📖 Simplify QuickSight Onboarding

[julialawrence]

User Story

I would like to simplify how we onboard users to QuickSight by shifting user creation from the AWS root account lambda to Control Panel

Value / Purpose

Will take onboarding from 5 steps to 2.

Useful Contacts

julialawrence, michaeljcollins, jamesstott

User Types

QuickSight Users

Hypothesis

If we implement this process, it will significantly speed up onboarding to QS users, as the current process is difficult for people to navigate.

Proposal

Proposal diagram:
https://mojdt.slack.com/archives/C06NFN4FMNG/p1736183448050609

1. Create a role in the MOJ Master account assumable by Control Panel dev and prod which allows creation of users in Identity Center and adding and removing them from Identity Center groups
2. Pre-create QuickSight groups in Identity Center which will hold readers, authors and admins (not currently used) and add them to QuickSight
3. When an AP admin adds a user to QuickSight via the Control Panel, the following process is kicked off:* User's entra identity is retrieved

• QuickSight toggle in CP is updated to offer the option of adding a user as a reader or an author
• Control Panel assumes the MOJ Master role
• CP creates the user in identity center if they don't already exist
• CP adds the user to the pre-created readers/authors group
• CP adds the user to the so-called holding group named azure-aws-sso-all-members

4. To offboard:

• User is removed from the quicksight group(s)
• Lambda will clean them up on the next run

Additional Information

Master account role information: https://mojdt.slack.com/archives/C06NFN4FMNG/p1736250687881559?thread_ts=1736183448.050609&cid=C06NFN4FMNG
Pre-created QuickSight group names:
"azure-aws-sso-analytical-platform-qs-readers"
"azure-aws-sso-analytical-platform-qs-authors"
"azure-aws-sso-analytical-platform-qs-admins"
Lambda code:
https://github.com/ministryofjustice/moj-terraform-scim-entra-id/blob/main/function/app.py

Definition of Done

• Documentation has been written / updated
• Role created and tested
• Control Panel reader/author toggle(s) added
• Backend process implemented