I have a use case where I need to send ~37 project-specific reports and email each project’s POC automatically. We planned to use dashboard snap job api for the getting the dashboard snapshot. However, I encountered below error :
aws: [ERROR]: An error occurred (AccessDeniedException) when calling the StartDashboardSnapshotJob operation: IdentityStore not found or unauthorized for account XX. Verify IdentityStore exists and credentials have proper permissions.
In AWS QuickSight Enterprise Edition, you can email reports from any sheet in a dashboard — not just pixel-perfect report sheets. This includes interactive dashboard sheets as well. You can configure schedules that define when to send them, what content to include, and who receives the emai.
QuickSight provides Snapshot Export APIs that allow you to programmatically generate and deliver dashboard snapshots to users who are not registered in QuickSight (anonymous/non-QuickSight users). The key APIs are :
StartDashboardSnapshotJob – Initiates a snapshot export job
DescribeDashboardSnapshotJob – Checks the status of the job
DescribeDashboardSnapshotJobResult – Retrieves the result
These APIs support exporting:
PDF format – for pixel-perfect report sheets
CSV and Excel formats – for data from tables and pivot tables
Method
Registered Users
Anonymous Users
Notes
Pixel Perfect Report Scheduling
Built-in email scheduling with RLS support
Interactive Sheet Email Reports
Schedule emails from any dashboard sheet
Snapshot Export APIs
Programmatic; requires custom app to handle email delivery
you may need to apply RLS /CLS in your dataset, to make sure user see only thoes data relevant to them.
This is confusing, I did try the StartDashboardSnapshotJob.
I was not able to do it for registered users , here is the error encountered.
aws: [ERROR]: An error occurred (ParamValidation): Parameter validation failed:
Unknown parameter in UserConfiguration: “RegisteredUsers”, must be one of: AnonymousUsers
I tried using with null anonymous user as provided in my previous message.
Error encountered : aws: [ERROR]: An error occurred (AccessDeniedException) when calling the StartDashboardSnapshotJob operation: IdentityStore not found or unauthorized for account XX. Verify IdentityStore exists and credentials have proper permissions.
Scheduling via dashboard is restricted to 5 schedules only, has this changed?
I have 37 project specific reports which needs to go out to users who are not registered in Quicksight.
Let me know if I can achieve the above goal without the Pixel perfect add on.
As Deep mentioned, the Pixel Perfect Report add-on is mandatory for the StartDashboardSnapshotJob API, and there’s no way around this requirement regardless of format (PDF, CSV, or Excel). To answer your question directly: no, you cannot achieve the snapshot-to-email workflow without it. The built-in scheduling UI is capped at 5 schedules per dashboard (this hasn’t changed), so for 37 project-specific reports to non-QuickSight users, the Snapshot Export API with a custom orchestration layer (Lambda + SES, for example) is the correct architecture, but it does require the add-on.
Regarding the RegisteredUsers parameter validation error, that’s expected. The API’s UserConfiguration only accepts AnonymousUsers as a key. Generating snapshots for registered users works differently: you use identity-enhanced IAM role session credentials and set UserConfiguration to null entirely. But since your recipients aren’t registered QuickSight users anyway, the AnonymousUsers path is the right one for your use case.
Now, for the actual blocker, the “IdentityStore not found or unauthorized” error. There are a few things to check. First, confirm you’re calling the API from the same AWS region where your QuickSight identity is configured. A region mismatch is a well-documented cause of this error. Second, verify that the IAM role making the call has identitystore:* permissions. Third, as Deep mentioned, confirm that session capacity pricing is enabled on your account, since it’s required for anonymous user access in QuickSight, and without it the anonymous namespace may not be properly configured. You can check both your identity region and pricing plan in the QuickSight admin console under “Manage QuickSight.”
Once you’ve confirmed session capacity pricing is active and verified the region alignment, the AnonymousUsers configuration you already have should work.
Just checking back in since this thread hasn’t received a response in a while. Was Jacob’s reply helpful to you and/or were you able to find a solution yourself in the meantime? Please help the community by marking this answer as “Solution” or following up in general within the next 3 business days!
Since I haven’t received any further updates from you, I’ll treat this inquiry as complete for now. If you have any additional questions, feel free to create a new post in the community and link this discussion for context.
