December 2022
Cloud Intelligence Dashboards (CID) helps you to visualize and understand AWS cost and usage data in your organization by exploring interactive dashboards. To simplify access for users you can now set up an SSO application for them to enter into. We recommend combining this with the Row Level Security customization to ensure they see the data they really matters to them.
For this solution you must have the following:
Login into your Cost Account where your CID is deployed and go into Amazon QuickSight
Select your CID and open it
On the top right click on the Share icon then Share Dashboard
Share your CID Dashboard in Amazon QuickSight with all users by clicking on the toggle Everyone in this account
Copy the Dashboard URL to somewhere local as we will use this later
Open the IAM Identity Centre. Click on Groups on the left then Create group
Under Group name, give the name CID then click Create group
Click on Users then Add user
Fill out the details using the same email that will be used for Amazon QuickSight. Click Next.
Click on the box next to the CID group you made earlier. Then Click Next.
Scroll down and click Add user
Open the IAM Identity Centre and select Applications on the left and Click Add application
Search in Preintegrated applications for Amazon Quicksight then click Next
Type a Display name Billing Dashboard. Under IAM Identity Center metadata Download IAM Identity Center SAML metadata file.
Under Application properties paste your CID Link under Relay state. Click Submit
Click into your application and slick Assign Users
Click on the Groups tab and select the CID group the click the Assign Users button
note: This step is done in the target account where the CID lives, this may differ from the SSO account.
Open IAM, on the left click Identity providers then click the Add provider button
Under Provider type choose SAML, give it the name QuickSightProvider then upload the SAML file you downloaded earlier using the Choose file button. Click Add provider
Click into your new provider
Click the button Assign role and choose Create a new role and click Next
Ensure SAML 2.0 federation is clicked at the top the click the Allow programmatic and AWS Management Console access radio button and click Next: Permissions
Click Create policy
Select the JSON tab and past in the below code replacing your ACCOUNT_ID with your CID account ID. Click Next:Tags
{
"Statement": [
{
"Action": [
"quicksight:CreateReader"
],
"Effect": "Allow",
"Resource": [
"*"
]
}
],
"Version": "2012-10-17"
}
Click through Next:Review
For Name call it QuickSightSAMLPolicy then click Create Policy
Go back to previous IAM tab to attach permissions, refresh the list then search for QuickSightSAMLPolicy and click the tick box. Click Next:Tags, Next:Review
Provide a Role name as QuickSightSAMLRole and click Create role
Search for your new role and click into it. Select the Trust relationships tab and click Edit trust policy
Replace the json with the below, replacing your ACCOUNT_ID with your CID account ID.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::ACCOUNT_ID:saml-provider/QuickSightProvider"
},
"Action": "sts:AssumeRoleWithSAML",
"Condition": {
"StringEquals": {
"SAML:aud": "https://signin.aws.amazon.com/saml"
}
}
},
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::ACCOUNT_ID:saml-provider/QuickSightProvider"
},
"Action": "sts:TagSession",
"Condition": {
"StringLike": {
"aws:RequestTag/Email": "*"
}
}
}
]
}
Return to your IAM Identity Center and find your Amazon Quicksight application for CID and click into it.
Click the Actions button and select Edit attribute mapping
Add two new mappings by clicking on Add new attribute mapping, replacing your ACCOUNT_ID with your CID account ID