---
schema_version: "1"
id: 5b7373dcf82d182f55cc02d49f0930a9e2787ecee01255433bce8738338bc8f7
title: Configure AWS Access
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/ai/264-0-0/agentforce_voice_realtime_streaming_aws_access.md
canonical_url: https://help.salesforce.com/s/articleView?id=ai.agentforce_voice_realtime_streaming_aws_access.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 3c98f4600b4211b6b2ab8fd118f050596846d429283fd52d5972343cdaf725c9
description: Confirm that your Amazon account can create resources for Agentforce Voice with Real-Time Streaming. Configure settings using your root user account or grant the required permissions to an IAM user or role.
products:
  - Agentforce
  - Cross Cloud
release: "264"
---
# Configure AWS Access

Confirm that your Amazon account can create resources for Agentforce Voice with Real-Time Streaming. Configure settings using your root user account or grant the required permissions to an IAM user or role.

## License and Permission Requirements for Amazon Configuration

If you are using Salesforce Voice with Amazon Connect, you must have the Additional Service add-on license.

To configure Amazon Connect, you must have these permissions:

- app-integrations:ListApplications
- wisdom:ListAssistants

These permissions are automatically granted if you have the Additional Service add-on license.

## Operator Permissions

The AWS Command Line Interface (CLI) names and the IAM action names use different prefixes. Q in Connect commands authorize as `wisdom`. AppIntegrations commands authorize as `app-integrations`.

Your Amazon account must have these permissions.

- Q in Connect: `wisdom:CreateAssistant`, `wisdom:CreateAIAgent`, `wisdom:CreateAIAgentVersion`
- AppIntegrations: `app-integrations:CreateApplication`
- Amazon Connect: `connect:CreateIntegrationAssociation`, `connect:UpdateSecurityProfile`, `connect:AssociateSecurityProfiles`, `connect:AssociateBot`
- Amazon Lex: `lex:CreateBot`, `lex:CreateBotLocale`, `lex:CreateIntent`, `lex:BuildBotLocale`, `lex:CreateBotVersion`, `lex:CreateBotAlias`
- IAM: `iam:ListRoles` or `iam:GetRole` to get the ARN of a role, `iam:PassRole` on the Lex service-linked role passed to `create-bot`

If you are a Salesforce Voice with Telephony Providers customer, grant your Amazon account `secretsmanager:GetSecretValue`, `secretsmanager:DescribeSecret`, and `kms:Decrypt` so you can read `<identity>-salesforce-jwt-secret`. Salesforce creates that secret and rotates the token.

If you aren’t a Salesforce Voice with Telephony Providers customer, deploy `SalesforceJwtRotatorNonScvStack` to add these operator actions.

- CloudFormation: `cloudformation:CreateStack`, `cloudformation:DescribeStacks`, `cloudformation:DescribeStackEvents`
- Lambda: `lambda:CreateFunction`, `lambda:GetFunction`, `lambda:AddPermission`
- EventBridge: `events:PutRule`, `events:PutTargets`
- Amazon S3: `s3:GetObject` on the artifact bucket named by `S3BucketForScvResources`
- IAM: `iam:CreateRole`, `iam:PutRolePolicy`, `iam:AttachRolePolicy`, `iam:GetRole`, and `iam:PassRole` on the Lambda execution role for `JwtTokenRotatorFunction`
- AWS Secrets Manager: `secretsmanager:CreateSecret`, `secretsmanager:PutResourcePolicy`, `secretsmanager:GetSecretValue`, `secretsmanager:DescribeSecret`, `secretsmanager:PutSecretValue`, `secretsmanager:TagResource`
- KMS: `kms:CreateKey`, `kms:CreateAlias`, `kms:DescribeKey`, `kms:PutKeyPolicy`, `kms:CreateGrant`, `kms:TagResource`, `kms:GenerateDataKey`, `kms:Decrypt`, `kms:Encrypt`

The `secretsmanager:PutSecretValue` action replaces `REPLACE_WITH_PRIVATE_KEY` in `<identity>-salesforce-secret`.

## Runtime Access

Amazon Connect reads the JWT at call time as the service principal `connect.amazonaws.com`. Grant access to these resource policies, scoped to this Amazon Connect instance.

- KMS key policy: `kms:Decrypt` and `kms:DescribeKey`
- JWT secret resource policy: `secretsmanager:GetSecretValue` on `<identity>-salesforce-jwt-secret`

The rotator Lambda role, which the stack creates, reads `<identity>-salesforce-secret` and writes `<identity>-salesforce-jwt-secret`. Those permissions belong to that role.