Downgrading user roles in Amazon Quick

AWS has published guidance on downgrading user roles in Amazon Quick, addressing a task the Amazon Quick console and the update-user API do not support directly. According to the post, the console offers no direct way to move a user from Admin to Reader or Author to Reader, and the update-user API rejects such direct downgrades with a "You cannot downgrade a user role" error.

The post primarily covers Quick Identity users, also called Quick-managed users. Users authenticated through IAM Identity Center or Active Directory typically have role changes managed through external identity provider group mappings; for IAM Identity Center, the post states a downgrade is handled by moving the user from one IdC group to another, with no step-down sequence required.

Two methods are described for Quick-managed users. The manual approach deletes the user and recreates them with the Reader role. The recommended CLI approach uses the AWS Command Line Interface to step through intermediate roles: Admin, Author, Restricted Reader, Reader. The post states the same sequence works for Pro users if intermediate steps use legacy roles, giving Author Pro to Author to Restricted Reader to Reader Pro as an example.

The post advises verifying that users are currently Admin or Author before changes, transferring ownership of dashboards, datasets and analyses first, and noting that downgraded users will no longer be able to edit resources they previously owned. It recommends reviewing Limit Profiles and Custom Permissions after a downgrade, since neither adjusts automatically with role changes. A script is provided for updating multiple users.