AWS IAM / QuickSight-用户无权执行：quicksight：资源上的GetDashboardEmbedUrl

Question

I am trying to use the embed QuickSight dashboard URL function in my ASP.NET MVC project. For testing, I'm simply trying to output the embed URL to a string. Here is the main part of my code:

    var awsCredentials = new BasicAWSCredentials("redacted", "redacted");

    AmazonSecurityTokenServiceClient stsClient = new AmazonSecurityTokenServiceClient(awsCredentials);
    var tokenServiceRequest = stsClient.GetSessionToken();

    var client = new AmazonQuickSightClient(
        tokenServiceRequest.Credentials.AccessKeyId,
        tokenServiceRequest.Credentials.SecretAccessKey,
        tokenServiceRequest.Credentials.SessionToken,
        Amazon.RegionEndpoint.APSoutheast2);
    try
    {
        string machineTypeEmbedUrl =
            client.GetDashboardEmbedUrlAsync(new GetDashboardEmbedUrlRequest
            {
                AwsAccountId = "redacted",
                DashboardId = "redacted",
                IdentityType = IdentityType.IAM,
                ResetDisabled = true,
                SessionLifetimeInMinutes = 100,
                UndoRedoDisabled = false
            }).Result.EmbedUrl;
    }
    catch (Exception ex)
    {
        return new HttpStatusCodeResult(HttpStatusCode.BadRequest,ex.Message);
    }

In order to support the permissions required, I have set up an IAM user with the STS Assume Role allowed as follows:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1551593192075",
            "Action": [
                "sts:AssumeRole"
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iam::redacted:role/assume-quicksight-role"
        }
    ]
}

I have set up the role specified above with the following permissions, and set its trust policy so that the IAM user above can assume it.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "quicksight:RegisterUser",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "quicksight:GetDashboardEmbedUrl",
            "Resource": "arn:aws:quicksight:ap-southeast-2:redacted:dashboard/redacted",
            "Effect": "Allow"
        }
    ]
}

So as far as I can tell this should work. Debug reveals I do get a session token which is passed to the embedUrl request, however I get the following error:

InnerException = {"User: arn:aws:iam:::user/api-dev-quicksight-user is not authorized to perform: quicksight:GetDashboardEmbedUrl on resource: arn:aws:quicksight:ap-southeast-2::dashboard/"}

I'm not sure why this happens? I have a user that can assume the right role, and the role has the right permissions to the dashboard in question. What am I missing here?

Answer 1

Try to change your role like this (notice the :: double colon before dashboard ):

...
"Action": "quicksight:GetDashboardEmbedUrl", 
"Resource": "arn:aws:quicksight:ap-southeast-2::dashboard/*", 
"Effect": "Allow"
...

This should allow the user to access all the sub-resources under the dashboard.

To follow the Least Privilege principle recommend by AWS, you should list all your resources:

...
"Resource": [
    "arn:aws:quicksight:ap-southeast-2::dashboard/", 
    "arn:aws:quicksight:ap-southeast-2::dashboard/redacted"]
...