Optional ReadonlykmsKMS key ARNs the data source must use to decrypt KMS-encrypted data and query results.
Use cases: Decrypting KMS-encrypted data lake objects and Athena results
AWS: IAM KMS permissions on the QuickSight resource-access role
Validation: Optional; array of KMS key ARNs
Optional Readonlys3S3 bucket ARNs the data source must read (and write, for Athena query results). Grants List/Get on the buckets and their objects, plus Put for query results.
Use cases: Data lake bucket access; Athena query-results bucket access
AWS: IAM S3 permissions on the QuickSight resource-access role
Validation: Optional; array of S3 bucket ARNs (arn:aws:s3:::bucket-name)
Customer-managed S3/KMS permissions to attach to QuickSight's account-level resource-access role so this project's data sources can read the data they query.
The role itself (typically
aws-quicksight-service-role-v0) is created by the@aws-mdaa/quicksight-accountmodule, which also attaches any AWS-managed policies (it owns the role). This module attaches the data-source-specific S3/KMS grants as a customer-managed policy on the (imported) role, since only the data source knows which buckets/keys it needs and those references resolve only after the data lake / Athena modules deploy.Use cases: Granting an Athena data source read/write on its results bucket and decrypt on the KMS-encrypted data lake it queries
AWS: IAM ManagedPolicy attached to the QuickSight resource-access role
Validation: all fields optional. The role is always the standard QuickSight resource-access role (aws-quicksight-service-role-v0), so it is not configurable here.