• 09 May 2025

Understanding Shared Folder Security Structure in Amazon QuickSight

Amazon QuickSight supports folder-based sharing, enabling collaboration across users and teams with built-in AWS security enforcement. Understanding how to manage folder access is essential for safeguarding sensitive business intelligence assets.

Folder Access Levels in Amazon QuickSight

Amazon QuickSight folders can be shared with one or more user groups. There are two primary access levels:

• Owner : Can manage all assets within the folder—dashboards, datasets, analyses, and subfolders.
• Viewer : Can view and interact with shared assets, but cannot edit or delete them.

Note: Permissions are enforced at the object level, ensuring secure and controlled access across dashboards and datasets.

Key Behaviors of Shared Folders

• Permission Inheritance :
  Assets placed inside a folder inherit the folder's permissions, provided the asset is owned by the same user or group that owns the folder.
• Private Assets :
  If a user adds an asset they own to a shared folder (owned by someone else), that asset becomes a private asset. It is visible to others but retains ownership and permissions of the original creator.
• Subfolder Visibility :
  When a subfolder is shared, users will see the parent folder path in their navigation, even if the parent folder itself was not directly shared.

Best Practices for Securing Shared Folders

1. Use Group-Based Sharing
   Share folders with IAM or QuickSight groups rather than individual users for simplified permission management.
2. Audit Folder Contents
   Periodically review who owns which assets inside shared folders to avoid confusion over inherited vs. private access rights.
3. Leverage AWS Identity & Access Management (IAM)
   Combine folder permissions with IAM policies to enforce broader organizational access control.
4. Avoid Unintentional Exposure
   Understand that adding personal or team-owned dashboards to a shared folder might make them visible, even if ownership remains private.

About DataTerrain

With over 300 clients across the United States, DataTerrain brings years of focused expertise in Amazon QuickSight deployment and governance. Our consultants work flexibly, without requiring long-term contracts, to help organizations enforce granular access control and maintain data integrity.