Automate user

As Amazon Quick environments scale and new AI-powered capabilities expand what users can do, automating user-level custom permissions becomes critical to maintaining the principle of least privilege. To address this, with custom permissions in Quick, you can enforce fine-grained access control by toggling specific features on or off for individual users. For example, with custom permissions, you can control access so that financial analysts author reports without exporting raw data, and external partners view dashboards without accessing sharing controls.

While Quick provides various options to apply custom permissions at the account, role, and user level, there are scenarios where your organization’s specific permissions need to be applied dynamically. This post walks through four architectural patterns to automate custom permissions assignment at key stages of the user lifecycle. The approaches range from a single API parameter to an event-driven automation, covering new users, future users, group-based logic, and retroactive bulk updates.

We will explore four scenarios to handle key stages of the user lifecycle:

Scenario 1: Pre-registered users (API and CLI)

If you have a custom onboarding portal that provisions users using the RegisterUser API, you don’t need complex automation. You can apply custom permissions during the creation of the Quick user by including the --custom-permissions-name parameter in your call.

When to use this approach: Your organization controls the user creation process end-to-end through a custom portal or script. This is the most direct path, no event-driven infrastructure required. This is especially common for software as a service (SaaS) companies embedding Quick across customer accounts. For instance, automatically restricting premium features like paginated reports and GenBI based on a customer’s pricing tier at the moment each user is provisioned.

The following example applies a custom permissions profile named Restricted-Author-Profile to Authors in the account, but the same API can be used to apply permissions profiles to any role (including Author Pros, Admins, Admin Pros, Readers, and Reader Pros).

Scenario 2: Default account or role permissions (API and CLI)

With two native APIs, you can set default custom permission profiles without per-user automation. Note that Quick custom permissions follow a three-level hierarchy (account, role, and user) where user-level settings override role-level, which override account-level, allowing administrators to implement flexible, layered security policies.

When to use this approach: These APIs cover both current and future use cases with minimal operational overhead. Start here before building custom automation. Move to Scenario 3 only if you need conditional logic beyond what account or role-level defaults support. For example, a 50,000-user enterprise may need all newly launched GenBI features and connectors blocked by default until their security team completes a 60–90-day review. An account-level default enforces that restriction instantly, without requiring any per-user automation and with no provisioning gap.

The UpdateAccountCustomPermission API sets a fallback custom permission profile that Quick applies to any user who doesn’t have an explicit profile assigned, including new users created with Just-In-Time provisioning.

With the UpdateRoleCustomPermission API, you can set a default custom permission profile per Quick role (READER, AUTHOR, ADMIN, and PRO roles).

Scenario 3: Event-driven custom logic (Amazon EventBridge and Lambda)

This scenario addresses more granular requirements: applying different custom permissions profiles to users based on which Quick or IAM Identity Center group they belong to. For example, a 125,000-employee technology services company needs authors in each business unit to receive distinct permission profiles at the moment of group assignment. This prevents cross-unit asset sharing while granting power-user access only to approved individuals, even though all authors share the same Quick role. Because we don’t have a native API for assigning custom permissions to a Group, we will need an architecture that detects when a user is added to a group that should have specific permissions.

Note: We suggest combining this approach with Scenario 2 for a fully layered permissions strategy. Scenarios 2 and 3 are complementary, not alternatives. When a user is provisioned through Just-In-Time federation, there’s an unavoidable window between account creation and the moment an administrator adds them to the appropriate group. Scenario 3 only fires on the group membership event.

To keep users from ever being in an unrestricted state, apply Scenario 2 first as a baseline: set an account-level or role-level default that enforces your most restrictive acceptable profile. Then use Scenario 3 to refine permissions once the user is assigned to a group. The user-level override from Scenario 3 will take precedence over the Scenario 2 default, so there is no conflict, only complementary layers of control.

Consider a global bank with more than 200,000 users, provisioned through single sign-on (SSO), that must block data export the instant an employee joins. Scenario 2 closes that gap immediately with a restrictive account-level default, and Scenario 3 refines permissions once the user is assigned to their compliance group. This prevents employees from downloading sensitive client data during the window between provisioning and group assignment.

Quick and IAM Identity Center emit distinct AWS CloudTrail events for group membership changes. Quick emits CreateGroupMembership when a user is added and DeleteGroupMembership when removed. IAM Identity Center emits AddMemberToGroup when a user is added and RemoveMemberFromGroup when removed. The following architecture detects these events to trigger permission updates automatically.

We will build this using Amazon EventBridge (to detect the event) and AWS Lambda (to apply the fix).

Figure 1: Event-driven architecture that applies a custom permission profile when a user is added to a Quick or IAM Identity Center group

Before implementing this solution, confirm you have the following:

You can deploy the full pipeline (IAM role, Lambda function, and Amazon EventBridge rule) using the provided CloudFormation template. The CloudFormation stack must be deployed in the same AWS Region as your Amazon Quick subscription, since Amazon EventBridge rules only capture events within their own Region.

The template accepts the following parameters:

The name of the group to apply custom permissions to. For Quick groups, this is the Quick group name. For IDC groups, this is the IDC group DisplayName.

Important: Each deployment targets either a Quick group or an IDC group, never both. To monitor both group types, deploy separate stacks.

If you prefer to deploy manually, follow these steps:

Your Lambda function needs permission to interact with Quick.

Now we must configure this function so that it runs only when a user is successfully added to a group.

Option B: Other Authentication (using Quick Groups)

To test this, add a user to a Group in Quick or IDC:

Group removal: This solution for Scenario 3 already handles removal events. When a user is removed from the target group, the Lambda calls DeleteUserCustomPermission, reverting them to the account or role-level default from Scenario 2. No additional configuration is needed.

Multi-group membership: Quick supports only one custom permissions profile per user at a time. If your organization assigns users to multiple groups with different profiles, you can extend the Lambda logic to list all groups the user belongs to, look up the profile mapped to each group, and apply the highest-priority profile (for example, the most restrictive profile). This multi-group conflict resolution isn’t included in the provided solution and must be implemented by your team based on your organization’s specific priority rules.

Scenario 4: Batch update for existing group members

You likely have existing groups (for example, “Finance-Readers” or “Marketing-Authors”) containing users who need specific restrictions applied retroactively. Because these users were created in the past, the Amazon EventBridge automation (Scenario 3) won’t catch them.

To fix this, we use a Python script to iterate through a specific Quick Group and apply the custom permission profile to every member.

Quick groups can contain thousands of users. The API ListGroupMemberships only returns 100 members at a time. If you write a script without pagination logic, it will stop after the first 100 users, leaving the rest unsecured. The following script handles this automatically using NextToken.

Copy the following code. You only need to edit the Configuration Section at the top.

Note: The default delay of 0.1 seconds between API calls (~10 requests/second) is suitable for most deployments. For large-scale groups (over 10,000 members), increase API_DELAY_SECONDS to avoid API throttling. Monitor for ThrottlingException errors in the output and adjust as needed for your environment.

If you deployed using the CloudFormation template, delete the stack to remove all resources it created, including the Amazon EventBridge rule, Lambda function, and associated IAM role and policy.

If you deployed manually, delete the following resources:

The batch update script (Scenario 4) does not deploy any infrastructure and requires no clean up.

Automating custom permissions in Amazon Quick is a foundational step toward a secure, scalable user governance strategy. As your Quick environment grows, the patterns in this post help verify that authentication and authorization scale together, not independently.

The following table summarizes the four scenarios and when to apply each:

One manual step remains in the Scenario 3 flow: an administrator must add each user to the appropriate group before the event-driven pipeline fires. You can remove this step entirely by extending the same Amazon EventBridge + Lambda architecture to listen for new user creation events.

When new users are provisioned through Just-In-Time federation, CloudTrail captures a CreateUser event (when Quick users are invited by admins, this produces a BatchCreateUser event). A Lambda function can intercept that event and apply custom logic to determine the correct group based on email domain, internal user mapping, or any available user attribute. It then calls CreateGroupMembership to assign the user to that group automatically.

Combined with Scenario 3, this approach can create a fully automated pipeline with no manual steps. A full implementation of this extension is beyond the scope of this post. However, the building blocks (CloudTrail event capture, Amazon EventBridge filtering, and Lambda-based Quick API calls) are identical to those described in Scenario 3.

Start with Scenario 2 to establish your baseline today. For more details, see Amazon Quick Custom Permissions in the Amazon Quick User Guide.