

  • CustomerManagedRoleArn (string) –

    [REQUIRED]

    The ARN of the customer-managed role that you want Amazon Quick Sight to use. To use this operation, you must have the iam:PassRole permission for the role.

    Configure the role as follows:

    • The role must belong to the Amazon Web Services account specified by AwsAccountId.

    • Configure the role trust policy to allow the Amazon Quick Sight service principal to call sts:AssumeRole.

    • Attach a permissions policy that allows access to the resources that you want Amazon Quick Sight to use.

    • To use features that rely on session tags, configure the role trust policy to allow the Amazon Quick Sight service principal to call sts:TagSession.

    If the role doesn’t exist or its trust policy doesn’t allow sts:AssumeRole, the request returns an AccessDeniedException.

    When you call this operation, Amazon Quick Sight attempts to assume the role with session tags and records whether the attempt succeeds. If you later add or remove sts:TagSession from the trust policy, call this operation again with the same role ARN to refresh the stored capability.

Return type:

dict

Returns:

Response Syntax

{
    'RoleType': 'QUICKSIGHT_MANAGED'|'CUSTOMER_MANAGED',
    'CustomerManagedRoleArn': 'string',
    'RequestId': 'string',
    'Status': 123
}

Response Structure

  • (dict) –

    • RoleType (string) –

      The type of service role that Amazon Quick Sight uses for your account after the update. This value is CUSTOMER_MANAGED.

    • CustomerManagedRoleArn (string) –

      The ARN of the customer-managed role that Amazon Quick Sight uses for your account after the update.

    • RequestId (string) –

      The Amazon Web Services request ID for this operation.

    • Status (integer) –

      The HTTP status of the request.

Exceptions