Amazon Quick ARNs: Cross-account migration and namespace permissions

This article explains how Amazon QuickSight ARNs work for cross-account migrations and multi-tenant namespace permissions, providing practical guidance for administrators.

• ARNs are account-bound; migrating resources changes the account ID portion even if resource IDs remain identical
• Permissions don't transfer during migration because they reference account-specific ARNs and must be re-established
• Asset Bundle APIs automatically update internal ARN references during import when dependencies are included
• OverrideParameters and OverridePermissions control data source mapping and access controls during import
• Namespaces affect principal ARNs (users/groups) but not asset ARNs (dashboards/datasets)
• Same username in different namespaces represents completely different principals with different ARNs
• Wildcard principal ARNs grant access to all current and future users within a namespace
• Cross-namespace sharing works because assets exist outside namespaces and can be shared with principals from multiple namespaces
• Utility functions provided for parsing, transforming, and constructing ARNs programmatically

Understanding ARN structure, account-binding, namespace isolation, and permission mechanics enables reliable cross-account migrations and multi-tenant architectures in Amazon QuickSight.