待翻译：Securing Amazon Quick from POC to production: Agents, Flows, and Spaces

AI 服务暂时不可用，以下为来源正文，待恢复后补全翻译。

Amazon Quick proof of concept (POC) projects often succeed with a small pilot team, then stall when security and compliance teams review the production plan. A permission model that works for ten pilot users often breaks when you add five departments. Agents can return data outside their intended scope, and compliance teams struggle to audit how datasets, agents, and Spaces connect. Amazon Quick combines dashboards, Chat Agents, Flows, and Spaces with knowledge bases. Each capability introduces security surfaces that standard dashboard controls do not cover. This post walks through designing Dashboards, Spaces, knowledge bases, Agents, and Flows for the AnyCompany scenario, with security controls that hold as you add users and departments. The walkthrough covers four patterns: dataset shaping, agent isolation, document classification, and approval gates. It also includes a governance framework and a production readiness checklist. Use case overview Consider AnyCompany: 5,000 employees, 5 departments, 5 locations. Three audiences need the same data at different levels: HR leadership: full workforce data including salaries and attrition risk. Department managers: their team’s operational metrics only. All employees: company policies and anonymized trends. Exposing one dataset to all three audiences and relying on permissions alone leaves too much room for misconfiguration. Solution overview The solution shapes one source dataset into three authorization-aligned views and connects each to a purpose-built Agent. It publishes a corresponding Dashboard per audience, scopes Spaces to content ownership, and gates outbound actions through a Flow with human-in-the-loop controls. The following screenshot shows the HR Leadership Dashboard, which provides full workforce visibility including salary, attrition risk, and position-level breakdowns across all employees. Figure 1a: HR Leadership Dashboard: full workforce visibility including salary, attrition risk, and position-level breakdowns across all 5,000 employees. The following screenshot shows the Department Manager Dashboard, which displays operational metrics scoped to a single department through Row-Level Security. Figure 1b: Department Manager Dashboard: same underlying data but with sensitive columns removed and RLS applied. Each manager sees only their own department’s employees. The following screenshot shows the Company Trends Dashboard, which displays only aggregated department-by-location summaries. No individual employee records are accessible from this view. Figure 1c: Company Trends Dashboard: aggregated to department × location level. No individual employee data visible. Available to all employees. Create and publish dashboards: To create dashboards from these datasets, navigate to Analyses, then Create analysis, select one of the three datasets, build your visualizations, then select Share, then Publish dashboard. Share each dashboard with the appropriate group. For detailed guidance, see Publishing dashboards. Validated patterns This post demonstrates four validated patterns that work together to enforce security through data architecture: Pattern What it does Where applied Dataset shaping Remove sensitive columns at the dataset level so they are structurally inaccessible Steps 1–2 Agent isolation Connect each Agent to exactly one dataset scoped to its audience Steps 5–7 Document classification Exclude sensitive documents from the knowledge base rather than relying on permissions Step 4 Approval gates Require human review before any outbound action in a Flow Step 8 Each pattern removes data before it reaches users, rather than relying on permission settings to block access. The following walkthrough implements all four. Prerequisites Before you begin, make sure you have the following in place: An AWS account with Amazon Quick turned on (Enterprise plan) At least three Amazon Quick user accounts representing different personas (or one user that can switch roles) A sample employee dataset (5,000 rows, 30 columns). Use the generation steps in Step 1 that follows, or use your own HR dataset with similar columns. AWS CloudTrail trail configured in your account. AWS Secrets Manager access if your Flows connect to external systems. Note: This walkthrough uses Amazon Quick managed identity (non-IDC). Group creation and user management are performed directly in the Amazon Quick console. If your account uses AWS IAM Identity Center (IDC) for identity federation, group management is handled in the AWS IAM Identity Center console rather than within Amazon Quick. The security patterns (dataset shaping, RLS, agent isolation) still apply, but group assignment steps will differ. Solution walkthrough The following nine steps walk you through each layer of the solution, from shaping datasets and applying row-level security to configuring Agents, Spaces, Flows, and audit logging. Step 1: Shape datasets to match authorization One of the most important security decisions in Amazon Quick is how you shape datasets. A dataset’s columns define the ceiling of what anyone connected to it can see. Removing columns from the dataset is structurally stronger than hiding columns behind permissions. Generate a synthetic employee dataset with 5,000 rows and 30 columns (Employee ID, Gender, Age, Department, Job Role, Position Level, Location, Annual Salary, Engagement Score, Attrition Flag, and so on). Use five departments (Sales, Engineering, Operations, Finance, HR), five locations, and realistic value ranges. The accompanying GitHub repository includes the full column list and a sample generation script, or you can substitute your own HR dataset with similar structure. Upload your generated employee_data.csv to Data (Datasets, then New dataset, then Upload file) to create three datasets: Dataset name Contents Audience Row count anycompany-employees-full All 30 columns HR Leadership 5,000 anycompany-employees-manager 4 sensitive columns removed (Annual Salary, Bonus Percent, Termination Date, Termination Reason) Department Managers 5,000 (RLS-filtered at query) anycompany-employees-aggregated Department × Location summaries only All Employees 25 The following screenshot shows the Datasets console after creating the three datasets. Figure 1d: The Datasets console. Note the RLS-enabled badge on the manager dataset, the Rules Dataset label on the permissions dataset, and SPICE storage for all datasets. For the aggregated dataset, use the data prep grouping UI or pre-aggregate the CSV before upload: To create the aggregated dataset, group your source data by Department and Location, then calculate: employee count, average Engagement Score, and average Satisfaction Score per group. This produces a 25-row summary (5 departments × 5 locations). Upload the result as a separate dataset. Why this matters: permissions-only compared to data architecture: If you exposed the full dataset to all audiences and relied solely on permissions, a single misconfiguration (incorrect group assignment, overly broad sharing rule) could expose salary data to all employees. With dataset shaping, the salary column does not exist in downstream datasets. No permission error can expose what isn’t there. Step 2: Apply Row-Level Security Amazon Quick Row-Level Security (RLS) restricts data access, so users only see specific rows based on their identity. You set up RLS at the dataset level by creating a mapping dataset that associates users or groups with specific column values, which then propagates to all linked analyses and dashboards. Create an RLS rules CSV and upload it as a permission dataset: Create a permissions CSV (rls-rules.csv) with two columns: UserName and Department. Add one row per user-department combination (for example, the HR admin gets five rows for full access. A Sales manager gets one row). Tip: To find your exact RLS username, add a calculated field username() to any analysis. The format varies by identity provider. Even one character mismatch returns zero rows. Upload rls-rules.csv as a new dataset (name it anycompany-rls-rules), then open the anycompany-employees-manager dataset, then Row-level security tab, then select the rules dataset, then map UserName and Department, then Save. Verify: Log in as hr-admin, then should see 5,000 rows. Log in as manager, then should see only their department (~1,000 rows). Zero rows mean the username string doesn’t match. Step 3: Create three groups and assign users Create three groups in Manage Amazon Quick, then Manage Groups: Group Members Dataset access hr-leadership hr-admin user full, manager, aggregated dept-managers one user per department manager (RLS-filtered), aggregated all-employees all other users aggregated only To simplify sharing at an enterprise scale, share datasets with groups rather than individual users. For more details, see Sharing datasets in the Amazon Quick documentation. The following screenshot shows the three groups created in the Manage Groups console. Figure 1e: Three groups created in Manage Amazon Quick, then Manage Groups: all-employees, hr-leadership, and dept-managers. Group membership controls all dataset, agent, and Space permissions. Step 4: Create a Space, upload knowledge base documents, and set permissions A Space organizes documents and provides document-grounded question answering through a knowledge base. All three agents connect to this Space, so create it before configuring the agents. Create the Space: Navigate to Spaces, then Create Space in the Amazon Quick console. In the Space name field, enter: AnyCompany HR. Select Create. Upload documents: Inside the AnyCompany HR Space, select File uploads, then Upload files. Classify each document before uploading. Only include documents appropriate for the intended audience. Upload the following documents from the sample files you downloaded from the accompanying GitHub repository: Document Upload Reason employee_handbook.pdf Yes General policies leave_policy.pdf Yes General policies public_holidays.csv Yes Reference data, no PII onboarding_checklist.pdf Yes Process documentation performance_review_guidelines.pdf Yes Process documentation employee_feedback_full_dataset.pdf No Contains individual performance reviews The employee_feedback_full_dataset.pdf file is deliberately excluded rather than permission restricted. All documents in a knowledge base are queryable by anyone with Viewer access, so the only way to prevent access to sensitive content is to keep it out entirely. If HR leadership needs this data, create a separate Space shared only with hr-leadership. The following screenshot shows the knowledge base document list after uploading the files. Figure 2: Knowledge base document list. Five documents uploaded and indexed (Ready status). The sixth document (employee_feedback_full_dataset.pdf) was deliberately excluded because it contains individual performance reviews that fail the classification review. Share the Space with groups: Spaces use a two-tier model: Owners can view, query, and upload. Viewers can view and query only. Users not added have no access. Select Share on the AnyCompany HR Space. Assign each group to the appropriate tier: Group Role What this role grants hr-leadership Owner View Space, query knowledge base, upload documents dept-managers Viewer View Space, query knowledge base (cannot upload) all-employees (Do not add) No access to the Space The following screenshot shows the Space permissions panel with the group assignments configured. Figure 3: The Space permissions panel. hr-leadership has Owner access, dept-managers has Viewer access, and all-employees is not listed (no access). Step 5: Configure three purpose-built Chat Agents Amazon Quick Chat Agents are artificial intelligence (AI) assistants that answer natural-language questions by querying a connected dataset or k [truncated for AI cost control]