Embedding the Amazon Q in QuickSight Generative Q&A experience for anonymous (unregistered) users
Intended audience: Amazon QuickSight developers |
In the following sections, you can find detailed information about how to set up an embedded Generative Q&A experience for anonymous (unregistered) users.
Topics
Step 1: Set up permissions
In the following section, you can find how to set up permissions for your backend application or web server to embed the Generative Q&A experience. This task requires administrative access to Amazon Identity and Access Management (IAM).
Each user who accesses a Generative Q&A experience assumes a role that gives them Amazon QuickSight access and permissions. To make this possible, create an IAM role in your Amazon Web Services account. Associate an IAM policy with the role to provide permissions to any user who assumes it. The IAM role needs to provide permissions to retrieve embedding URLs for a specific user pool.
With the help of the wildcard character *, you can grant the
permissions to generate a URL for all users in a specific namespace. Or you can grant
permissions to generate a URL for a subset of users in specific namespaces. For this,
you add quicksight:GenerateEmbedUrlForAnonymousUser
.
You can create a condition in your IAM policy that limits the domains that
developers can list in the AllowedDomains
parameter of a
GenerateEmbedUrlForAnonymousUser
API operation. The
AllowedDomains
parameter is an optional parameter. It grants developers
the option to override the static domains that are configured in the Manage
QuickSight menu and instead list up to three domains or subdomains that
can access a generated URL. This URL is then embedded in a developer's website. Only the
domains that are listed in the parameter can access the embedded Q search bar. Without
this condition, developers can list any domain on the internet in the
AllowedDomains
parameter.
To limit the domains that developers can use with this parameter, add an
AllowedEmbeddingDomains
condition to your IAM policy. For more
information about the AllowedDomains
parameter, see GenerateEmbedUrlForAnonymousUser in the Amazon QuickSight API
Reference.
The following sample policy provides these permissions.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "quicksight:GenerateEmbedUrlForAnonymousUser" ], "Resource": [ "arn:{{
partition
}}:quicksight:{{region
}}:{{accountId
}}:namespace/{{namespace
}}", "arn:{{partition
}}:quicksight:{{region
}}:{{accountId
}}:dashboard/{{dashboardId-1
}}", "arn:{{partition
}}:quicksight:{{region
}}:{{accountId
}}:dashboard/{{dashboardId-2
}}" ], "Condition": { "ForAllValues:StringEquals": { "quicksight:AllowedEmbeddingDomains": [ "https://my.static.domain1.com
", "https://*.my.static.domain2.com
" ] } } }
Your application's IAM identity must have a trust policy associated with it to allow access to the role that you just created. This means that when a user accesses your application, your application can assume the role on the user's behalf to load the Generative Q&A experience. The following example shows a sample trust policy.
{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowLambdaFunctionsToAssumeThisRole", "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" }, { "Sid": "AllowEC2InstancesToAssumeThisRole", "Effect": "Allow", "Principal": { "Service": "ec2.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
For more information regarding trust policies, see Temporary security credentials in IAM in the IAM User Guide
Step 2: Generate the URL with the authentication code attached
In the following section, you can find how to authenticate your user and get the embeddable Q topic URL on your application server.
When a user accesses your app, the app assumes the IAM role on the user's behalf. Then the app adds the user to QuickSight, if that user doesn't already exist. Next, it passes an identifier as the unique role session ID.
import java.util.List; import com.amazonaws.auth.AWSCredentials; import com.amazonaws.auth.AWSCredentialsProvider; import com.amazonaws.auth.BasicAWSCredentials; import com.amazonaws.regions.Regions; import com.amazonaws.services.quicksight.AmazonQuickSight; import com.amazonaws.services.quicksight.AmazonQuickSightClientBuilder; import com.amazonaws.services.quicksight.model.AnonymousUserGenerativeQnAEmbeddingConfiguration; import com.amazonaws.services.quicksight.model.AnonymousUserEmbeddingExperienceConfiguration; import com.amazonaws.services.quicksight.model.GenerateEmbedUrlForAnonymousUserRequest; import com.amazonaws.services.quicksight.model.GenerateEmbedUrlForAnonymousUserResult; import com.amazonaws.services.quicksight.model.SessionTag; /** * Class to call QuickSight Amazon SDK to generate embed url for anonymous user. */ public class GenerateEmbedUrlForAnonymousUserExample { private final AmazonQuickSight quickSightClient; public GenerateEmbedUrlForAnonymousUserExample() { quickSightClient = AmazonQuickSightClientBuilder .standard() .withRegion(Regions.US_EAST_1.getName()) .withCredentials(new AWSCredentialsProvider() { @Override public AWSCredentials getCredentials() { // provide actual IAM access key and secret key here return new BasicAWSCredentials("access-key", "secret-key"); } @Override public void refresh() { } } ) .build(); } public String GenerateEmbedUrlForAnonymousUser( final String accountId, // YOUR Amazon ACCOUNT ID final String initialTopicId, // Q TOPIC ID TO WHICH THE CONSTRUCTED URL POINTS AND EXPERIENCE PREPOPULATES INITIALLY final String namespace, // ANONYMOUS EMBEDDING REQUIRES SPECIFYING A VALID NAMESPACE FOR WHICH YOU WANT THE EMBEDDING URL final List<String> authorizedResourceArns, // Q TOPIC ARN LIST TO EMBED final List<String> allowedDomains, // RUNTIME ALLOWED DOMAINS FOR EMBEDDING final List<SessionTag> sessionTags // SESSION TAGS USED FOR ROW-LEVEL SECURITY ) throws Exception { AnonymousUserEmbeddingExperienceConfiguration experienceConfiguration = new AnonymousUserEmbeddingExperienceConfiguration(); AnonymousUserGenerativeQnAEmbeddingConfiguration generativeQnAConfiguration = new AnonymousUserGenerativeQnAEmbeddingConfiguration(); generativeQnAConfiguration.setInitialTopicId(initialTopicId); experienceConfiguration.setGenerativeQnA(generativeQnAConfiguration); GenerateEmbedUrlForAnonymousUserRequest generateEmbedUrlForAnonymousUserRequest = new GenerateEmbedUrlForAnonymousUserRequest() .withAwsAccountId(accountId) .withNamespace(namespace) .withAuthorizedResourceArns(authorizedResourceArns) .withExperienceConfiguration(experienceConfiguration) .withSessionTags(sessionTags) .withSessionLifetimeInMinutes(600L); // OPTIONAL: VALUE CAN BE [15-600]. DEFAULT: 600 .withAllowedDomains(allowedDomains); GenerateEmbedUrlForAnonymousUserResult result = quickSightClient.generateEmbedUrlForAnonymousUser(generateEmbedUrlForAnonymousUserRequest); return result.getEmbedUrl(); } }
Note
Embed URL generation APIs cannot be called from browsers directly. Refer to the Node.JS example instead.
import json import boto3 from botocore.exceptions import ClientError import time # Create QuickSight and STS clients quicksightClient = boto3.client('quicksight',region_name='us-west-2') sts = boto3.client('sts') # Function to generate embedded URL for anonymous user # accountId: YOUR Amazon ACCOUNT ID # topicId: Topic ID to embed # quicksightNamespace: VALID NAMESPACE WHERE YOU WANT TO DO NOAUTH EMBEDDING # authorizedResourceArns: TOPIC ARN LIST TO EMBED # allowedDomains: RUNTIME ALLOWED DOMAINS FOR EMBEDDING # sessionTags: SESSION TAGS USED FOR ROW-LEVEL SECURITY def generateEmbedUrlForAnonymousUser(accountId, quicksightNamespace, authorizedResourceArns, allowedDomains, sessionTags): try: response = quicksightClient.generate_embed_url_for_anonymous_user( AwsAccountId = accountId, Namespace = quicksightNamespace, AuthorizedResourceArns = authorizedResourceArns, AllowedDomains = allowedDomains, ExperienceConfiguration = { 'GenerativeQnA': { 'InitialTopicId': topicId } }, SessionTags = sessionTags, SessionLifetimeInMinutes = 600 ) return { 'statusCode': 200, 'headers': {"Access-Control-Allow-Origin": "*", "Access-Control-Allow-Headers": "Content-Type"}, 'body': json.dumps(response), 'isBase64Encoded': bool('false') } except ClientError as e: print(e) return "Error generating embeddedURL: " + str(e)
The following example shows the JavaScript (Node.js) that you can use on the app server to generate the URL for the embedded dashboard. You can use this URL in your website or app to display the dashboard.
const AWS = require('aws-sdk'); const https = require('https'); var quicksightClient = new AWS.Service({ region: 'us-east-1', }); quicksightClient.generateEmbedUrlForAnonymousUser({ 'AwsAccountId': '111122223333', 'Namespace': 'DEFAULT' 'AuthorizedResourceArns': '["topic-arn-topicId1","topic-arn-topicId2"]', 'AllowedDomains': allowedDomains, 'ExperienceConfiguration': { 'GenerativeQnA': { 'InitialTopicId': 'U4zJMVZ2n2stZflc8Ou3iKySEb3BEV6f' } }, 'SessionTags': '["Key": tag-key-1,"Value": tag-value-1,{"Key": tag-key-1,"Value": tag-value-1}]', 'SessionLifetimeInMinutes': 15 }, function(err, data) { console.log('Errors: '); console.log(err); console.log('Response: '); console.log(data); });
The following example shows the .NET/C# code that you can use on the app server to generate the URL for the embedded Q search bar. You can use this URL in your website or app to display the Q search bar.
using System; using Amazon.QuickSight; using Amazon.QuickSight.Model; namespace GenerateGenerativeQnAEmbedUrlForAnonymousUser { class Program { static void Main(string[] args) { var quicksightClient = new AmazonQuickSightClient( AccessKey, SecretAccessKey, SessionToken, Amazon.RegionEndpoint.USEast1); try { AnonymousUserGenerativeQnAEmbeddingConfiguration anonymousUserGenerativeQnAEmbeddingConfiguration = new AnonymousUserGenerativeQnAEmbeddingConfiguration { InitialTopicId = "U4zJMVZ2n2stZflc8Ou3iKySEb3BEV6f" }; AnonymousUserEmbeddingExperienceConfiguration anonymousUserEmbeddingExperienceConfiguration = new AnonymousUserEmbeddingExperienceConfiguration { GenerativeQnA = anonymousUserGenerativeQnAEmbeddingConfiguration }; Console.WriteLine( quicksightClient.GenerateEmbedUrlForAnonymousUserAsync(new GenerateEmbedUrlForAnonymousUserRequest { AwsAccountId = "111122223333", Namespace = "DEFAULT", AuthorizedResourceArns '["topic-arn-topicId1","topic-arn-topicId2"]', AllowedDomains = allowedDomains, ExperienceConfiguration = anonymousUserEmbeddingExperienceConfiguration, SessionTags = '["Key": tag-key-1,"Value": tag-value-1,{"Key": tag-key-1,"Value": tag-value-1}]', SessionLifetimeInMinutes = 15, }).Result.EmbedUrl ); } catch (Exception ex) { Console.WriteLine(ex.Message); } } } }
To assume the role, choose one of the following Amazon Security Token Service (Amazon STS) API operations:
-
AssumeRole – Use this operation when you are using an IAM identity to assume the role.
-
AssumeRoleWithWebIdentity – Use this operation when you are using a web identity provider to authenticate your user.
-
AssumeRoleWithSaml – Use this operation when you are using SAML to authenticate your users.
The following example shows the CLI command to set the IAM role. The role
needs to have permissions enabled for
quicksight:GenerateEmbedUrlForAnonymousUser
.
aws sts assume-role \ --role-arn "
arn:aws:iam::111122223333:role/embedding_quicksight_generative_qna_role
" \ --role-session-nameanonymous caller
The assume-role
operation returns three output parameters: the
access key, the secret key, and the session token.
Note
If you get an ExpiredToken
error when calling the
AssumeRole
operation, this is probably because the
previous SESSION TOKEN
is still in the environment
variables. Clear this by setting the following variables:
-
AWS_ACCESS_KEY_ID
-
AWS_SECRET_ACCESS_KEY
-
AWS_SESSION_TOKEN
The following example shows how to set these three parameters in the
CLI. For a Microsoft Windows machine, use set
instead of
export
.
export AWS_ACCESS_KEY_ID = "
access_key_from_assume_role
" export AWS_SECRET_ACCESS_KEY = "secret_key_from_assume_role
" export AWS_SESSION_TOKEN = "session_token_from_assume_role
"
Running these commands sets the role session ID of the user visiting
your website to
embedding_quicksight_q_search_bar_role/QuickSightEmbeddingAnonymousPolicy
.
The role session ID is made up of the role name from role-arn
and the role-session-name
value. Using the unique role session
ID for each user ensures that appropriate permissions are set for each user.
It also prevents any throttling of user access. Throttling is a security feature that prevents the same user
from accessing QuickSight from multiple locations. In addition, it keeps each
session separate and distinct. If you're using an array of web servers, for
example for load balancing, and a session is reconnected to a different
server, a new session begins.
To get a signed URL for the dashboard, call generate-embed-url-for-anynymous-user
from the app server. This returns the embeddable dashboard URL. The following example shows how to generate the URL for an embedded dashboard using a server-side call for users who are making anonymous visits to your web portal or app.
aws quicksight generate-embed-url-for-anonymous-user \ --aws-account-id
111122223333
\ --namespacedefault-or-something-else
\ --authorized-resource-arns '["topic-arn-topicId
","topic-arn-topicId2
"]' \ --allowed-domains '["domain1
","domain2
"]' \ --experience-configuration 'GenerativeQnA={InitialTopicId="topicId1"}
' \ --session-tags '["Key": tag-key-1,"Value": tag-value-1,{"Key": tag-key-1,"Value": tag-value-1}]
' \ --session-lifetime-in-minutes15
For more information about using this operation, see GenerateEmbedUrlForAnonymousUser
Step 3: Embed the Generative Q&A experience URL
In the following section, you can find how to embed the Generative Q&A experience URL in your website or application page. You do this with the Amazon QuickSight
embedding SDK
-
Place the Generative Q&A experience on an HTML page.
-
Customize the layout and appearance of the embedded experience to fit your application needs.
-
Handle error states with messages that are customized to your application.
To generate the URL that you can embed in your app, call the
GenerateEmbedUrlForAnonymousUser
API operation. This URL is valid for
5 minutes, and the resulting session is valid for up to 10 hours. The API operation
provides the URL with an auth_code
value that enables a single-sign on
session.
The following shows an example response from generate-embed-url-for-anonymous-user
.
//The URL returned is over 900 characters. For this example, we've shortened the string for //readability and added ellipsis to indicate that it's incomplete.{ "Status": "200", "EmbedUrl": "https://quicksightdomain/embedding/12345/q/search...", "RequestId": "7bee030e-f191-45c4-97fe-d9faf0e03713" }
Embed the Generative Q&A experience in your webpage with the QuickSight
embedding SDK
Make sure that the domain to host the Generative Q&A experience is on the allow list, the list of approved domains for your QuickSight subscription. This requirement protects your data by keeping unapproved domains from hosting embedded Generative Q&A experiences. For more information about adding domains for an embedded Generative Q&A experience, see Managing domains and embedding.
You can use the QuickSight Embedding SDK to customize the layout and apperance of the embedded Generative Q&A experience to fit your application. Use the panelType
property to configure the landing state of the Generative Q&A experience when it renders in your application. Set the panelType
property to 'FULL'
to render the full Generative Q&A experience panel. This panel resembles the experience that QuickSight users have in the console. The frame height of the panel is not changed based on user interaction and respects the value that you set in the frameOptions.height
property. The image below shows the Generative Q&A experience panel that renders when you set the panelType
value to 'FULL'
.

Set the panelType
property to 'SEARCH_BAR'
to render the Generative Q&A experience as a search bar. This search bar resembles the way that the Q Search Bar renders when it is embedded into an application. The Generative Q&A search bar expands to a larger panel that displays topic selection options, the question suggestion list, the answer panel or the pinboard.
The default minimum height of the Generative Q&A search bar is rendered when the embedded asset loads. It is recommended that you set the frameOptions.height
value to "38px"
to optimize the search bar experience. Use the focusedHeight
property to set the optimal size of the topic selection dropdown and the question suggestion list. Use the expandedHeight
property to set the optimal size of the answer panel and pinboard. If you choose the 'SEARCH_BAR'
option, it is recommended that you style the parent container with position; absolute to avoid unwanted content shifting in your application. The image below shows the Generative Q&A experience search bar that renders when you set the panelType
value to 'SEARCH_BAR'
.

After you configure the panelType
property, use the QuickSight embedding SDK to customize the following properties of the Generative Q&A experience.
-
The title of the Generative Q&A panel (Applies only to the
panelType: FULL
option). -
The search bar's placeholder text.
-
Whether topic selection is allowed.
-
Whether topic names are shown or hidden.
-
Whether the Amazon Q icon is shown or hidden (Applies only to the
panelType: FULL
option). -
Whether the pinboard is shown of hidden.
-
Whether users can maximize the Genertaive Q&A panel to fullscreen.
-
The theme of the Generative Q&A panel. A custom theme ARN can be passed in the SDK to change the appearance of the frame's content. QuickSight starter themes are not supported for embedded Generative BI panels. To use a QuickSight starter theme, save it as a custom theme in QuickSight.
When you use the QuickSight Embedding SDK, the Generative Q&A experience on your page is dynamically resized based on the state. With the QuickSight Embedding SDK, you can also control parameters within the Generative Q&A experience and receive callbacks in terms of page load completion, state changes, and errors.
The following example shows how to use the generated URL. This code is generated on your app server.
<!DOCTYPE html> <html> <head> <title>Generative Q&A Embedding Example</title> <script src="https://unpkg.com/amazon-quicksight-embedding-sdk@2.7.0/dist/quicksight-embedding-js-sdk.min.js"></script> <script type="text/javascript"> const embedGenerativeQnA = async() => { const {createEmbeddingContext} = QuickSightEmbedding; const embeddingContext = await createEmbeddingContext({ onChange: (changeEvent, metadata) => { console.log('Context received a change', changeEvent, metadata); }, }); const frameOptions = { url: "<YOUR_EMBED_URL>", // replace this value with the url generated via embedding API container: '#experience-container', height: "700px", width: "1000px", onChange: (changeEvent, metadata) => { switch (changeEvent.eventName) { case 'FRAME_MOUNTED': { console.log("Do something when the experience frame is mounted."); break; } case 'FRAME_LOADED': { console.log("Do something when the experience frame is loaded."); break; } } }, }; const contentOptions = { // Optional panel settings. Default behavior is equivalent to {panelType: 'FULL'} panelOptions: { panelType: 'FULL', title: 'custom title', // Optional showQIcon: false, // Optional, Default: true }, // Use SEARCH_BAR panel type for the landing state to be similar to embedQSearchBar // with generative capability enabled topics /* panelOptions: { panelType: 'SEARCH_BAR', focusedHeight: '250px', expandedHeight: '500px', }, */ showTopicName: false, // Optional, Default: true showPinboard: false, // Optional, Default: true allowTopicSelection: false, // Optional, Default: true allowFullscreen: false, // Optional, Default: true searchPlaceholderText: "custom search placeholder", // Optional themeOptions: { // Optional themeArn: 'arn:aws:quicksight:<Region>:<Amazon-Account-ID>:theme/<Theme-ID>' } onMessage: async (messageEvent, experienceMetadata) => { switch (messageEvent.eventName) { case 'Q_SEARCH_OPENED': { // called when pinboard is shown / visuals are rendered console.log("Do something when SEARCH_BAR type panel is expanded"); break; } case 'Q_SEARCH_FOCUSED': { // called when question suggestions or topic selection dropdown are shown console.log("Do something when SEARCH_BAR type panel is focused"); break; } case 'Q_SEARCH_CLOSED': { // called when shrinked to initial bar height console.log("Do something when SEARCH_BAR type panel is collapsed"); break; } case 'Q_PANEL_ENTERED_FULLSCREEN': { console.log("Do something when panel enters full screen mode"); break; } case 'Q_PANEL_EXITED_FULLSCREEN': { console.log("Do something when panel exits full screen mode"); break; } case 'CONTENT_LOADED': { console.log("Do something after experience is loaded"); break; } case 'ERROR_OCCURRED': { console.log("Do something when experience fails to load"); break; } } } }; const embeddedGenerativeQnExperience = await embeddingContext.embedGenerativeQnA(frameOptions, contentOptions); }; </script> </head> <body onload="embedGenerativeQnA()"> <div id="experience-container"></div> </body> </html>
For this example to work, make sure to use the Amazon QuickSight Embedding SDK to load the embedded Generative Q&A experience on your website with JavaScript. To get your copy, do one of the following:
-
Download the Amazon QuickSight embedding SDK
from GitHub. This repository is maintained by a group of QuickSight developers. -
Download the latest embedding SDK version from https://www.npmjs.com/package/amazon-quicksight-embedding-sdk
. -
If you use
npm
for JavaScript dependencies, download and install it by running the following command.npm install amazon-quicksight-embedding-sdk
Optional embedded Generative Q&A experience functionalities
The following optional functionalities are available for the embedded Generative Q&A experience with the embedding SDK.
Invoke Generative Q&A search bar actions
-
Set a question — This feature sends a question to the Generative Q&A experience and immediately queries the question.
embeddedGenerativeQnExperience.setQuestion('
show me monthly revenue
'); -
Close the answer panel (applies to the Generative Q&A search bar option) — This feature closes the answer panel and returns the iframe to the original search bar state.
embeddedGenerativeQnExperience.close();
For more information, see the QuickSight embedding SDK