feat: QuickSight v3.0.0 — auto-subscribe, group-based permissions, EventBridge user sync

[chrisns]

Summary

Major overhaul of the QuickSight dashboard template (v2.4.0 → v3.0.0) to make it fully self-contained and deployable in fresh ISB sandbox accounts where QuickSight has never been configured.

What changed

• Auto-subscribe QuickSight: New setup Lambda + custom resource that handles the full QuickSight lifecycle — subscribes to Enterprise edition, waits for activation, registers an IAM admin user, enables SPICE auto-purchase, and creates the ndx-all-users group. Handles all subscription states (active, unsubscribed, in-progress, failed) with polling and retry logic.
• Group-based permissions: All three QuickSight resources (DataSource, DataSet, Dashboard) now grant permissions to the ndx-all-users group instead of a hardcoded SSO username. Removes the QuickSightUsername parameter entirely.
• EventBridge auto-group-sync: New EventBridge rule + Lambda that catches CloudTrail events for QuickSight user creation (RegisterUser, BatchCreateUser, CreateUser) and automatically adds new users to the ndx-all-users group. Handles console self-provisioning events where the username is in serviceEventDetails with Role:Session format (converted to Role/Session).
• RegisterUser retry logic: The setup Lambda retries RegisterUser up to 6 times with backoff for PreconditionNotMetException, which occurs after rapid subscribe/unsubscribe cycles when QuickSight's IAM integration hasn't propagated.
• Versioned bucket emptying: Data generator Lambda now properly empties versioned S3 buckets on stack delete by iterating all object versions and delete markers, preventing stack deletion failures.
• SAM transform removed: Template is now pure CloudFormation — no SAM build/deploy required. Compatible with ISB blueprint deployment pipeline.
• Removed parameters: AutoCleanupHours (lifecycle rules replaced by explicit cleanup) and QuickSightUsername (replaced by group-based permissions).

New resources (8)

Resource	Type	Purpose
QuickSightSetupRole	AWS::IAM::Role	IAM role for QuickSight subscription, user, and group management
QuickSightSetupFunction	AWS::Lambda::Function	Auto-subscribes QuickSight, registers admin user, creates group
QuickSightSetupLogGroup	AWS::Logs::LogGroup	7-day retention for setup Lambda
QuickSightSetupTrigger	AWS::CloudFormation::CustomResource	Triggers setup on stack create/update
QuickSightGroupSyncFunction	AWS::Lambda::Function	Adds new QuickSight users to ndx-all-users group
QuickSightGroupSyncLogGroup	AWS::Logs::LogGroup	7-day retention for sync Lambda
QuickSightGroupSyncRule	AWS::Events::Rule	EventBridge rule matching QuickSight user creation events
QuickSightGroupSyncPermission	AWS::Lambda::Permission	Allows EventBridge to invoke sync Lambda

Key design decisions

1. Group-based over user-based permissions — decouples deployment from user identity, scales to multiple users automatically
2. Idempotent subscription handling — setup Lambda handles all QuickSight states rather than assuming clean slate
3. Event-driven user sync — EventBridge + CloudTrail rather than polling or manual steps
4. Subscription left intact on delete — only the admin user is cleaned up; AWS Nuke handles full teardown in ISB sandbox model
5. Pure CloudFormation — SAM transform removed for ISB blueprint compatibility

Test plan

• Deployed stack fresh to sandbox account (us-west-2) with no prior QuickSight subscription
• QuickSight auto-subscribed, admin user registered (with retry on PreconditionNotMetException)
• ndx-all-users group created, admin user added
• Logged into QuickSight console as SSO user — CreateUser service event fired
• Sync Lambda extracted username from serviceEventDetails with colon-to-slash conversion
• CreateGroupMembership succeeded — user added to ndx-all-users
• Dashboard visible in QuickSight console without manual permission grants
• Stack delete tested — versioned bucket emptied cleanly