Add SCP error handling in Quicksight identity region checks

backend/dataall/base/aws/quicksight.py

@@ -10,6 +10,23 @@
 class QuicksightClient:
 
     DEFAULT_GROUP_NAME = 'dataall'
+    QUICKSIGHT_IDENTITY_REGIONS = [
+        {"name": 'US East (N. Virginia)', "code": 'us-east-1'},
+        {"name": 'US East (Ohio)', "code": 'us-east-2'},
+        {"name": 'US West (Oregon)', "code": 'us-west-2'},
+        {"name": 'Europe (Frankfurt)', "code": 'eu-central-1'},
+        {"name": 'Europe (Stockholm)', "code": 'eu-north-1'},
+        {"name": 'Europe (Ireland)', "code": 'eu-west-1'},
+        {"name": 'Europe (London)', "code": 'eu-west-2'},
+        {"name": 'Europe (Paris)', "code": 'eu-west-3'},
+        {"name": 'Asia Pacific (Singapore)', "code": 'ap-southeast-1'},
+        {"name": 'Asia Pacific (Sydney)', "code": 'ap-southeast-2'},
+        {"name": 'Asia Pacific (Tokyo)', "code": 'ap-northeast-1'},
+        {"name": 'Asia Pacific (Seoul)', "code": 'ap-northeast-2'},
+        {"name": 'South America (São Paulo)', "code": 'sa-east-1'},
+        {"name": 'Canada (Central)', "code": 'ca-central-1'},
+        {"name": 'Asia Pacific (Mumbai)', "code": 'ap-south-1'},
+    ]
 
     def __init__(self):
         pass
@@ -37,21 +54,33 @@ def get_identity_region(AwsAccountId):
             the region quicksight uses as identity region
         """
         identity_region_rex = re.compile('Please use the (?P<region>.*) endpoint.')
-        identity_region = 'us-east-1'
-        client = QuicksightClient.get_quicksight_client(AwsAccountId=AwsAccountId, region=identity_region)
-        try:
-            response = client.describe_group(
-                AwsAccountId=AwsAccountId, GroupName=QuicksightClient.DEFAULT_GROUP_NAME, Namespace='default'
-            )
-        except client.exceptions.AccessDeniedException as e:
-            match = identity_region_rex.findall(str(e))
-            if match:
-                identity_region = match[0]
-            else:
-                raise e
-        except client.exceptions.ResourceNotFoundException:
-            pass
-        return identity_region
+        scp = 'with an explicit deny in a service control policy'
+        index = 0
+        while index < len(QuicksightClient.QUICKSIGHT_IDENTITY_REGIONS):
+            try:
+                identity_region = QuicksightClient.QUICKSIGHT_IDENTITY_REGIONS[index].get("code")
+                index += 1
+                client = QuicksightClient.get_quicksight_client(AwsAccountId=AwsAccountId, region=identity_region)
+                response = client.describe_group(
+                    AwsAccountId=AwsAccountId, GroupName=QuicksightClient.DEFAULT_GROUP_NAME, Namespace='default'
+                )
+                logger.info(f'Returning identity region = {identity_region} for account {AwsAccountId}')
+                return identity_region
+            except client.exceptions.AccessDeniedException as e:
+                if scp in str(e):
+                    logger.info(f'Quicksight SCP found in {identity_region} for account {AwsAccountId}. Trying next region...')
+                else:
+                    logger.info(f'Quicksight identity region is not {identity_region}, selecting correct region endpoint...')
+                    match = identity_region_rex.findall(str(e))
+                    if match:
+                        identity_region = match[0]
+                        logger.info(f'Returning identity region = {identity_region} for account {AwsAccountId}')
+                        return identity_region
+                    else:
+                        raise e
+            except client.exceptions.ResourceNotFoundException:
+                pass
+        raise Exception(f'Quicksight subscription is inactive or the identity region has SCPs preventing access from data.all to account {AwsAccountId}')
 
     @staticmethod
     def get_quicksight_client_in_identity_region(AwsAccountId):

backend/dataall/modules/dashboards/aws/dashboard_quicksight_client.py

@@ -17,26 +17,26 @@ class DashboardQuicksightClient:
     _DEFAULT_GROUP_NAME = QuicksightClient.DEFAULT_GROUP_NAME
 
     def __init__(self, username, aws_account_id, region='eu-west-1'):
-        session = SessionHelper.remote_session(accountid=aws_account_id)
-        self._client = session.client('quicksight', region_name=region)
         self._account_id = aws_account_id
         self._region = region
         self._username = username
+        self._client = QuicksightClient.get_quicksight_client(aws_account_id, region)
 
     def register_user_in_group(self, group_name, user_role='READER'):
+        identity_region_client = QuicksightClient.get_quicksight_client_in_identity_region(self._account_id)
         QuicksightClient.create_quicksight_group(self._account_id, group_name)
         user = self._describe_user()
 
         if user is not None:
-            self._client.update_user(
+            identity_region_client.update_user(
                 UserName=self._username,
                 AwsAccountId=self._account_id,
                 Namespace='default',
                 Email=self._username,
                 Role=user_role,
             )
         else:
-            self._client.register_user(
+            identity_region_client.register_user(
                 UserName=self._username,
                 Email=self._username,
                 AwsAccountId=self._account_id,
@@ -45,13 +45,13 @@ def register_user_in_group(self, group_name, user_role='READER'):
                 UserRole=user_role,
             )
 
-        response = self._client.list_user_groups(
+        response = identity_region_client.list_user_groups(
             UserName=self._username, AwsAccountId=self._account_id, Namespace='default'
         )
         log.info(f'list_user_groups for {self._username}: {response})')
         if group_name not in [g['GroupName'] for g in response['GroupList']]:
             log.warning(f'Adding {self._username} to Quicksight group {group_name} on {self._account_id}')
-            self._client.create_group_membership(
+            identity_region_client.create_group_membership(
                 MemberName=self._username,
                 GroupName=group_name,
                 AwsAccountId=self._account_id,