Forward Deployment of Amazon QuickSight Analytics in Air-Gapped Environments

The financial sector separates development and production networks in accordance with the Electronic Financial Supervision Regulations, controlling changes so they propagate only from lower to higher environments. The deployment path is fixed in one direction: RND → Dev → STG → PRD, and reverse deployments or direct modifications to higher environments are not permitted.

These controls are familiar for application code but pose challenging issues for Amazon QuickSight assets. Dashboards and analyses are not version-controlled as text like code but exist as state within each account, and account IDs and dataset IDs differ for each environment. Therefore, reflecting changes in higher environments requires a systematic approach to forward migration of assets while substituting references.

Resolving SMUS Restricted Folder Constraints

Integrating data analysis environments with Amazon SageMaker Unified Studio (SMUS) adds another constraint. The restricted folders created by SMUS projects do not accept the Assets-as-Bundle API import, which is the standard asset migration method for QuickSight. This is because resource-based deny policies are applied to the folders, blocking requests to add existing assets.

Consequently, assets can only be introduced by creating them anew within the folder, and referenced datasets must be passable datasets without explicit deny policies. Due to this constraint, migration is based on the Analysis Definition rather than a bundle containing all assets.

3-Step Deployment Process

The solution utilizes the aws quicksight CLI and a simple browser-based transformation tool (index.html). The entire process is divided into three steps.

• Step 1: Validation and Definition Export: Check for definition errors using describe-analysis-definition and export the analysis definition and theme ARN to a file.
• Step 2: Account and Dataset Substitution: Upload the definition to the browser tool and substitute the source account ID and dataset ID with target environment values. Since it operates solely within the browser without external servers, security is maintained.
• Step 3: Creation in Restricted Folders: Create or update analyses in restricted folders using create-analysis --folder-arns. If necessary, publish dashboards and promote to the next environment.

This approach automates the process via CI/CD to ensure consistent reflection of identical assets across each environment and secures audit traceability.