Configuring the VPC connection with the QuickSight CLI

Prerequisites

• Before you begin, make sure that you have the following information available to copy and paste into the VPC Connection page. For more information, see Finding information to connect to a VPC.

  • Amazon Web Services Region – The Amazon Web Services Region where you plan to create a connection to your data source.

  • VPC ID – The ID of the VPC that contains the data, the subnets, and the security groups that you plan to use.

  • Execution role– An IAM role that contains a trust policy that allows QuickSight to create, update, and delete network infrastructure in your account. This policy is required for all VPC connections. At minimum, the IAM policy needs the following Amazon EC2 permissions:

    • DescribeSecurityGroups

    • DescribeSubnets

    • CreateNetworkInterface

    • DeleteNetworkInterface

    • ModifyNetworkInterfaceAttribute

    The following example shows an IAM policy that you can add to an existing IAM role to create, delete, or modify a VPC connection:

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "ec2:CreateNetworkInterface",
                    "ec2:ModifyNetworkInterfaceAttribute",
                    "ec2:DeleteNetworkInterface",
                    "ec2:DescribeSubnets",
                    "ec2:DescribeSecurityGroups"
                ],
                "Resource": "*"
            }
        ]
    }

    After you add the necessary permissions to an IAM role, attach a trust policy to allow QuickSight to configure the VPC connection to your account. The following shows an example trust policy that you can add to an existing IAM role to allow QuickSight access to the role:

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": "quicksight.amazonaws.com"
          },
          "Action": "sts:AssumeRole"
        }
      ]
    }

  • Subnet IDs – The IDs of the subnets that the QuickSight network interface is using. Each VPC connection needs at least two subnets.

  • Security group IDs – The IDs of the security groups. Each VPC connection needs at least one security group.