How does row-level security work in QuickSight?

Q: How does row-level security work in QuickSight?

You create a separate rules dataset containing a UserName or GroupName column plus one column per field you want to restrict, with column names matching the target dataset exactly. Attach it under the dataset's row-level security settings. A user with no matching row sees no data — default-deny. Multiple rows are additive. Leaving a restriction column blank grants access to all values of that field, which is how you give administrators full visibility and also the most common accidental exposure

Question

Accepted Answer

You create a separate rules dataset containing a UserName or GroupName column plus one column per field you want to restrict, with column names matching the target dataset exactly. Attach it under the dataset's row-level security settings.

A user with no matching row sees no data — default-deny. Multiple rows are additive. Leaving a restriction column blank grants access to all values of that field, which is how you give administrators full visibility and also the most common accidental exposure.

RLS is Enterprise edition only. Test with a real low-privilege account, including a user with no entitlements, who should see an empty dashboard.