Amazon Quick ARNs: Why Dashboard Permissions Break Across Accounts
Migrating dashboards? Your ARN changes, and permissions vanish—here's why.
Amazon Quick, the unified AI-powered BI service, relies on Amazon Resource Names (ARNs) to uniquely identify every resource. Think of an ARN as a postal address: it includes a planet (AWS partition), country (service), state (region), city (account ID), street (resource type), and house number (resource ID). When you migrate a dashboard from a development account to production, the account ID in the ARN changes — just like moving to a new city changes your address. This means the dashboard in production is a completely different resource, even if it has the same resource ID.
In practice, AnyCompany uses three accounts: Development (111111111111), QA (222222222222), and Production (333333333333). Saanvi builds a sales dashboard in Development with ARN ending in "dashboard/sales-dash-001". When she migrates it to QA using the Asset Bundle APIs, the ARN changes to include the QA account ID (222222222222). The permissions she granted to the DataAnalysts group in the Development account are lost because they reference the old ARN. Amazon Quick stores permissions as relationships between resource ARNs and principal ARNs — both must exist in the same account. This explains why cross-account migration requires re-applying permissions or using namespace-based isolation strategies.
- ARNs include the AWS account ID, so migrating resources across accounts creates entirely new ARNs, even with identical resource IDs.
- Permissions are stored as relationships between specific resource ARNs and principal ARNs, so they do not survive Asset Bundle migrations.
- Administrators must explicitly re-grant permissions in the target account or adopt namespace-based isolation to manage multi-tenant access.
Why It Matters
Understanding ARN structure is critical for error-free cross-account BI deployments and avoiding silent permission failures.