Healthcare-data platform hardens AWS identity under live incident response

Reporting over regulated healthcare data cuts both ways: the business needs its commercial-intelligence insights visible and self-serve, while every dashboard is, structurally, an access path to sensitive data — and must be permissioned like one. The platform’s migration off its previous warehouse reset the reporting layer’s foundations, creating the obligation and the opportunity to rebuild it AWS-native: connected directly to the new lake’s query engine, without data copies drifting into unmanaged tools, and with viewer access scoped deliberately rather than broadly.

Amazon QuickSight completes the platform’s AWS-native analytics chain. It reads through Amazon Athena against the Glue-cataloged S3 lake — the same governed path every other consumer uses, so reporting reflects the catalog’s single definition of the data with no side-channel extracts to secure separately. Access is permissioned: QuickSight’s users, groups, and dataset permissions scope who can see which reporting surfaces over the healthcare dataset, operating as one of the platform’s named production access controls — reviewed as part of the estate’s Security-pillar Well-Architected discipline rather than left as an untracked SaaS bolt-on. Alongside the Amazon RDS-backed profile web tier, the result is a two-surface product: the application for operational use, QuickSight for analytical reporting — both fed by, and governed with, the same platform.