Salesforce Docs Portal

Configure AWS Access

Confirm that your Amazon account can create resources for Agentforce Voice with Real-Time Streaming. Configure settings using your root user account or grant the required permissions to an IAM user or role.

License and Permission Requirements for Amazon Configuration

If you are using Salesforce Voice with Amazon Connect, you must have the Additional Service add-on license.

To configure Amazon Connect, you must have these permissions:

  • app-integrations:ListApplications
  • wisdom:ListAssistants

These permissions are automatically granted if you have the Additional Service add-on license.

Operator Permissions

The AWS Command Line Interface (CLI) names and the IAM action names use different prefixes. Q in Connect commands authorize as wisdom. AppIntegrations commands authorize as app-integrations.

Your Amazon account must have these permissions.

  • Q in Connect: wisdom:CreateAssistant, wisdom:CreateAIAgent, wisdom:CreateAIAgentVersion
  • AppIntegrations: app-integrations:CreateApplication
  • Amazon Connect: connect:CreateIntegrationAssociation, connect:UpdateSecurityProfile, connect:AssociateSecurityProfiles, connect:AssociateBot
  • Amazon Lex: lex:CreateBot, lex:CreateBotLocale, lex:CreateIntent, lex:BuildBotLocale, lex:CreateBotVersion, lex:CreateBotAlias
  • IAM: iam:ListRoles or iam:GetRole to get the ARN of a role, iam:PassRole on the Lex service-linked role passed to create-bot

If you are a Salesforce Voice with Telephony Providers customer, grant your Amazon account secretsmanager:GetSecretValue, secretsmanager:DescribeSecret, and kms:Decrypt so you can read <identity>-salesforce-jwt-secret. Salesforce creates that secret and rotates the token.

If you aren’t a Salesforce Voice with Telephony Providers customer, deploy SalesforceJwtRotatorNonScvStack to add these operator actions.

  • CloudFormation: cloudformation:CreateStack, cloudformation:DescribeStacks, cloudformation:DescribeStackEvents
  • Lambda: lambda:CreateFunction, lambda:GetFunction, lambda:AddPermission
  • EventBridge: events:PutRule, events:PutTargets
  • Amazon S3: s3:GetObject on the artifact bucket named by S3BucketForScvResources
  • IAM: iam:CreateRole, iam:PutRolePolicy, iam:AttachRolePolicy, iam:GetRole, and iam:PassRole on the Lambda execution role for JwtTokenRotatorFunction
  • AWS Secrets Manager: secretsmanager:CreateSecret, secretsmanager:PutResourcePolicy, secretsmanager:GetSecretValue, secretsmanager:DescribeSecret, secretsmanager:PutSecretValue, secretsmanager:TagResource
  • KMS: kms:CreateKey, kms:CreateAlias, kms:DescribeKey, kms:PutKeyPolicy, kms:CreateGrant, kms:TagResource, kms:GenerateDataKey, kms:Decrypt, kms:Encrypt

The secretsmanager:PutSecretValue action replaces REPLACE_WITH_PRIVATE_KEY in <identity>-salesforce-secret.

Runtime Access

Amazon Connect reads the JWT at call time as the service principal connect.amazonaws.com. Grant access to these resource policies, scoped to this Amazon Connect instance.

  • KMS key policy: kms:Decrypt and kms:DescribeKey
  • JWT secret resource policy: secretsmanager:GetSecretValue on <identity>-salesforce-jwt-secret

The rotator Lambda role, which the stack creates, reads <identity>-salesforce-secret and writes <identity>-salesforce-jwt-secret. Those permissions belong to that role.