Downgrading user roles in Amazon Quick

← AI for Your Work

WebCrimp analysis and practical explanation. AI-assisted; reviewed before publication.

Quick Summary

Amazon QuickSight does not allow direct role downgrades from Admin or Author to Reader. Administrators must either delete and recreate the user or use the AWS CLI to step down through intermediate roles (Admin → Author → Restricted Reader → Reader) while transferring asset ownership first.

What Happened?

When a user's responsibilities change and they no longer need authoring or admin rights, their role must be reduced to follow the principle of least privilege and control costs. Direct downgrade via the QuickSight console or UpdateUser API is blocked, requiring a multi‑step process.

Why It Matters

Proper role downgrading minimizes security exposure, avoids unnecessary licensing fees for Author/Admin seats, and prevents orphaned dashboards or datasets when users leave or change teams.

Who Can Use It?

Data Analytics · Business · Management · Cloud · DevOps · Software Development

How Can I Use This?

If you work in Data Analytics, Business, Management, Cloud, DevOps, Software Development

• Data analysts can run the CLI script to batch‑downgrade users after verifying asset transfers; Cloud administrators can schedule monthly role‑review workflows; Business managers can use the bulk asset transfer tool to reassign dashboards before role changes.

AI Tip

Always export a CSV of users to be downgraded and load it into the CLI script to avoid hardcoding emails.

AI Trick

Use AWS CloudShell so the –region flag is optional, simplifying the CLI commands.

Example Workflow

1. 1. Transfer ownership of all dashboards, datasets, and analyses to another admin or group. 2. If using console: delete the user, then recreate with Reader role. 3. If using AWS CLI: run update‑user in sequence AUTHOR → RESTRICTED_READER → READER for each user. 4. Verify the new role and confirm the user can only view content. 5. Review and adjust any Limit Profiles or Custom Permissions that may still be attached.

Copy This Prompt

Downgrade the QuickSight user {{username}} with email {{email}} from Admin to Reader using the AWS CLI step‑down method, assuming AWS account ID {{account_id}} and region {{region}}.

Recommended Tools

• AWS CLI
• AWS CloudShell
• Amazon QuickSight console
• CSV file editor

Check official documentation, availability and pricing before using these suggestions.

Difficulty

Intermediate

Estimated Time Saved

Not measured; validate with your own workflow.

Source

AWS AI
Downgrading user roles in Amazon Quick
Original publication date: 2026-10-05T15:51:38+00:00