# QuickSight Project configuration using Secrets Manager authentication.
# Use this variant when you want a Redshift (or other credential-pair) data
# source to authenticate with a Secrets Manager secret instead of IAM.
# Setting secretsManager both wires the secret as the data source credentials
# and grants QuickSight's account-level Secrets Manager role
# (aws-quicksight-secretsmanager-role-v0) read access to the secret.

# Named QuickSight principals (users or groups) referenced in folder and
# data source permissions. Each key is a logical name, value is the
# QuickSight principal ARN.
principals:
  Lob1_AUTHORS_GROUP: 'arn:{{partition}}:quicksight:{{region}}:{{account}}:group/lob1-qs-ns/lob1-qs-ns-AUTHORS'

# (Optional) Nested map of data source type to data source configurations
# for QuickSight project data connectivity. Outer key is the data source
# type (e.g., REDSHIFT, ATHENA), inner key is a unique data source ID.
dataSources:
  REDSHIFT:
    datasource-secretsmanager:
      # Type-specific connection parameters
      dataSourceSpecificParameters:
        redshiftParameters:
          # Target database within the cluster
          database: 'default_db'
          # Redshift cluster identifier the data source connects to
          clusterId: 'sample-datawarehouse'
      # A display name for the data source
      displayName: 'sampleRedshiftSecretsManager'
      # (Optional) Secrets Manager authentication. The single toggle for the
      # secret-based auth path; the QuickSight Secrets Manager role and all IAM
      # wiring are handled automatically.
      secretsManager:
        # ARN of the Secrets Manager secret holding the data source credentials
        arn: 'arn:{{partition}}:secretsmanager:{{region}}:{{account}}:secret:sample-datawarehouse-serviceuser'
        # (Optional) KMS key ARNs encrypting the secret; QuickSight's Secrets
        # Manager role is granted decrypt on these for CMK-encrypted secrets
        kmsKeyArns:
          - 'arn:{{partition}}:kms:{{region}}:{{account}}:key/sample-secret-key-id'
      # A list of resource permissions on the data source
      permissions:
        - actions: 'AUTHOR_DATA_SOURCE'
          # The Amazon Resource Name (ARN) of the principal
          principal: 'Lob1_AUTHORS_GROUP'