The new serverless pattern generates per‑user embed URLs for individual Amazon QuickSight visuals directly from a React front‑end that authenticates with Amazon Cognito. Practitioners gain fine‑grained access control without building separate dashboards or managing manual token exchanges.
Solution Overview
The flow consists of four distinct layers:
- Front‑end: A React application is stored in an Amazon S3 bucket and delivered via Amazon CloudFront. AWS WAF sits in front of CloudFront to filter malicious traffic.
- Authentication: Amazon Cognito User Pools handle sign‑in and issue JSON Web Tokens (
JWT) that are validated by downstream services. - Backend: An Amazon API Gateway endpoint, protected by a Cognito authorizer, forwards authenticated calls to an AWS Lambda function. The function assumes a dedicated IAM role and invokes the QuickSight
GenerateEmbedUrlForRegisteredUserAPI to obtain a time‑scoped embed URL for the requested visual. Execution details are recorded in Amazon CloudWatch. - Analytics: The QuickSight visual is rendered in the browser using the QuickSight Embedding SDK. The QuickSight account must list the CloudFront domain in its embedding allowlist, otherwise the iframe is blocked.
User Synchronization and Role Enforcement
Each Cognito user must also exist as a registered QuickSight user. The Lambda function extracts the user’s email from the validated JWT and calls describe_user. If the call raises ResourceNotFoundException, the function registers the user with register_user as a READER, the least‑privileged role that supports visual embedding. This on‑demand provisioning removes any manual user‑management step.
Operational Considerations
The entire solution can be deployed with a single AWS CloudFormation stack, reducing setup time. Embed URLs have an extended validity period, which limits the frequency of re‑authentication during a user session. CloudWatch provides visibility into Lambda invocations, errors, and latency, enabling operators to set alarms or dashboards for health monitoring.
Security Implications
Authorization is enforced at three points: Cognito validates the user identity, the API Gateway authorizer ensures only authenticated calls reach Lambda, and QuickSight enforces the READER role for the generated embed URL. The IAM role assumed by Lambda limits permissions to the specific QuickSight API call. WAF adds a network‑edge protection layer, and the domain allowlist in QuickSight prevents unauthorized origins from loading the visual.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
- Adopt the four‑layer serverless pattern to replace ad‑hoc dashboard embedding with per‑visual control.
- Leverage Cognito‑driven user provisioning to keep QuickSight user accounts in sync automatically.
- Monitor Lambda execution via CloudWatch to detect provisioning failures or latency spikes.
- Validate that the CloudFront domain is present in the QuickSight allowlist before rollout to avoid iframe rendering errors.
- Review the IAM role policy to ensure it grants only the required QuickSight actions.