Using aws cognito with quicksight

Question

Pulumi · Accepted Answer

When integrating AWS Cognito with QuickSight, the general idea is to set up a Cognito User Pool and configure AWS QuickSight to use that user pool for authentication. This allows users authenticated through Cognito to access QuickSight dashboards and analyses.

Below is a Pulumi program that outlines the necessary steps for setting up an AWS Cognito User Pool and a QuickSight user using AWS and QuickSight Pulumi resources. In a typical scenario, you would also need to create a QuickSight dashboard or analysis and provide access to the QuickSight user, but for simplicity, this example only includes the setup for authentication integration.

First, we'll create a Cognito User Pool and a User Pool Client. Next, we'll add a QuickSight user who is authenticated through the Cognito User Pool. Note that this program assumes that a QuickSight account is already set up and configured in your AWS account.

Please be aware that specific setups like enabling QuickSight for your account, granting explicit permissions, and actual dashboard creation are beyond this example and require manual steps through the QuickSight console or additional AWS API calls.

```typescript
import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";

// Create an AWS Cognito User Pool.
const userPool = new aws.cognito.UserPool("myUserPool", {
    // Configuration parameters for the User Pool...
    // You can customize attributes, schema, policies, and so on.
});

// Create an AWS Cognito User Pool Client.
const userPoolClient = new aws.cognito.UserPoolClient("myUserPoolClient", {
    userPoolId: userPool.id,
    // Configuration parameters for the User Pool Client...
    // You would typically set callback URLs, allowed OAuth flows, etc.
});

// Assume that the QuickSight user's email and role are provided.
// In a real-world scenario, these should be replaced with actual values.
const quickSightUserEmail = "example-user@example.com";
const quickSightUserRole = "READER"; // Other possible roles include "AUTHOR" and "ADMIN".

// Create a QuickSight user linked to the Cognito User Pool.
const quickSightUser = new aws.quicksight.User("myQuickSightUser", {
    email: quickSightUserEmail,
    identityType: "IAM", // For Cognito-based authentication, set to "QUICKSIGHT".
    awsAccountId: aws.config.accountId, // Use the AWS account ID from the configuration.
    namespace: "default", // The default namespace used for QuickSight.
    userName: userPoolClient.id,
    userRole: quickSightUserRole, // The role assigned to the QuickSight user.
    // More configuration parameters can be set if needed...
});

// Outputs - Useful for retrieving values and using them in other parts of your stack.
export const userPoolId = userPool.id;
export const userPoolClientId = userPoolClient.id;
export const quickSightUserName = quickSightUser.userName;

```
This Pulumi program defines the necessary resources and links them for AWS Cognito and QuickSight integration. The `aws.quicksight.User` resource is configured with `identityType` set to `QUICKSIGHT`, which indicates that the QuickSight user authentication is managed outside of AWS using your Cognito User Pool. The `userRole` can be set to `READER`, `AUTHOR`, or `ADMIN`, depending on the required level of access.

Remember to replace placeholder values with actual information appropriate for your situation, and ensure that your AWS and Pulumi configurations are set up correctly to create these resources. Additional configurations for the Cognito User Pool and User Pool Client can be set by adding properties to their respective Pulumi resource declarations.