Hi Team,
I am exploring ways to achieve S3 folder access via Quicksight UI/Dashboard for the customers to download/access reports directly from a Quicksight dashboard rather than giving them access to the S3 folder directly.
Currently we are achieving this by setting up SFTP service from AWS Transfer Family. The customers can use tools like WinSCP to download the files using their credentials.
We explored the below 3 ways to achieve S3 folder access via Quicksight UI/Dashboard.
Method 1: API Gateway + Lambda Redirector: QuickSight Custom URL Action triggers a serverless backend to generate temporary S3 pre-signed URLs for direct file downloads.
Method 2: AWS Transfer Family Web App: QuickSight link directs users to a fully managed web portal utilizing S3 Access Grants/Logical Directories for carrier-isolated folder browsing.
Method 3: Embedded Storage Browser for S3: QuickSight Custom Visual Content iframe embeds the React-based aws-amplify/ui-react-storage component directly inside the dashboard for inline file management.
With the above details/methods,
(1) We would like to know if there are any other simpler/more secure ways to achieve the same other than the 3 we identified.
(2) From an AWS expert POV, what will be the Pros/Cons of the 3 methods we identified?
(3) From an AWS expert POV, which will be the best & secure option
Note: Each customers’ data is in sub-folders and the method we are going to implement (QS + AWS services) should be smart enough to show only the folders related to that customer and download them.
Looking forward for your advice.
Thanks!
Hi @sandeep.k,
Method 1 is the simplest to stand up and keeps customers away from AWS entirely, but it only really fits downloading known files. There’s no native folder browsing, and you own all the isolation risk. Method 2 is a fully managed file browser that enforces isolation through Access Grants and logical directories. It requires IAM Identity Center and opens in a separate tab rather than embedding, but it’s a natural step up from your existing SFTP setup with almost nothing to maintain. Method 3 offers the best experience and is also Access Grants-backed, but you take on React component building/configuration (plus handling authentication inside the iframe).
The alternative I’d add is to make S3 Access Grants (or per-carrier S3 Access Points) the isolation engine, independent of whichever front end you choose. AWS then enforces “this customer, this prefix only” by policy. This should be far easier to audit than Lambda logic and also satisfy your sub-folder requirement.
My recommendation is to back isolation with S3 Access Grants per carrier prefix in all cases, then pick the front end based on preference. I’d start with Method 2 for the fastest secure win with nothing to maintain, and move to Method 3 only if an embedded in-dashboard experience is more necessary. This approach also simplifies maintenance and gives you a clean audit trail through CloudTrail.
Hope this helps!
Hi Luis,
Thank you for your reply. Could you please share steps/documentation on how to achieve all the recommended points for implementing Method 3?
Also, other than the 3 methods, is there any other way that exists the can serve the same purpose?
Thanks!