Q0 Cheat sheet — platform foundations

Verified 2026-08-09. Pricing figures are from an Oct 2025 announcement and are illustrative only — get current numbers from Amazon Quick pricing.

The naming rule

Search in "Quick". Write in quicksight.

You see	You type
Amazon Quick / Quick Suite	—
Amazon Quick Sight (the BI feature)	`quicksight`
docs `/quick/…`, `/quicksuite/…`, `/quicksight/…`	endpoint `quicksight.<region>.amazonaws.com`
	CLI `aws quicksight …` · IAM `quicksight:*`
	ARN `arn:aws:quicksight:…` · API version `2018-04-01`
	Service Quotas code `quicksight`

⚠️ aws quick, quick:*, arn:aws:quick:… do not exist. Renamed 2025-10-09; APIs unchanged.

Three doc trees are live simultaneously — /quicksight/latest/user/, /quick/latest/userguide/, /quicksuite/latest/userguide/. Not redirects. Cite full URLs + a date.

Editions — this is an architecture decision

Capability	Standard	Enterprise
VPC / on-premises sources	❌	✅
Encryption at rest	❌	✅
Row-level & column-level security	❌	✅
Hourly refresh · incremental refresh	❌	✅
ML / narrative insights	❌	✅
Emailed reports	❌	✅
Rows per SPICE dataset	25 M	2 B
Size per SPICE dataset	25 GB	2 TB
`CreateIngestion` calls / 24h	8	32

⚠️ Private VPC data + Standard = cannot connect. Multi-tenancy + Standard = impossible (no RLS).

Subscriptions and roles

Subscription	Role	~Price/mo
Amazon Quick Enterprise	Author Pro / Admin Pro	$40
Amazon Quick Professional	Reader Pro	$20
(BI only)	Author / Admin	$24
(BI only)	Reader	$3

Admin is not a separate seat — it's an Author (or Author Pro) with admin rights. ⚠️ $250/month infrastructure fee for Pro users or active Topics / Dashboard Q&A. A monthly floor, not per user.

Admin rights are split — know which half you have

Action	IAM permissions	Quick admin role
Manage assets · Security & permissions	✅	❌
VPC connections · KMS keys · Account settings	✅	❌
Account customization · Subscriptions · Mobile	❌	✅
Domains and embedding	❌	✅
SPICE capacity	❌	✅
Manage users	✅ (IdC users)	✅ (Quick + IAM users)

⚠️ AdministratorAccess in IAM cannot buy SPICE capacity. Being paged for refresh failures means you need the Quick admin role.

Identity

Signup options: (Recommended) Password-based or Single-Sign On · IAM Identity Center · Single-Sign On Only · Active Directory. Trial: 25 users / 30 days.

	IdC / Active Directory	Quick + IAM users
Administer	Groups → roles	Individual users
Leavers	Flow through from directory	Manual, forever

⚠️ Whether the auth method can be changed post-signup is not documented — treat as permanent. ⚠️ AWS Organizations SCP deny can block signup and will look like a Quick bug. Test with the IAM policy simulator. ⚠️ Notification email receives service and usage notices — point it at a distribution list. Encryption at rest is on by default (AWS-managed keys); CMK is a post-signup, IAM-side change.

Regions

⚠️ Two independent Region selectors. Opening Quick from the AWS console lands you in the last Region you used inside Quick, not the console's Region.

Read the Region from the URL: https://us-east-1.quicksight.aws.amazon.com/sn/admin Always pass --region on the CLI. 404 ResourceNotFoundException ⇒ suspect the Region first.

Region-scoped	Account-scoped
Data sources, datasets, analyses, dashboards, SPICE capacity	Users, roles, account name, notification email

No move-between-Regions operation — promote via asset export/import (Q7). Choose the Region your data is in.

7 Regions have an API endpoint but no entry in the "QuickSight Websites" table: af-south-1, ap-southeast-3, ap-southeast-5, eu-south-1, eu-south-2, eu-central-2, sa-east-1. Verify before committing.

The asset hierarchy

DATA SOURCE ──▶ DATASET ──▶ ANALYSIS ──▶ DASHBOARD
connection      shaped data   authors      readers
+ credentials   SPICE/direct

Data source = reusable connection state. ⚠️ No connection info is saved for text/Excel uploads — those can never be refreshed (S3_UPLOADED_FILE_DELETED).
Dataset = where every decision that costs money is made. Only dataset changes affect SPICE size. Saving one triggers an ingestion (RequestType: EDIT).
Analysis = authoring surface. Can use multiple datasets.
Dashboard = published, shared independently. Dashboard access ≠ analysis access.

Console	CLI	ARN
Data source	`data-source`	`…:datasource/<id>`
Dataset	`data-set`	`…:dataset/<id>`
Analysis	`analysis`	`…:analysis/<id>`
Dashboard	`dashboard`	`…:dashboard/<id>`

⚠️ CLI hyphenates (data-set), ARNs don't (dataset).

Audit an inherited account in 60 seconds

ACC=111122223333; REG=us-east-1
aws quicksight describe-account-settings --aws-account-id $ACC --region $REG
aws quicksight list-users --aws-account-id $ACC --namespace default --region $REG \
  --query 'UserList[].{Name:UserName,Role:Role,Active:Active}' --output table
aws quicksight list-data-sets --aws-account-id $ACC --region $REG \
  --query 'DataSetSummaries[].{Id:DataSetId,Name:Name,Mode:ImportMode}' --output table
aws quicksight list-dashboards --aws-account-id $ACC --region $REG \
  --query 'DashboardSummaryList[].{Id:DashboardId,Name:Name}' --output table

ImportMode is the highest-value column you can read: SPICE vs DIRECT_QUERY for everything.