Automate user-level custom permissions for Amazon Quick

This article presents four architectural patterns to automate custom permissions assignment for Amazon QuickSight users at different lifecycle stages, from pre-registration through retroactive batch updates.

• Pre-registered users: Apply permissions during user creation via RegisterUser API with custom-permissions-name parameter
• Account/role defaults: Use UpdateAccountCustomPermission and UpdateRoleCustomPermission APIs to set baseline profiles for all users
• Event-driven logic: Deploy EventBridge and Lambda to automatically apply permissions when users join Quick or IAM Identity Center groups
• Retroactive batch updates: Execute Python script to apply permissions to existing group members using pagination to handle thousands of users
• Layered approach: Combine Scenario 2 defaults with Scenario 3 event-driven logic to prevent unrestricted access windows during provisioning
• Handles both Quick native groups and IAM Identity Center groups with distinct CloudTrail event types

Organizations can implement these patterns incrementally, starting with account-level defaults and progressing to event-driven automation for granular, group-based permission management at scale.