Row Level Security

full_access_users - is a view or a table that contains a list of emails of users who supposed to have a full unrestricted access to protected datasets. This view can be edited in Athena directly (https://docs.aws.amazon.com/athena/latest/ug/views-managing.html) as linline table or it can be replaced with the tables that comes from other sources (your identity management or a simple csv file on Amazon S3). We do not recommend using individual users for this and rather prioritize user management with groups, but it can be handy on the initial setup phase. Please make sure you put exactly the same email as you have in Quick Suite.

full_access_groups - is a view or a table that contains a list of Quick Suite Groups with users who will to have a full unrestricted access to protected datasets. This view can be edited in Athena directly (https://docs.aws.amazon.com/athena/latest/ug/views-managing.html) as linline table or it can be replaced with the tables that comes from other sources (your identity management or a simple csv file on Amazon S3).

account_access - a view or a table that has following fields:

permission view - is a union of several sub tables based on full_access_users, full_access_groups and account_access. It results to a following fields:

quickSight_users table contains emails and UserName of QS User.

rls_view is the final form and represents the same fields as permission view but instead of user email it will have the QS User Names needed for RLS Dataset.

Login to Management Account(s) and install the Permission Stack by clicking Launch Stack below

Login to Data Collection/Dashboard Account and install the Data Collection Stack by clicking Launch Stack below. Put Management Account Ids parameter as a comma separated list of your Management Accounts.

Once installed, you can go to AWS Organization in the Management Account and configure tags as follows:

After update you can launch execution of the data collection using a StepFunction CID-DC-organizations-StateMachine.

You can validate data using following query:

SELECT * FROM "organization_data"

Login to Data Collection/Dashboard Account and install the Data Collection Stack by clicking Launch Stack below. If you have already CID Data Collection Stack you can just check if Quick Suite and OrgData modules are activated, and continue to the next item.

Create an inline Athena Table that simulates Data Collection organization_data, but can be edited directly in Athena to manage access.

CREATE OR REPLACE VIEW "cid_cur"."organization_data" AS
WITH accounts AS (
  SELECT *
  FROM (
    VALUES
      ROW ('1111111111111111', '1111111111111111', ARRAY['user11@e.mail', 'user12@e.mail'], ARRAY['group11', 'group12'])
    , ROW ('2222222222222222', '1111111111111111', ARRAY['user21@e.mail', 'user22@e.mail'], ARRAY['group21', 'group22'])
    , ROW ('3333333333333333', '1111111111111111', ARRAY['user31@e.mail', 'user32@e.mail'], ARRAY['group31', 'group32'])
  )  ignored_table_name ("account_id", "payer_id", "emails", "groups")
)
SELECT
  account_id as Id,
  payer_id as ManagementAccountId,
  ARRAY[
    CAST(ROW('cid_users', array_join("emails", ',')) AS ROW(key VARCHAR, value VARCHAR)),
    CAST(ROW('cid_groups', array_join("groups", ',')) AS ROW(key VARCHAR, value VARCHAR))
  ] as HierarchyTags
FROM accounts

Login to Data Collection/Dashboard Account and install the Data Collection Stack by clicking Launch Stack below

Create a CSV file (ex: file.csv):

"account_id", "payer_id", "emails", "groups"
"1111111111111111", "1111111111111111", "user11@e.mail,user12@e.mail", "group11,group12"
"2222222222222222", "1111111111111111", "user21@e.mail,user12@e.mail", ""
"3333333333333333", "1111111111111111", "", "group31,group32"

Upload CSV file to an Amazon S3 Bucket. Please use an existing Bucket that Quick Suite already has access to. Example: cid-{account-id}-data-exports or cid-data-{account-id}. You can use either the web interface or the command line:

account_id=$(aws sts get-caller-identity --query "Account" --output text)
aws s3 cp ./file.csv s3://cid-data-${account_id}/my_accounts/file.csv

Login to AWS Console, select Athena Service and Create a Table:

CREATE EXTERNAL TABLE "cid_cur"."my_accounts" (
    "account_id" string,
    "payer_id" string,
    "emails" string,
    "groups" string
)
ROW FORMAT SERDE 'org.apache.hadoop.hive.serde2.OpenCSVSerde'
WITH SERDEPROPERTIES (
    'separatorChar' = ',',
    'quoteChar' = '"',
    'escapeChar' = '\\'
)
STORED AS TEXTFILE
LOCATION 's3://cid-data-${account_id}/my_accounts/' -- REPLACE ${account_id} WITH YOUR ACCOUNT ID
TBLPROPERTIES (
    'has_encrypted_data'='false',
    'skip.header.line.count'='1'
);

Verify the table

SELECT * FROM "cid_cur"."my_accounts"

Create a view that simulates organization_data table

CREATE OR REPLACE VIEW "cid_cur"."organization_data" AS
  account_id as Id,
  payer_id as ManagementAccountId,
  ARRAY[
    CAST(ROW('cid_users',  "emails")) AS ROW(key VARCHAR, value VARCHAR)),
    CAST(ROW('cid_groups', "groups")) AS ROW(key VARCHAR, value VARCHAR))
  ] as HierarchyTags
FROM "cid_cur"."my_accounts"

Access Terminal: Login to Amazon CloudShell or use your local terminal

Install CID-CMD Tool:

pip3 install -U cid-cmd

Deploy RLS Dashboard:

cid-cmd deploy --dashboard-id cid-rls

Verify Dashboard: Check the dashboard in Quick Suite. Ensure the dataset updates and displays data (may take several minutes after deployment)

Configure Admin Access: Edit Athena views full_access_users and full_access_groups replace placeholders with your admin users and groups for full dashboard access. After modifying data, refresh the rls_dataset dataset.

Access Terminal: Login to Amazon CloudShell or use your local terminal

Install CID-CMD Tool (if not already installed):

pip3 install -U cid-cmd

Enable RLS: Update dashboard with RLS enabled. The tool will guide you through selecting the dashboard and RLS dataset, then update all associated datasets:

cid-cmd update --force --recursive --rls ENABLE

RLS Management Options: