Optional ReadonlyawsAWS managed policy names to attach (e.g. service-role/AWSQuicksightAthenaAccess for Athena
connectivity). Names are used rather than full ARNs because AWS-managed policies live in the
aws account and are never cross-account, matching the awsManagedPolicies convention in the
roles module. Only this module can attach AWS-managed policies, since it owns the role.
Data-source-specific S3/KMS grants are NOT configured here — those reference resources
(e.g. the Athena results bucket and its KMS key) that are created by other modules which
deploy after this one, so they are attached by the consuming data source module
(@aws-mdaa/quicksight-project) instead.
Use cases: Athena API + query-results access via the AWS-managed policy
AWS: AWS managed policies attached to the QuickSight resource-access role
Validation: Optional; array of AWS managed policy names
Optional ReadonlycustomerExisting customer-managed policy names to attach to the QuickSight resource-access role.
Because QuickSight discovers this role by its fixed name (aws-quicksight-service-role-v0)
and will only assume a role with that exact identity, the role cannot be swapped for a
customer-supplied one; scoped least-privilege permissions must therefore be attached to it as
customer-managed policies. Author the policy in the roles module (or out-of-band) and
reference it here by name — matching the customerManagedPolicies convention in that module.
Attachment is by the policy's deployed name, so the policy must already exist when this module deploys.
Use cases: Granting scoped Athena metadata access (e.g. athena:GetTableMetadata, athena:ListTableMetadata on a specific data catalog) without attaching a broad AWS-managed policy
AWS: Customer-managed policies attached to the QuickSight resource-access role
Validation: Optional; array of existing customer-managed policy names
Permissions to attach to QuickSight's account-level resource-access service role so that QuickSight data sources can reach the underlying AWS resources (Athena, S3, KMS).
QuickSight assumes a single account-wide role (
aws-quicksight-service-role-v0, created by this module) to access AWS services on your behalf. Because this module owns the role — and because QuickSight discovers it by its fixed name and will only assume a role with that exact identity (so it cannot be swapped for a customer-supplied role) — this module attaches both AWS-managed policies (e.g. AWSQuicksightAthenaAccess) and customer-managed policies (for scoped least-privilege grants) to it here.Use cases: Granting an Athena data source access to its workgroup results bucket and the KMS-encrypted data lake it queries, or scoped Athena metadata access via a customer-managed policy
AWS: AWS-managed and customer-managed policies attached to the QuickSight resource-access role
Validation: all sub-properties optional