# Question for Quicksight Community about SPICE Security **URL:** \ **Category:** Q&A\ **Tags:** error, developer, quick-sight\ **Created:** [October 22, 2024, 4:26pm UTC](https://community.amazonquick.com/t/question-for-quicksight-community-about-spice-security/37318 "2024-10-22T16:26:36Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Awan](https://avatars.discourse-cdn.com/v4/letter/a/f1d935/32.png) [@Awan](https://community.amazonquick.com/u/Awan)\ **Post date:** [October 22, 2024, 4:26pm UTC](https://community.amazonquick.com/t/question-for-quicksight-community-about-spice-security/37318/1 "2024-10-22T16:26:36Z")
Recently I’m working on a project in Quick sight for a client. But the client wants the dashboard in Direct Query mode only. But using Direct Query will impact the performance, due to huge load the visuals will eventually fail to load. The client said “The SPICE stores the customer data for which they don’t have permission”. What I’m able to grasp is the spice will run the query and stores the data and this stored result will be used to compute calculated field or with filter selection it will make selection on result. It will not run query again and again like direct query. I want to know about the security issues of SPICE or are they myth. And also something about KMS was also mentioned in security concern with SPICE. ---
**Author:** ![Xclipse](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/xclipse/32/20455_2.png) [@Xclipse](https://community.amazonquick.com/u/Xclipse)\ **Post date:** [October 23, 2024, 3:50am UTC](https://community.amazonquick.com/t/question-for-quicksight-community-about-spice-security/37318/2 "2024-10-23T03:50:43Z")
Hi @Awan SPICE is designed with security as a top priority, incorporating several measures to ensure that stored data remains well-protected. To address security concerns, SPICE uses AWS KMS for encryption, and there is also the option to use **customer-managed keys** , offering an additional level of control over the encryption process. Please refer the below Quick Sight documentation and community post this might be helpful for you. It might be helpful to provide the client with information from Amazon’s official documentation regarding the encryption and security of SPICE datasets to help. > [@New Amazon QuickSight SPICE Customer Managed Keys (CMK) Feature](https://community.amazonquick.com/t/new-amazon-quicksight-spice-customer-managed-keys-cmk-feature/7991): > > [[QuickSight SPICE CMK Feature] ](https://www.youtube.com/watch?v=HG1h9O4wVac) Quick Sight now enables you to encrypt your SPICE datasets using the keys you have stored in the AWS Key Management Service. This provides you with the tools to audit access to data and satisfy regulatory security requirements. If you need to do so, you have the option to immediately lock down access to your data by revoking access to AWS KMS keys. All data access to encrypted datasets in Quick Sight SPICE is logged in AWS CloudTrail. Administrators or… > **[Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/)** > **[Best practices for security in Amazon QuickSight - Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/best-practices-security.html)** > > Learn about best practices for security in Amazon QuickSight. > **[Encrypting your QuickSight data with AWS Key Management Service...](https://docs.aws.amazon.com/quicksight/latest/user/customer-managed-keys.html)** > > Using a customer managed key in Amazon QuickSight. > **[AWS security in Amazon QuickSight - Amazon QuickSight](https://docs.aws.amazon.com/quicksight/latest/user/security.html)** > > Configure Amazon QuickSight to meet your security and compliance objectives, and learn how to use other AWS services that can help you to secure your Amazon QuickSight resources. Hope this helps! ---
**Author:** ![Awan](https://avatars.discourse-cdn.com/v4/letter/a/f1d935/32.png) [@Awan](https://community.amazonquick.com/u/Awan)\ **Post date:** [October 23, 2024, 6:55am UTC](https://community.amazonquick.com/t/question-for-quicksight-community-about-spice-security/37318/3 "2024-10-23T06:55:00Z")
What about direct query does it store result and does it work same as SPICE. Does Direct Query uses AWS KMS for encryption, or customer managed keys. ---
**Author:** ![Koushik\_Muthanna](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/koushik_muthanna/32/3290_2.png) [@Koushik\_Muthanna](https://community.amazonquick.com/u/Koushik_Muthanna)\ **Post date:** [October 23, 2024, 9:42am UTC](https://community.amazonquick.com/t/question-for-quicksight-community-about-spice-security/37318/4 "2024-10-23T09:42:37Z")
@Awan , For direct query, Quick Sight is querying the data source at the time of dashboard access to retrieve results and load the visuals. This also means, if a user changes a value for example in a filter, the data is queried again in the data source . The encryption of the data source is the responsibility of the customer . ---
**Author:** ![Awan](https://avatars.discourse-cdn.com/v4/letter/a/f1d935/32.png) [@Awan](https://community.amazonquick.com/u/Awan)\ **Post date:** [October 23, 2024, 9:50am UTC](https://community.amazonquick.com/t/question-for-quicksight-community-about-spice-security/37318/5 "2024-10-23T09:50:24Z")
Okay Thanks @Koushik_Muthanna @Xclipse