Automate user-level custom permissions for Amazon Quick
Amazon Web Services Ashok Dasineni
AWS Quick can now auto-apply user-level permissions as people are added. That keeps access tight without waiting for admins to clean up later.
Based on reporting by Amazon Web Services, Ashok Dasineni — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Amazon Quick is getting a more practical answer to a boring but important problem: how to keep permissions tight as the product grows and users get AI-powered features. AWS is pushing automation for custom permissions so administrators can keep to the principle of least privilege without hand-editing every account one by one.
The core idea is simple. Quick custom permissions let admins switch specific features on or off for individual users, so one person can write reports without exporting raw data, while another can see dashboards but not share them. AWS says there are four ways to automate that setup depending on where in the user lifecycle you want control: at user creation, as a default for an account or role, through event-driven logic tied to group membership, or by updating existing users in bulk.
If your onboarding flow already creates Quick users through the RegisterUser API, the lightest option is to pass the custom permissions profile right there with --custom-permissions-name. That fits custom portals and scripts, and AWS even points to SaaS companies that may want to lock premium features such as paginated reports and GenBI according to a customer’s pricing tier the moment the user is provisioned.
For broader defaults, Quick has a hierarchy: account, role, then user. User-level settings win. Account-level defaults are set with UpdateAccountCustomPermission, and role-level defaults with UpdateRoleCustomPermission. AWS says this is the place to start if you want all users, including those created with just-in-time provisioning, to inherit a restrictive profile without building extra automation around them.
The more interesting setup is the event-driven one. Quick and AWS IAM Identity Center don’t offer a native API for assigning custom permissions to a group, so AWS suggests watching CloudTrail events with Amazon EventBridge and using AWS Lambda to call UpdateUserCustomPermission when someone is added to a group. That works for both Quick groups and Identity Center groups, and AWS is explicit that it should be layered on top of a default account or role policy so users are never briefly too open while waiting for group assignment.
There’s also a retroactive path for the mess you already have: a Python script to apply permissions to users who were created before automation existed. It’s a tidy admission that the real world is full of old users, old groups, and old mistakes. The nice part is that AWS is finally treating permissions like something to automate, not something to babysit.
My take — AI-written commentary, not fact-checked reporting
This is the right kind of unsexy automation: less “AI magic,” more “please stop giving everyone the keys.” AWS is basically admitting that permission sprawl is the real enterprise problem, not another shiny feature. The only surprise is that more vendors don’t build this stuff in before customers have to tape it together with Lambda and hope for the best.
Read more about this at: Amazon Web Services