Amazon QuickSight の BI アセットに対するバックアップ戦略の実装方法

Amazon Quick Sight is a core feature within Amazon Quick — an agentic, AI-powered digital workspace designed to maximize end-user productivity— that provides AI-powered BI capabilities through natural language queries, interactive dashboards, and embedded analytics from trusted enterprise data sources.

Amazon Quick Sight assets such as dashboards, analyses, datasets, and data sources can be backed up using the AssetsAsBundle APIs described in this post. A backup strategy helps protect against accidental deletions, unintended modifications, and regional disruptions. For teams that rely on Quick Sight to support critical business decisions, a well-designed backup plan is recommended.

This post is the first in a two-part series covering backup and restore for Amazon Quick Sight BI assets:

• Part 1 (this post): Covers how to design and implement a backup strategy, including asset selection, the APIs available for export, and a ready-to-use sample automation tool.

• Part 2: Covers the restore process. You can use the backups created in Part 1 to recover assets after accidental deletion, unintended changes, or as part of a broader disaster recovery plan.

An effective backup strategy is especially critical for organizations in heavily regulated industries such as financial services, healthcare, and energy, for multiple reasons:

• Data loss prevention protects against human errors, accidental deletions, and events like ransomware.

• Meeting recovery objectives helps organizations achieve their Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO), minimizing data loss during incidents.

• Audit and reporting supports tracking and reporting on assets throughout their lifecycle (creation, updates, and deletion).

• Increased workload resiliency enables quick restoration of systems to previous states, reducing downtime and improving reliability. This aligns with the Reliability pillar of the AWS Well-Architected Framework.

• Disaster recovery (DR) preparedness provides a foundation for implementing a DR process that anticipates technology-related disasters and contributes to your organization’s business continuity plan (BCP).

For more information about the disaster recovery capabilities of Quick, and how to assess them against organizational requirements, see the Amazon Quick disaster recovery and resiliency guide.

In this post, we cover best practices for implementing an effective backup strategy for BI assets in Quick Sight. We start by covering the options for selecting the assets to include in your backup, then explain the high-level APIs available for that purpose, and finalize with sample code to help you get started quickly.

Backup practices for business intelligence

BI systems present unique business continuity challenges because of their role in supporting decision-making processes and key stakeholders. You must protect them against service disruptions by implementing an effective backup plan. Before building this plan, it’s important to understand the architecture and the dimensions to consider as part of your DR plan.

The preceding diagram shows that Quick Sight relies on AWS’s global infrastructure across multiple AWS Regions to provide high availability for Quick Sight assets, including data sources, datasets, analyses, and dashboards.

The Super-fast, Parallel, In-memory Calculation Engine (SPICE) stores and encrypts imported data with high availability (HA) through redundant copies across multiple Availability Zones (AZs) within the Quick Sight Region.

With this regional design, you can maintain resources in multiple Regions and use a secondary Region in the unlikely event of a regional outage affecting your primary BI resources.

For *user and identity management*, Quick Sight uses a single Region that you define during the initial account subscription process. The diagram shows that this Region hosts user and group identity information and must be available for users to access Quick Sight.

For example, if a user wants to access a dashboard in the eu-west-1 Region but the Quick Sight main Region is us-east-1, both Regions must be available to finish the user access flow. Quick Sight uses regional architecture with AZs for redundancy. However, if your business needs protection against the unlikely event of a regional outage, you must design your disaster recovery (DR) strategy accordingly.

Tip: If you’re unsure of your Quick Sight main Region, you can retrieve this information by running the following command:

aws quicksight describe-account-settings --aws-account-id XXXXXXXXXXXX --region us-east-1

Note: This aws quicksight describe-account-settings command specifies us-east-1 as the endpoint Region. If you receive a 200 status, your identity Region is us-east-1. Otherwise, you receive an error like the following, which instructs you to point to your current identity Region (for example, eu-west-1):

An error occurred (AccessDeniedException) when calling the DescribeAccountSettings operation: Operation is being called from endpoint us-east-1, but your identity region is us-east-1. Please use the eu-west-1 endpoint.

Defining Quick Sight assets to include in the backup plan

With a clearer understanding of Quick Sight architecture, the next step is selecting the assets to include in your backup plan, for this you can follow two strategies:

Back up specific assets:

This option is suitable when you define a backup or DR strategy focused on protecting critical assets for your business operations that you can conveniently restore after a disaster or accidental deletion. This includes specific dashboards (and their dependent assets) that key stakeholders use to make business decisions or that operating teams (finance, logistics, procurement, and so on) use to support continued business operation.

This option is recommended when you require a straightforward backup plan and when the BI assets that are key to business continuity are a subset of all the assets available in your Quick Sight instance.

Back up all assets:

This strategy is recommended when you want to define a backup strategy that covers both versioning and potential disaster recovery. By backing up all assets, you can perform in-place rollback of any asset to a previous state if a human error causes an unintended modification or deletion. Additionally, because you have a backup of all assets in your account, you can select specific assets to restore as part of your DR plan.

This approach gives you maximum coverage but also requires more complex orchestration and automation. This post focuses on this strategy and provides sample code that you can adapt to minimize time to production.

After you select your strategy, choose the type of BI assets to export. Quick Sight offers the following asset types:

• Dashboards: Read-only assets targeted at reader users, published from an analysis. You can also save a dashboard to an analysis to make edits.

• Analyses and dashboards: An analysis is an editable version of a dashboard. Only the authors you choose can access it.

• Data sources: A data source implements the connection to your data, which can come from analytic sources such as databases or data warehouses, AWS services such as Amazon Simple Storage Service (Amazon S3), or third-party software as a service (SaaS) data providers such as Jira and ServiceNow.

• Datasets: An asset type that uses a data source to access external data that you can use to prepare and structure the data that powers your analyses and dashboards.

• VPC connections: A feature that you can use to integrate with your VPC resources such as databases and data warehouses that are located in that VPC or reachable from it (peered VPCs or networks connected through VPN or AWS Direct Connect).

• Themes: A collection of styling and appearance settings that you can apply to multiple analyses and dashboards to match an aesthetic standard that meets your product or corporate branding needs.

All these assets have dependencies between each other, with analyses and dashboards at the top of this dependency chain, as the following diagram illustrates.

When you choose the asset types to back up, be aware of these dependencies so you can fully restore assets from the backup. For example, when you back up a dashboard, you also need to back up its dependencies, which might include datasets, data sources, VPC connections, and a theme. The next sections explain how Quick Sight export APIs handle these dependencies.

Backup process overview

The mechanism we cover in this post uses the AssetsAsBundle APIs available in Quick Sight. AssetsAsBundle APIs (also referenced as AAB APIs) are a set of high-level APIs designed to support programmatic export and import of Quick Sight resources. They cover a range of use cases such as release management, backup and restore, cross-account migration, and continuous integration and continuous delivery (CI/CD) workflows.

This set of APIs includes the following operations:

• StartAssetBundleExportJob: Creates a package (bundle) that contains the assets exported as part of the operation. The package is a zip file with text files. The format can be either JSON or AWS CloudFormation depending on the value specified in the ExportFormat parameter. Depending on the format, you can import these assets using the AAB APIs directly or use CloudFormation infrastructure as code (IaC) for provisioning. After the asynchronous operation finishes, the system uploads the bundle to a temporary S3 location for downloading.

• StartAssetBundleImportJob: Takes a previously exported bundle and restores the assets packed in it. You can use the import operation to define overrides for a wide set of parameters such as asset names and data source connection parameters (host, port, workgroup, and more).

• DescribeAssetBundleImportJob and DescribeAssetBundleExportJob: Both AssetBundle operations are asynchronous. You can use these APIs to describe the operation, poll for its status, and act after it finishes. When you perform an export job, you can use DescribeAssetBundleExportJob to retrieve the DownloadUrl for the bundle, which is valid for 5 minutes. You can renew the URL with further calls to DescribeAssetBundleExportJob.

Supported assets and current limitations of AssetsAsBundle APIs

AssetsAsBundle APIs support a list of Quick Sight assets including analyses, dashboards, data sources, datasets, shared folders, restricted folders, refresh schedules, themes, and VPC connections. However, some asset types have limitations.

Unsupported data sources: Adobe Analytics, File, GitHub, Jira, Salesforce, ServiceNow, Amazon S3 (with locally uploaded manifest files), and Twitter.

Unsupported datasets: Datasets that contain machine learning (ML) columns generated using inference through connected SageMaker ML models.

You must exclude these assets from your backup plan to avoid an InvalidParameterValueException error when you issue the StartAssetBundleExportJob operation.

To work around this, you can replace unsupported data sources and datasets by following these procedures.

For Amazon S3 data sources with local manifest files:

• Create a new Amazon S3 data source.

• Upload the manifest file to Amazon S3.

• Reference the manifest file from your data source.

• Replace the data source in the dependent datasets using the UpdateDataSet API.

For other unsupported data sources and datasets:

Follow this procedure to transform your incompatible dataset into a compatible one:

• Create an analysis connected to the data source you want to support in your backup.

• Create a table visual that displays all dataset columns.

• Export the data as a CSV file.

• Create an Amazon S3 dataset using a manifest uploaded to Amazon S3.

• Update your analyses and dashboards with the new dataset using the replace dataset functionality.

Other assets to consider as part of your backup

Although Quick Sight resources are the key assets to back up, you need to include some additional resources and configurations in your backup plan for potential restore or disaster recovery situations.

You can export Quick Sight assets along with their permissions, including the users and groups that have access to them. You control this by setting the IncludePermissions flag to true.

Because each Quick Sight asset is owned by a user, you need to back up users and groups to have a full and restorable backup.

AssetsAsBundle APIs don’t cover users and groups, but you can use DescribeUser, DescribeGroup, and DescribeGroupMembership to include this information in the backup.

In addition to users and groups, consider backing up account settings such as account customization (the DescribeAccountCustomization API), customized brands (the DescribeBrand API), and folders (the ListFolders,