AWS quicksight documentation change
Summary
Expanded opt-out instructions for Amazon Q in QuickSight with detailed steps to remove Pro users, topics, and disable indexing/Q&A features
Security assessment
The changes provide detailed access control procedures but focus on billing/feature opt-out rather than addressing security vulnerabilities
Diff
diff --git a/quicksight/latest/user/generative-bi-opt-out.md b/quicksight/latest/user/generative-bi-opt-out.md index 804f7fb39..cf61181b6 100644 --- a//quicksight/latest/user/generative-bi-opt-out.md +++ b//quicksight/latest/user/generative-bi-opt-out.md @@ -7 +7,86 @@ -To opt out of Amazon Q in QuickSight, remove all Pro users and topics from your account. For more information about removing users from a QuickSight account, see [Managing user access inside Amazon QuickSight](./managing-users.html). To delete a topic from your account, use the [DeleteTopic](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteTopic.html) API or navigate to the topic in the **Topics** page of the QuickSight console and choose **Delete**. +QuickSight accounts are charged if Amazon Q in QuickSight is active in the account. Amazon Q in QuickSight is considered active if your account uses any of the following capabilities: + + * Pro users + + * Topics + + * Dashboard and visual indexing + + * Dashboard Q&A + + + + +To avoid being charged for Amazon Q in QuickSight by completely deactivating it, perform the following steps. + +###### Note + +If your QuickSight account was subscribed to QuickSight Q before 4/30/2024 and you want to opt out of the QuickSight Q add-on, contact your account team and request to migrate your account to the new pricing model. After your account is migrated to the new pricing model, perform the following steps. For more information about QuickSight pricing, see [Amazon QuickSight Pricing](https://aws.amazon.com/quicksight/pricing/). + +###### To opt out of Amazon Q in QuickSight + + 1. Ensure there are no Pro users or user groups mapped to Pro roles in the account by performing the following steps: + + * To update or remove Pro users using APIs: + + * If you use QuickSight identity (with or without IAM federation): + + 1. Find users that have Pro roles using the [ListUsers](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListUsers.html) API. + + 2. Either change the users' roles using the [UpdateUser](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateUser.html) API, or remove the users from the account using the [DeleteUser](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteUser.html) API. + + * If you use IAM Identity Center or Microsoft Active Directory: + + 1. Find group of users mapped to Pro roles using the [ListRoleMemberships](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListRoleMemberships.html) API. + + 2. Create new user groups with the same users, but mapped to different roles, using the [CreateRoleMemberships](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_CreateRoleMemberships.html) API. + + 3. Delete the previous user groups mapped to Pro roles using the [DeleteRoleMemberships](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteRoleMemberships.html) API. + + * To update or remove Pro users using the QuickSight console: + + 1. Open the [QuickSight console](https://quicksight.aws.amazon.com/). + + 2. Choose the profile icon, then choose **Manage QuickSight**. + + 3. If necessary, in the left navigation pane, choose **Manage users**. + + * If you use QuickSight identity (with or without IAM federation), update user roles or delete users using the steps in [Viewing Amazon QuickSight account details](./view-user-accounts.html) or [Deleting a QuickSight user account](./delete-a-user-account.html). + + * If you use IAM Identity Center or Microsoft Active Directory, update group and role mappings or delete user groups using the steps in [Managing user access](./view-user-accounts-enterprise.html). + + 2. Ensure there are no topics in the account by performing the following steps: + + 1. Use the [ListTopics](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_ListTopics.html) API to list all topics in the account for each AWS Region where topics are used. + + 2. For each topic, do one of the following: + + * If you are an owner or co-owner of the topics, delete the topics using the [DeleteTopic](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteTopic.html) API. + + * If you're not an owner or co-owner of the topics: + + * Identify the owners of each topic using the [DescribeTopicPermissions](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DescribeTopicPermissions.html) API, then ask them to delete their topics using the [DeleteTopic](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteTopic.html) API. + + * Make yourself a co-owner of the topics using the [UpdateTopicPermissions](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateTopicPermissions.html) API , then delete the topics using the [DeleteTopic](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_DeleteTopic.html) API. + + 3. Ensure that dashboard and visual indexing and Dashboard Q&A are disabled by performing the following steps: + + * To disable dashboard and visual indexing and Dashboard Q&A using APIs: + + 1. Disable dashboard and visual indexing using the [UpdateQuickSightQSearchConfiguration](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateQuickSightQSearchConfiguration.html) API. + + 2. Disable Dashboard Q&A using the [UpdateDashboardsQAConfiguration](https://docs.aws.amazon.com/quicksight/latest/APIReference/API_UpdateDashboardsQAConfiguration.html) API. + + * To disable dashboard and visual indexing and Dashboard Q&A using the QuickSight console: + + 1. Open the [QuickSight console](https://quicksight.aws.amazon.com/). + + 2. Choose the profile icon, then choose **Manage QuickSight**. + + 3. In the left navigation pane, choose **Security & permissions**. + + 4. In **Amazon Q** , choose **Manage**. + + 5. Disable each of the options. + + @@ -9 +93,0 @@ To opt out of Amazon Q in QuickSight, remove all Pro users and topics from your -If your QuickSight account was subscribed to QuickSight Q before 4/30/2024 and you want to opt out of the QuickSight Q add-on, contact your account team and request to migrate your account to the new pricing model. Once your account is migrated to the new pricing model, delete all topics and Pro users from your account. For more information about QuickSight pricing, see [Amazon QuickSight Pricing](https://aws.amazon.com/quicksight/pricing/).