Optional ReadonlyawsAWS managed policy names to attach (e.g. service-role/AWSQuicksightAthenaAccess for Athena
connectivity). Names are used rather than full ARNs because AWS-managed policies live in the
aws account and are never cross-account, matching the awsManagedPolicies convention in the
roles module. Only this module can attach AWS-managed policies, since it owns the role.
Data-source-specific S3/KMS grants are NOT configured here — those reference resources
(e.g. the Athena results bucket and its KMS key) that are created by other modules which
deploy after this one, so they are attached by the consuming data source module
(@aws-mdaa/quicksight-project) instead.
Use cases: Athena API + query-results access via the AWS-managed policy
AWS: AWS managed policies attached to the QuickSight resource-access role
Validation: Optional; array of AWS managed policy names
Permissions to attach to QuickSight's account-level resource-access service role so that QuickSight data sources can reach the underlying AWS resources (Athena, S3, KMS).
QuickSight assumes a single account-wide role (
aws-quicksight-service-role-v0, created by this module) to access AWS services on your behalf. Because this module owns the role, it attaches both the AWS-managed policies (e.g. AWSQuicksightAthenaAccess) and a dedicated customer-managed policy scoping S3/KMS access to the configured resources.Use cases: Granting an Athena data source access to its workgroup results bucket and the KMS-encrypted data lake it queries
AWS: AWS-managed policies plus an IAM ManagedPolicy attached to the QuickSight resource-access role
Validation: all sub-properties optional