Amazon QuickSight

By the end of this lesson you will be able to

• Explain what business intelligence (BI) is, where Amazon QuickSight sits at the end of an analytics pipeline, and which exam phrases point to it.
• Connect QuickSight to AWS sources (Athena, Redshift, RDS, Aurora, S3, OpenSearch, Timestream), on-premises databases, SaaS applications and uploaded files, including private databases through a VPC connection.
• Choose between importing data into SPICE and querying the source directly, and plan SPICE capacity and refreshes.
• Describe the path dataset → analysis → published dashboard → shared with users and groups, and why QuickSight users and groups are not IAM users and groups.
• Restrict rows and columns with row-level security (RLS) and column-level security (CLS), and know what each edition offers.
• Estimate QuickSight cost with per-user and capacity (session) pricing, and embed dashboards in your own application.

#Business intelligence and QuickSight

#What business intelligence is

Every business collects data in many places: orders in a database, clicks in an S3 data lake, leads in a CRM, call records on a telecom’s servers. Business intelligence (BI) is the last step that turns that data into answers people can act on: charts, dashboards, reports and alerts that a manager opens in a browser on Monday morning. The earlier lessons of this chapter store and query the data (Athena in lesson 17.1, Redshift in lesson 17.2); a BI tool sits on top of them and draws the picture. This is the OLAP side of the OLTP / OLAP split from lesson 16.1: reading many rows to summarise them, not writing one order at a time.

#What QuickSight is

Amazon QuickSight is AWS’s serverless, machine-learning-powered BI service for building interactive dashboards, charts and reports:

• Serverless and auto-scaling: there are no servers or BI clusters to size, patch or license. Ten readers or ten thousand, QuickSight scales for you.
• Fast: imported data is served from SPICE, an in-memory engine (explained below).
• Embeddable: a dashboard can be shown inside your own website or app.
• ML-powered insights: anomaly detection (an unusual drop in yesterday’s sales), forecasting (next quarter’s sales from the trend), and auto-narratives that describe a chart in sentences. Amazon Q in QuickSight adds natural-language questions (“sales by division last month”) and generative summaries.
• Pricing per user or per session: you pay for authors and readers, or for capacity measured in reader sessions, not for servers (details below).

Typical use cases: business analytics, building visualisations, ad-hoc analysis (“why did returns jump in Sylhet?”) and getting business insights from data the company already has.

#Data sources and how QuickSight reaches them

QuickSight does not store your raw data; it connects to where it already lives and either queries it each time or imports a copy into SPICE. A data source is the connection (endpoint, credentials, network path); a dataset is what you build on it (which table or SQL query, which columns, calculated fields, joins) and is what analyses use.

#Private databases: the VPC connection

QuickSight runs in AWS’s own network, outside your VPC. A database in a private subnet (the right place for it, chapter 3) has no public address, so QuickSight cannot reach it over the internet. The answer is a VPC connection (Enterprise edition): QuickSight places network interfaces (ENIs) in subnets you choose, with a security group you choose, and talks to the database’s private address through them. Allow the database port in the database’s security group from the VPC connection’s security group. On-premises databases work the same way: the VPC reaches the data centre over Site-to-Site VPN or Direct Connect, and QuickSight connects through the VPC connection.

The old alternative is to make the database publicly reachable and allow QuickSight’s published IP range for the Region in its security group. It works, but a private database with a VPC connection is the answer the exam prefers.

#Permissions to AWS sources

QuickSight calls Athena, reads S3 and lists Redshift clusters with its own service role, not with the permissions of the person clicking. An admin grants that access on QuickSight’s security and permissions page: tick Athena, tick each S3 bucket (including Athena’s query-result bucket), and choose the KMS keys QuickSight may use for encrypted data. A query that works in the Athena console but fails in QuickSight with access denied is almost always a bucket that was never ticked there. If the data lake is governed by Lake Formation, grant the QuickSight users or groups access to the tables and columns there (lesson 17.6).

#SPICE and direct query

#Two ways to get data into a dashboard

Every dataset uses one of two query modes:

• Direct query: QuickSight keeps no copy. Each time a visual is drawn, filtered or refreshed, it sends a query to the source. The data is always current, but every viewer’s every click becomes load (and, with Athena, cost) on the source, and the dashboard is only as fast as the source.
• Import into SPICE: QuickSight runs the dataset query once and stores the result in SPICE, the Super-fast, Parallel, In-memory Calculation Engine. SPICE is a columnar, in-memory store inside QuickSight, replicated for durability. Visuals are calculated from memory, so they are fast, and the source is not touched until the next refresh. SPICE is used only when data is imported; a direct-query dataset never uses it.

#SPICE capacity

SPICE is bought per GB per month. In Enterprise edition each Author brings 10 GB (an Author Pro gets a 10 GB credit), and extra capacity costs about $0.38 per GB-month; it can be added or released at any time. Capacity is shared by the whole account in a Region. When it runs out, a new import fails while existing datasets keep working: buy more, delete unused datasets, or import fewer columns and rows (only the last 90 days, only the columns the visuals use).

#Refreshing SPICE

SPICE data is a snapshot, so it must be refreshed:

• Full refresh replaces the whole copy. Schedules: daily, weekly or monthly in both editions, and hourly in Enterprise edition. Up to five schedules per dataset in the console; scheduled refreshes start within 10 minutes of the chosen time.
• Incremental refresh (Enterprise edition, SQL sources such as Athena, Redshift and RDS) re-reads only the rows inside a look-back window on a date column, for example the last two days, and can run every 15 or 30 minutes.
• On demand: press “Refresh now”, or call the CreateIngestion API from the end of a data pipeline, for example from a Lambda function after a Glue job finishes, so the dashboard is fresh exactly when new data lands (lesson 17.8). Triggering refreshes from code requires capacity pricing.

When a refresh fails (a renamed column, a dropped table, an expired password, a source that times out), SPICE keeps the last successful copy: the dashboard keeps working but shows old numbers, and, if the dataset’s “email owners when a refresh fails” option is on, QuickSight emails the owner. Showing a “last refreshed” time on important dashboards makes stale data visible.

#Analyses, dashboards, users and groups

#From dataset to dashboard

QuickSight separates building from reading:

1. A dataset prepares the data (source, columns, joins, calculated fields, SPICE or direct query).
2. An analysis is the author’s workspace: visuals, filters, parameters, controls, themes. Only authors can create or edit analyses.
3. Publishing an analysis creates a dashboard: a read-only snapshot of the analysis that preserves its configuration, the filters, parameters, controls and sort order as the author set them. Readers can use the controls the author left (choose a month, drill down, export a visual if allowed) but cannot change the visuals.
4. The dashboard is shared with users or groups. To share a dashboard, you must first publish it.

Editing the analysis does not change the dashboard: readers see the change only after the author publishes again (QuickSight keeps earlier versions, so the owner can roll back). You can also share an analysis, but that makes people co-authors who can change it; share analyses with fellow authors and dashboards with readers.

Users who can see a dashboard can also see the underlying data used by its visuals (for example by exporting or drilling down). A filter on a dashboard is not security. If some rows or columns are not for everyone, use row-level or column-level security on the dataset.

QuickSight can also email a dashboard as a scheduled report (as PDF or in the body), send threshold alerts (“tell me when daily returns pass 500”), and produce paginated reports for print-style output.

#Users, groups and roles

QuickSight has its own users and groups. They exist only within QuickSight, not in IAM: an IAM user, even an administrator, cannot open QuickSight until a QuickSight user is registered for them, and an IAM group cannot be picked when sharing a dashboard.

• Identity: users can sign in with their IAM identity (the QuickSight user is linked to it), through IAM Identity Center or another SAML identity provider (single sign-on), with Active Directory (Enterprise edition), or as QuickSight-native users invited by email.
• Roles: Admin, Author (connects data, builds analyses, publishes), Reader (views and interacts with dashboards), plus Author Pro and Reader Pro with the generative AI features.
• Groups: collections of QuickSight users used for sharing and for RLS rules. Groups are available in Enterprise edition (standard edition has users only). Share with groups, not people: a new branch manager then gets every dashboard by joining one group.
• Namespaces (Enterprise) separate users and groups into isolated sets, for example one per customer in a multi-tenant SaaS product.

#Row-level and column-level security

#Row-level security (RLS)

Row-level security lets one dashboard serve many audiences, each seeing only its own rows. It is an Enterprise edition feature. You create a rules dataset (also called a permissions dataset) with:

• one column that identifies users or groups (user name or group name, or their ARNs), and
• one column per field to filter on, holding the allowed values. A blank value means all values.

You attach the rules dataset to the data dataset. From then on QuickSight adds the matching rules as filters to every query for that viewer, in SPICE or direct query, before any visual is calculated: totals, exports and drill-downs contain only allowed rows. Rules to remember:

• A user or group with no matching rule sees no rows: RLS fails closed.
• Dataset owners see everything; RLS restricts the people the dataset is shared with.
• RLS filters text fields (not numbers or dates).
• A rules dataset kept in a database through direct query updates as soon as the table changes; a file-based one must be re-uploaded.
• For anonymous embedded users (who have no QuickSight user name), use tag-based RLS: the application passes session tags (buyer = B17) when it requests the embed URL, and the dataset matches rows on them.

#Column-level security (CLS)

Column-level security (also Enterprise edition) restricts columns of a dataset to specific users or groups: salary, a customer’s phone number, a national ID. For everyone else the column is not available: they cannot add it to visuals, and visuals that use it show as restricted. RLS removes rows; CLS removes columns; a dataset can use both.

QuickSight RLS and CLS protect data inside QuickSight. If the same data must also be restricted for people who query it with Athena, Redshift Spectrum or EMR, define the row and column permissions once in Lake Formation, and QuickSight users querying through Athena get the same restrictions (lesson 17.6).

#Editions and pricing

#Standard and Enterprise editions

Standard edition is now offered only through the API (CreateAccountSubscription) at about $9 per user per month on an annual plan. The exam’s point is simple: CLS (and RLS, groups, VPC connections) need Enterprise edition.

#Prices (Enterprise edition, October 2026)

Worked example: the shop has 3 authors and 40 managers who read dashboards: 3 × $24 + 40 × $3 = $192 per month, with 30 GB of SPICE included. If the shop instead embeds a dashboard for 20,000 sellers on its marketplace, per-user pricing would mean 20,000 × $3 = $60,000 a month even though most sellers look once a week; capacity pricing charges per 30-minute session actually used, which is why the exam links QuickSight with “per-session pricing” for large or occasional audiences.

#Embedding dashboards in an application

A dashboard (or a single visual, or the Q search bar) can run inside your own website or app, for customers or partners who never see the QuickSight console:

• Registered-user embedding: for people who are already QuickSight users (internal staff on an intranet). Your backend calls GenerateEmbedUrlForRegisteredUser; the session runs as that user, with their sharing and RLS.
• Anonymous embedding: for many external users with no QuickSight account (customers in a portal, citizens on a public site). Your backend calls GenerateEmbedUrlForAnonymousUser with the dashboard ARNs, optional session tags for tag-based RLS and allowed domains. It needs capacity pricing: you pay per session, not per viewer.

How it works and what goes wrong: the embed URL carries a one-time token valid for 5 minutes, and the session it opens lasts 15 minutes to 10 hours (default 10). Generate a fresh URL on the server for every page load; a cached URL fails. The page’s domain must be on QuickSight’s domain allow list (or passed in the call, up to three), otherwise the iframe refuses to render, which stops other sites from framing your dashboards. Session tags are security credentials: set them only on the server, never from values the browser sends.

#Security and operations

• Access: QuickSight users and groups, roles (Admin, Author, Reader), sharing per dashboard and dataset, RLS and CLS. IAM policies control who can administer QuickSight and call its API (quicksight:* actions).
• Network: VPC connections keep traffic to private sources inside your network instead of opening databases to the internet.
• Encryption: data in SPICE is encrypted at rest (with an AWS-owned key, or your own KMS customer managed key, in either edition); connections use TLS.
• Audit: QuickSight API calls and console actions (creating data sources and datasets, sharing dashboards, requesting embed URLs) are recorded in CloudTrail (chapter 19). SPICE ingestion status is visible per dataset and through the API.

#What goes wrong

• A data source to a private database times out: there is no VPC connection, or the database’s security group does not allow the VPC connection’s security group. Do not make the database public.
• Athena works in the console, QuickSight says access denied: QuickSight’s service role was never granted the S3 bucket (or Athena’s result bucket, or the KMS key) on its security and permissions page, or Lake Formation has no grant for the QuickSight user.
• Dashboards are slow and the Athena bill climbs: datasets use direct query on Athena and every reader’s click runs a scan. Import into SPICE and refresh on a schedule.
• Numbers are a day old and nobody noticed: a SPICE refresh failed (schema change, expired credentials) and SPICE kept the last good copy. Watch the failure emails and show the refresh time.
• An import fails for lack of SPICE: buy capacity, remove unused datasets, import fewer rows or columns, or use direct query for that table.
• Readers do not see the new chart: the analysis was saved but the dashboard was not published again.
• An administrator cannot open QuickSight, or an IAM group is missing in the share dialog: QuickSight users and groups are separate from IAM; register the user and use QuickSight groups.
• A branch manager sees every branch: the dataset has no RLS (or a copy was made without the rules dataset). A dashboard filter is not security.
• A new employee sees empty charts: RLS is on and no rule exists for their user or group.
• CLS or RLS is “missing” from the menu: the account is on Standard edition.
• An embedded dashboard shows an error: the page’s domain is not allowed, or the embed URL was reused after 5 minutes; anonymous embedding without capacity pricing fails too.

#QuickSight in system design

Common patterns:

• Data lake BI: S3 → Glue Data Catalog → Athena → QuickSight (SPICE). The serverless analytics stack: nothing to manage end to end.
• Data warehouse BI: many sources → Redshift → QuickSight, often in direct query because Redshift is built for many concurrent analytical queries, or SPICE for the most-viewed dashboards.
• Operational database reporting: RDS or Aurora → QuickSight through a VPC connection, importing into SPICE so reports do not slow the production database (or point it at a read replica, chapter 7).
• Customer-facing analytics: a SaaS product embeds dashboards for each tenant with anonymous embedding, session tags for tag-based RLS and capacity pricing.
• The end of the big data ingestion pipeline: IoT → Kinesis → Firehose → S3 → Athena → QuickSight (lesson 17.8).

When QuickSight is the wrong choice: operational metrics and alarms of servers and applications belong in CloudWatch dashboards (chapter 19) or Grafana; searching and exploring logs belongs in OpenSearch Dashboards (lesson 17.3); running SQL belongs in Athena or Redshift, which QuickSight only queries; real-time decisions per event belong in stream processing.

#Try it yourself

These commands use the AWS CLI v2 against an account that already has a QuickSight Enterprise subscription in ap-southeast-1. Account ID 111122223333 is a placeholder. QuickSight charges per user and per GB of SPICE, so delete what you create.

# 1. Register a reader (a QuickSight user, separate from IAM) and create a group
aws quicksight register-user --aws-account-id 111122223333 --namespace default \
  --identity-type QUICKSIGHT --user-role READER \
  --email dhaka.manager@example.com --user-name dhaka-manager
# { "User": { "Arn": "arn:aws:quicksight:ap-southeast-1:111122223333:user/default/dhaka-manager",
#             "Role": "READER", "IdentityType": "QUICKSIGHT", "Active": false, ... },
#   "UserInvitationUrl": "https://quicksight.aws.amazon.com/sn/console/signup?..." }

aws quicksight create-group --aws-account-id 111122223333 --namespace default \
  --group-name Dhaka-Managers --description "Branch managers, Dhaka region"
aws quicksight create-group-membership --aws-account-id 111122223333 --namespace default \
  --group-name Dhaka-Managers --member-name dhaka-manager

# 2. Create an Athena data source (QuickSight’s role must be allowed the S3 buckets)
aws quicksight create-data-source --aws-account-id 111122223333 \
  --data-source-id athena-sales --name "Athena sales" --type ATHENA \
  --data-source-parameters '{"AthenaParameters":{"WorkGroup":"primary"}}'
# { "Arn": "arn:aws:quicksight:ap-southeast-1:111122223333:datasource/athena-sales",
#   "CreationStatus": "CREATION_IN_PROGRESS", "Status": 202 }

# 3. After creating a SPICE dataset on it (console or create-data-set with ImportMode SPICE),
#    start a refresh and check it
aws quicksight create-ingestion --aws-account-id 111122223333 \
  --data-set-id sales-2026 --ingestion-id refresh-2026-10-30-0600
aws quicksight describe-ingestion --aws-account-id 111122223333 \
  --data-set-id sales-2026 --ingestion-id refresh-2026-10-30-0600 \
  --query 'Ingestion.[IngestionStatus,RowInfo.RowsIngested,ErrorInfo]'
# [ "COMPLETED", 1843201, null ]
# A failed refresh looks like: [ "FAILED", null, { "Type": "SQL_EXCEPTION", "Message": "..." } ]

# 4. Share a published dashboard with the group (read-only actions)
aws quicksight update-dashboard-permissions --aws-account-id 111122223333 \
  --dashboard-id month-end-sales --grant-permissions \
  'Principal=arn:aws:quicksight:ap-southeast-1:111122223333:group/default/Dhaka-Managers,Actions=quicksight:DescribeDashboard,quicksight:ListDashboardVersions,quicksight:QueryDashboard'

# 5. Embed it for an anonymous portal visitor (needs capacity pricing), with a session tag for RLS
aws quicksight generate-embed-url-for-anonymous-user --aws-account-id 111122223333 \
  --namespace default --session-lifetime-in-minutes 60 \
  --authorized-resource-arns arn:aws:quicksight:ap-southeast-1:111122223333:dashboard/buyer-orders \
  --experience-configuration '{"Dashboard":{"InitialDashboardId":"buyer-orders"}}' \
  --session-tags Key=buyer,Value=B17 --allowed-domains https://portal.example.com
# { "EmbedUrl": "https://ap-southeast-1.quicksight.aws.amazon.com/embed/...", "Status": 200,
#   "AnonymousUserArn": "arn:aws:quicksight:ap-southeast-1:111122223333:user/default/..." }
# The URL works once, within 5 minutes.

# 6. Clean up
aws quicksight delete-group --aws-account-id 111122223333 --namespace default --group-name Dhaka-Managers
aws quicksight delete-user --aws-account-id 111122223333 --namespace default --user-name dhaka-manager

Also try in the console: upload a small CSV of sales into SPICE, build an analysis with a bar chart and a filter control, publish it, then add a rules CSV (GroupName,Region with one row per group) as row-level security on the dataset and open the dashboard as a reader in another browser.

#Summary

Key takeaways

• QuickSight = AWS’s serverless, ML-powered BI service for interactive dashboards; fast, auto-scaling, embeddable, priced per user or per session. Use cases: business analytics, visualisations, ad-hoc analysis, business insights. Since 2025 it is part of Amazon Quick (Quick Sight); the exam and the API still say QuickSight.
• Sources: RDS, Aurora, Redshift, Athena, S3, OpenSearch, Timestream; JDBC databases on premises; SaaS (Salesforce, Jira…); files (Excel, CSV, TSV, JSON, ELF/CLF logs). Private databases need a VPC connection; AWS sources need QuickSight’s service role to be granted the buckets.
• SPICE = Super-fast, Parallel, In-memory Calculation Engine, used when data is imported: fast, offloads the source, fresh only as of the last refresh. Direct query: always current, as fast as the source. “Thousand times faster” is not an AWS figure.
• SPICE: 10 GB per Author, about $0.38 per extra GB-month; refresh daily/weekly/monthly, hourly (Enterprise), incremental every 15 minutes (Enterprise, SQL sources), or on demand via CreateIngestion. A failed refresh keeps the old copy.
• Analysis (editable workspace) → publish → dashboard (read-only snapshot that keeps filters, parameters, controls, sort) → share with users or groups. You must publish before sharing; republish to update. Dashboard viewers can see the underlying data.
• QuickSight users and groups exist only in QuickSight, not IAM. Groups need Enterprise edition.
• RLS (Enterprise): rules dataset of users/groups → allowed values; blank = all; no rule = no rows; owners see all; tag-based RLS for anonymous embedding. CLS (Enterprise): restrict columns to some users or groups.
• Pricing: Author $24, Reader $3, Pro roles $40 / $20, capacity pricing per 30-minute session for large audiences and anonymous embedding.
• Embedding: registered-user or anonymous (capacity pricing, session tags); URL valid 5 minutes, one use; domain allow list.

Self-check: Amazon QuickSight30 questions