Unable to create AWS Quicksight embedded dashboard URL

Question

Scenario

1. I have a serverless react js app hosted in S3.
2. I am using Cognito for user authentication.
3. Configured the Cognito identity authenticated role with the quicksight:CreateUser permission.
4. I loaded data into Quicksight from data files in S3 and created a dashboard.

I am using the below code to create an embedded dashboard URL from my node js (v8.10) lambda function.

const AWS = require('aws-sdk');
var quicksight = new AWS.QuickSight({
    region: 'us-east-1'
});
return quicksight.getDashboardEmbedUrl({
                'AwsAccountId': 'XXXXX',
                'DashboardId': 'YYYYYYY',
                'IdentityType': 'IAM',
                'ResetDisabled': true,
                'SessionLifetimeInMinutes': 100,
                'UndoRedoDisabled': false
            }).promise().then((res) => {
                console.log('Response: ');
                console.log(res);
            }).catch((err) => {
                console.log('Error: ');
                console.log(err);
            })

**

I am getting the below error.

**

2019-01-15T17:48:42.496Z    cafaa35a-18ed-11e9-9e84-ad156518dcbe    { UnknownError: Forbidden
at Object.extractError (/var/task/node_modules/aws-sdk/lib/protocol/json.js:51:27)
at Request.extractError (/var/task/node_modules/aws-sdk/lib/protocol/rest_json.js:52:8)
at Request.callListeners (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
at Request.emit (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
at Request.emit (/var/task/node_modules/aws-sdk/lib/request.js:683:14)
at Request.transition (/var/task/node_modules/aws-sdk/lib/request.js:22:10)
at AcceptorStateMachine.runTo (/var/task/node_modules/aws-sdk/lib/state_machine.js:14:12)
at /var/task/node_modules/aws-sdk/lib/state_machine.js:26:10
at Request.<anonymous> (/var/task/node_modules/aws-sdk/lib/request.js:38:9)
at Request.<anonymous> (/var/task/node_modules/aws-sdk/lib/request.js:685:12)
message: 'Forbidden',
code: 'UnknownError',
statusCode: 403,
time: 2019-01-15T17:48:42.440Z,
requestId: 'XXXX',
retryable: false,
retryDelay: 1.6256019461018845 }


2019-01-15T17:48:42.938Z    cafaa35a-18ed-11e9-9e84-ad156518dcbe    Error: 
2019-01-15T17:48:42.938Z    cafaa35a-18ed-11e9-9e84-ad156518dcbe    { QuickSightUserNotFoundException: Could not find user information in QuickSight
at Object.extractError (/var/task/node_modules/aws-sdk/lib/protocol/json.js:51:27)
at Request.extractError (/var/task/node_modules/aws-sdk/lib/protocol/rest_json.js:52:8)
at Request.callListeners (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
at Request.emit (/var/task/node_modules/aws-sdk/lib/sequential_executor.js:78:10)
at Request.emit (/var/task/node_modules/aws-sdk/lib/request.js:683:14)
at Request.transition (/var/task/node_modules/aws-sdk/lib/request.js:22:10)
at AcceptorStateMachine.runTo (/var/task/node_modules/aws-sdk/lib/state_machine.js:14:12)
at /var/task/node_modules/aws-sdk/lib/state_machine.js:26:10
at Request.<anonymous> (/var/task/node_modules/aws-sdk/lib/request.js:38:9)
at Request.<anonymous> (/var/task/node_modules/aws-sdk/lib/request.js:685:12)
message: 'Could not find user information in QuickSight',
code: 'QuickSightUserNotFoundException',
time: 2019-01-15T17:48:42.938Z,
requestId: 'XXXXX,
statusCode: 412,
retryable: false,
retryDelay: 84.05706341238961 }

Any idea why this is coming ? Do i have to add the user in the quicksight portal as well ? I thought quick sight-cognito integration is plug and play.

Thanks in advance for help.

Answer 1

Refer the following thread which gives detailed procedure to programatically generate embedded URL.

How to get/generate aws quicksight secure dashboard url

Answer 2

Check out this sample repo. It's from Amazon engineers. Uses Cloudformation.

https://github.com/aws-samples/amazon-quicksight-embedding-sample

Answer 3

I had a similar problem, getting the QuickSightUserNotFoundException error.

I followed this post:

QuickSightUserNotFoundException When getting a AWS Quicksight embed URL with cognito user

Main point being "When registering the user the IdentityType has to be IAM but for getDashboardEmbedUrl it has to be type QUICKSIGHT and you need to pass UserArn which you can find in the response from registerUser"