Amazon Connect resource-level policy examples

Amazon Connect supports resource-level permissions for IAM users, so you can specify actions for them for an instance, as shown in the following policies.

Deny the "delete" and "update" actions

This following sample policy denies the "delete" and "update" actions for users in one Amazon Connect instance. It uses a wild card at the end of the Amazon Connect user ARN so that "delete user" and "update user" are denied on the full user ARN (that is, all Amazon Connect users in the provided instance, such as arn:aws:connect:us-east-1:123456789012:instance/00fbeee1-123e-111e-93e3-11111bfbfcc1/agent/00dtcddd1-123e-111e-93e3-11111bfbfcc1).

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "connect:DeleteUser",
                "connect:UpdateUser*"
            ],
            "Resource": "arn:aws:connect:us-east-1:123456789012:instance/00fbeee1-123e-111e-93e3-11111bfbfcc1/agent/*"
        }
    ]
}            

Allow actions for integrations with specific names

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAllAppIntegrationsActions",
            "Effect": "Allow",
            "Action": [
                "app-integrations:ListEventIntegrations",
                "app-integrations:CreateEventIntegration",
                "app-integrations:GetEventIntegration",
                "app-integrations:UpdateEventIntegration",
                "app-integartions:DeleteEventIntegration"
            ],
"Resource":"arn:aws:appintegrations:*:*:event-integration/MyNamePrefix-*"
	}
    ]
}            

Allow "create users" but deny if you're assigned to a specific security profile

The following sample policy allows "create users" but explicitly denies using arn:aws:connect:us-west-2:123456789012:instance/00fbeee1-123e-111e-93e3-11111bfbfcc1/security-profile/11dtcggg1-123e-111e-93e3-11111bfbfcc17 as the parameter for security profile in CreateUser request.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",        
            "Action": [
                "connect:CreateUser"
             ],
            "Resource": "*",
        },
        {
            "Effect": "Deny",
            "Action": [
                "connect:CreateUser"
             ],
            "Resource": "arn:aws:connect:us-west-2:123456789012:instance/00fbeee1-123e-111e-93e3-11111bfbfcc17/security-profile/11dtcggg1-123e-111e-93e3-11111bfbfcc17",
        } 
    ]
}            

Allow recording actions on a contact

The following sample policy allows "start contact recording" on a contact in a specific instance. Since contactID is dynamic, * is used.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
          "connect:StartContactRecording"
      ],
      "Resource": "arn:aws:connect:us-west-2:accountID:instance/instanceId/contact/*",
      "Effect": "Allow"
    }
  ]
}            

Set up a trusted relationship with accountID.

The following actions are defined for the recording APIs:

• "connect:StartContactRecording"

• "connect:StopContactRecording"

• "connect:SuspendContactRecording"

• "connect:ResumeContactRecording"

Allow more contact Actions in the same role

If the same role is used to calling other contact APIs, you can list the following contact actions:

• GetContactAttributes

• ListContactFlows

• StartChatContact

• StartOutboundVoiceContact

• StopContact

• UpdateContactAttributes

Or use a wildcard to allow all contact actions, for example: "connect:*"

Allow more resources

You can also use a wildcard to allow more resources. For example, here's how to allow all connect actions on all contact resources:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "connect:*"
            ],
            "Resource": "arn:aws:connect:us-west-2:accountID:instance/*/contact/*",
            "Effect": "Allow"
        }
    ]
}       

View specific Amazon AppIntegrations resources

The following sample policy allows a specific event integrations to be fetched.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "app-integrations:GetEventIntegration"
            ],
            "Resource": "arn:aws:app-integrations:us-west-2:accountID:event-integration/Name"
        }
    ]
}   

Grant access to Amazon Connect Customer Profiles

Amazon Connect Customer Profiles use profile as the prefix for actions instead of connect. The following policy grants full access to a specific domain in Amazon Connect Customer Profiles.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
          "profile:*"
      ],
      "Resource": "arn:aws:profile:us-west-2:accountID:domains/domainName",
      "Effect": "Allow"
    }
  ]
}            

Set up a trusted relationship with accountID to domain domainName.

Grant read-only access to Customer Profiles data

Following is an example for granting read access to the data in Amazon Connect Customer Profiles.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "profile:SearchProfiles",
                "profile:ListObjects"
            ],
            "Resource": "arn:aws:profile:us-west-2:accountID:domains/domainName",
            "Effect": "Allow"
        }
    ]
}            

Query Amazon Connect Wisdom only for a specific Assistant

The following sample policy allows querying only a specific Assistant.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "wisdom:QueryAssistant "
            ],
            "Resource": "arn:aws:wisdom:us-west-2:accountID:assistant/assistantID"
        }
    ]
} 

Grant full access to Amazon Connect Voice ID

Amazon Connect Voice ID uses voiceid as the prefix for actions instead of connect. The following policy grants full access to a specific domain in Amazon Connect Voice ID:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
          "voiceid:*"
      ],
      "Resource": "arn:aws:voiceid:us-west-2:accountID:domain/domainName",
      "Effect": "Allow"
    }
  ]
}  

Set up a trusted relationship with accountID to domain domainName.

Grant access to Amazon Connect outbound campaigns resources

Outbound campaigns uses connect-campaign as the prefix for actions instead of connect. The following policy grants full access to a specific outbound campaign.

{
    "Sid": "AllowConnectCampaignsOperations",
    "Effect": "Allow",
    "Action": [
        "connect-campaigns:DeleteCampaign",
        "connect-campaigns:DescribeCampaign",
        "connect-campaigns:UpdateCampaignName",
        "connect-campaigns:GetCampaignState"
        "connect-campaigns:UpdateOutboundCallConfig",
        "connect-campaigns:UpdateDialerConfig",
        "connect-campaigns:PauseCampaign",
        "connect-campaigns:ResumeCampaign",
        "connect-campaigns:StopCampaign"
    ],
    "Resource": "arn:aws:connect-campaigns:us-west-2:accountID:campaign/campaignId",
    }