Amazon Connect IAM Roles and Provisioning Policies for Salesforce Voice

To integrate natively with Amazon Connect, Salesforce Voice comes with Amazon Connect artifacts, including IAM roles and provisioning policies.

Required Editions

This article applies to:

Salesforce Voice with Partner Telephony from Amazon Connect

View supported editions.

Before analyzing the Salesforce Voice IAM Roles and Policies matrix, review the prerequisite steps for Salesforce Voice with Partner Telephony from Amazon Connect and review the resource details. You can find the latest SCVProvisioningPolicy.json at https://github.com/service-cloud-voice/examples-from-doc/blob/main/iam_policies/SCVProvisioningPolicy.json. The matrix in this document describes the IAM policies and roles. If you operate in the public sector domain in the US but uses the commercial AWS account, you can use the same SCVProvisioningPolicy.json file. But, if you operate in the public sector domain in the US and uses the AWS GovCloud region, use the SCVGovProvisioningPolicy.json file available on GitHub.

AWS IAM Role

To enable a trusted relationship with the Salesforce Management AWS account, create an Identity and Access Management (IAM) role during setup. Using this role, Salesforce configures artifacts in your Amazon Connect instance that are required for Service Cloud Voice. These resources are nondestructive IAM permissions, such as resetPassword and delete and deactivate roles.

To define access, add policies to the IAM role. The requirements for this role are based on these principles.

Following the principle of least privilege, we granted this role the minimum level of permissions needed to perform its job.
We built enough flexibility into this role to add new features and enhancements in the future.
To reduce the footprint, all permissions and restrictions are included in one IAM role policy: SCVProvisioningPolicy.json.
This role includes only the permission to the services required by Service Cloud Voice.
To mitigate security risk associated with Salesforce Voice Provisioning Service, add an IAM permissions boundary.

See Configure AWS Identity and Access Management (IAM) Role for Voice.

AWS IAM Role for GovCloud

If you operate in the public sector domain in the US and uses the AWS GovCloud region, use the SCVGovProvisioningPolicy.json file available on GitHub. The value of GOV prod MPA account ID must be 383319876315.

If you operate in the public sector domain in the US but uses the commercial AWS account, you can use the general SCVProvisioningPolicy.json file.

Wildcard Access

The WildcardAccess section lists all resources that have wildcard-service actions and wildcard-resource access. The ds (directory service) and logs (cloud watch logs) policies require wildcard access for provisioning and run-time actions.

The Lambda service also has wildcard actions.

Event Access

The EventAccess section defines who has access to the events. Only the Lambda functions in the Resource section have access to events.

LambdaEventSourceAccess

The LambdaEventSourceAccess section lists which Lambda functions can act on an event triggered by AWS resources. You can map only the specified Lambda functions to event sources. For example, you can map the CTRStream event source to CTRDataSyncFunction and the S3 event source to VoiceMailAudioProcessingFunction.

LambdaAccess

The LambdaAccess section imposes resource-based restrictions on Lambda access. To prevent unwanted access to user-defined Lambda functions, Salesforce provisions and works only with the specified Lambda functions.

S3Write

The S3Write section defines the policy for the S3-related actions. Service Cloud Voice Provisioning Service creates two S3 buckets for your Salesforce org. One bucket stores the conversation audio recording files. The second stores all AWS activity captured by the CloudTrail service. The IAM Policies and Roles Matrix in this page references S3 buckets that are required to download Lambda function code and layer code.

ResourceBasedAccess

The ResourceBasedAccess section grants wildcard access to the actions of different services. This section lists the resource regular expressions (regexes) that are required only for the Salesforce Voice Provisioning Service. These resources are in your AWS account with ID AWS_ACCOUNT_ID.

IAMAccess

Salesforce Voice Provisioning Service creates Lambda functions. Some functions are application-specific, such as pausing and resuming call recordings, and generating presigned S3 credentials for playing back audio recordings. All these functions use the IAM role and are based on Salesforce infrastructure security. Salesforce Voice adds required actions on IAM roles. The IAM role that you create grants access only to those IAM role resources that Salesforce Voice requires. They’re nondestructive IAM permissions, such as resetPassword and delete and deactivate roles.

CloudformationAccess

The CloudformationAccess section lists all AWS CloudFormation actions that Salesforce Voice requires. Salesforce Voice provisions two Cloudformation stacks. One stack is in the us-east-1 region and sets up AWS account-level infrastructure, such as IAM Roles, Identity Provider, and CloudTrail. The other stack is in the contact center region of your choice. This CloudFormation access is constrained by the resource-level restrictions.

ConnectAccess

The ConnectAccess section grants fine-grained Amazon Connect permissions that are required to operate the contact center.

IAM Policies and Roles Matrix

During provisioning, these IAM policies and roles are created automatically in your AWS account.

Policies Managed by Salesforce Voice
Policy	Permission	Description
SCVSSMAccessPolicy	Action: `ssm:GetParameter* ssm:PutParameter ssm:DeleteParameter` Resource: `arn:aws:ssm::${AWS::AccountId}:parameter/-salesforce- arn:aws:ssm::${AWS::AccountId}:parameter/-scrt-jwt-auth-private-key`	This policy controls access to SSM keys created by Salesforce Voice.
SCVLambdaAccessPolicy	Action: `lambda:InvokeFunction lambda:InvokeAsync lambda:ListFunctions lambda:AddPermission lambda:RemovePermission` Resource: VoiceMailTranscribeFunction ContactLensProcessorFunction kvsTranscriber kvsConsumerTrigger InvokeTelephonyIntegrationApiFunction ContactLensProcessorFunction ContactLensConsumerFunction CTRDataSyncFunction InvokeSalesforceRestApiFunction AuthKeysSSMUtilFunction HandleContactEventsFunction CustomSSMFunction RealtimeAlert ConnectConfigurationFunction S3BucketPolicyConfigurationFunction S3BucketPolicyConfigurationFunction S3BucketEventBridgeConfigurationFunction TDGConfigurationFunction VoiceMailAudioProcessingFunction VoiceMailTranscribeFunction VoiceMailPackagingFunction	This policy controls access to the Lambda functions created by Service Cloud Voice.
SCVKMSAccessPolicy	Action: `kms:CreateGrant kms:DescribeKey kms:ListAliases kms:RetireGrant kms:Decrypt Resource: alias/aws/kinesisvideo alias/aws/lambda alias/aws/ssm Action: kms:CreateGrant kms:DescribeKey kms:ListAliases kms:RetireGrant kms:Decrypt` Resource: `KMS keys tagged with resourceOwner:scv`	This policy controls access to KMS keys created by Salesforce Voice.
SCVAmazonConnectAccessPolicy	Action: "connect:Get", "connect:List", "connect:Search", "connect:Describe", "connect:AssociateApprovedOrigin", "connect:AssociateInstanceStorageConfig", "connect:AssociateLambdaFunction", "connect:AssociatePhoneNumberContactFlow", "connect:AssociateQueueQuickConnects", "connect:AssociateRoutingProfileQueues", "connect:AssociateTrafficDistributionGroupUser", "connect:CreateContactFlow", "connect:CreateInstance", "connect:CreateHoursOfOperation", "connect:CreateContactFlowModule", "connect:CreateQueue", "connect:CreateQuickConnect", "connect:CreateRoutingProfile", "connect:CreateTrafficDistributionGroup", "connect:CreateUser", "connect:ReplicateInstance", "connect:StartOutboundVoiceContact", "connect:TagResource", "connect:UpdateTrafficDistribution", "connect:UpdateQuickConnectName", "connect:UpdateInstanceAttribute", "connect:UpdateHoursOfOperation", "connect:UpdateQueueName", "connect:DeleteQueue", "connect:DeleteUser", "connect:DisassociateLambdaFunction", "connect:DisassociateApprovedOrigin", "connect:DisassociateQueueQuickConnects", "connect:DisassociateTrafficDistributionGroupUser"	This policy controls access to your Amazon Connect instances.
InvokeSalesforceRestApiFunctionRolePolicy	Action: `"ssm:Describe", "ssm:Get", "ssm:List", "ssm:Put", "lambda:*"`	This policy controls access to the Salesforce REST API.
CTRDataSyncFunctionRolePolicy	Action: `"kinesis:DescribeStream", "kinesis:DescribeStreamSummary", "kinesis:GetRecords", "kinesis:GetShardIterator", "kinesis:ListShards", "kinesis:ListStreams", "kinesis:SubscribeToShard", "kms:Decrypt", "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "lambda:InvokeFunction"` Resource: `"CTRStream", "ContactLensStream"`	This policy controls access to the contact record and Contact Lens streams created by Salesforce Voice. If you use an Amazon Connect instance integrated by Salesforce when you set up Salesforce Voice, Salesforce also controls access to the customer-configured contact record stream.
SCVSecretsManagerAccessPolicy	Action: `secretsmanager:GetSecretValue secretsmanager:DescribeSecret secretsmanager:UpdateSecret secretsmanager:CreateSecret` Resource: `arn:${AWS::Partition}:secretsmanager::${AWS::AccountId}:secret:-salesforce-*`	This policy controls access to Salesforce org and cert details in AWS Secrets Manager.

Roles
Role Name	Role Description
`SCVKvsTranscriberRoleResource`	The `kvsTranscriber` Lambda function uses this role and Telephony Integration API to send transcription data based on Amazon Connect's video stream. See Create a Transcript.
`SCVProvisioningRole`	A Service Cloud user uses this role to perform provisioning functions, such as creating and updating the contact center via Salesforce Voice Provisioning Service.
`SCVHandleContactEventsFunct`	The `HandleContactEventsFunction` Lambda function uses this role to clear Pending Service Routing requests when Amazon Connect publishes customer disconnect events.
`SCVContactDataSyncFunctionRole`	The Contact Data Sync Lambda function uses this role to invoke backfill transcripts from the Contact Lens.

IAM Roles with Policies Created by Salesforce Voice Provisioning Service

With the exception of a few IAM roles, Salesforce Voice Provisioning Service creates the IAM roles at runtime. The Provisioning Service creates the SCVIDPLambdaRole, SCVAmazonConnectManagementRole, SCVConnectConfiguratorLambdaRole roles during setup.

SCV-Managed Policies
Role Name	Policy	Description
`SCVCTRDataSyncFunctionRole`	`AWSLambdaBasicExecutionRole` `AWSLambdaKinesisExecutionRole` `SCVKMSAccessPolicy` `SCVKinesisDataStreamAccessPolicy`	The CTRDataSyncFunction Lambda function uses this role to invoke Update Voice Call API. See Update a Voice Call Record.
`SCVPostCallAnalysisTriggerFunctionRoleResource`	`AWSLambdaBasicExecutionRole` `SCVSSMAccessPolicy` `SCVKMSAccessPolicy` `SCVLambdaAccessPolicy` `SCVAmazonConnectAccessPolicy` `s3:GetObject` `s3:GetBucketNotification` `SCVSecretsManagerAccessPolicy`	The PostCallAnalysisTriggerFunction Lambda function uses this role to send analytics events after the voice call ends to persist Contact-Lens-generated intelligence signals.
`SCVInvokeTelephonyIntegrationApiFunctionRole`	`AWSLambdaBasicExecutionRole` `SCVSSMAccessPolicy` `SCVSecretsManagerAccessPolicy`	The InvokeTelephonyIntegrationApiFunction Lambda function uses this role and CreateVoiceCall API to create Salesforce Voice calls. See Create a Voice Call Record.
`SCVInvokeSalesforceRestApiFunctionRole`	`AWSLambdaBasicExecutionRole` `SCVSSMAccessPolicy` `SCVSecretsManagerAccessPolicy`	The InvokeSalesforceRestApiFunction Lambda function uses this role to perform REST API operations.
`SCVSSMLambdaExecutionRole`	`AWSLambdaBasicExecutionRole` `SCVSSMAccessPolicy` `SCVSecretsManagerAccessPolicy`	Salesforce Voice Provisioning Service uses this role to create "Systems Manager" -- "Parameter Store" -- "Secure String" typed parameters.
`SCVS3Role`	`"s3:GetObject"` `"kms:Decrypt"` `"s3:ListBucket"`	After voice calls are stored in the AWS S3 bucket, a rep can play the recorded voice calls in Salesforce. Salesforce uses this role to gain access in the AWS S3 bucket and play voice call recordings.
`SCVKvsTranscriberRole`	`AWSLambdaBasicExecutionRole` `SCVKMSAccessPolicy` `SCVSSMAccessPolicy` `"transcribe:DeleteTranscriptionJob`" `"transcribe:DeleteMedicalTranscriptionJob`" `"transcribe:GetTranscriptionJob"` `"transcribe:GetMedicalTranscriptionJob"` `"transcribe:GetVocabulary"` `"transcribe:GetMedicalVocabulary"` `"transcribe:GetVocabularyFilter"` `"transcribe:ListTranscriptionJobs"` `"transcribe:ListMedicalTranscriptionJobs"` `"transcribe:ListVocabularies"` `"transcribe:ListMedicalVocabularies"` `"transcribe:ListVocabularyFilters"` `"transcribe:StartStreamTranscription"` `"transcribe:StartMedicalStreamTranscription"` `"transcribe:StartTranscriptionJob"` `"transcribe:StartMedicalTranscriptionJob"` `"kinesisvideo:Describe"` `"kinesisvideo:Get"` `"kinesisvideo:List*"` `"connect:UpdateContactAttributes"` `SCVSecretsManagerAccessPolicy`	The kvsTranscriber Lambda function uses this role and Telephony Integration API to send transcription data based on the Amazon Connect's video stream. See Create a Transcript.
`SCVKvsConsumerTriggerRole`	`AWSLambdaBasicExecutionRole` `SCVLambdaAccessPolicy`	The kvsConsumerTrigger Lambda function uses this role to trigger the KVSTranscriber Lambda function to invoke and process the Kinesis video stream.
`SCVContactLensConsumerFunctionRole`	`AWSLambdaBasicExecutionRole` `AWSLambdaKinesisExecutionRole` `SCVKMSAccessPolicy` `SCVKinesisDataStreamAccessPolicy` `SCVLambdaAccessPolicy` `SCVSSMAccessPolicy` `SCVSecretsManagerAccessPolicy`	The ContactLensConsumerFunction Lambda function uses this role to enable real-time transcription from Contact Lens.
`SCVIDPLambdaRole`	`"iam:*SamlProvider"` `AWSLambdaBasicExecutionRole`	The ProviderCreator Lambda function uses this role to create "IAM" -- "Identity Provider," where Salesforce serves as the identity provider. Salesforce Voice Provisioning Service creates this Lambda resource.
`SCVAmazonConnectManagementRole`	`AWSLambdaBasicExecutionRole` `SCVKinesisDataStreamAccessPolicy` `SCVKMSAccessPolicy` `SCVAmazonConnectAccessPolicy`	Salesforce Voice Provisioning Service uses this role to perform Amazon Connect configuration tasks, such as creating and removing users, routing profiles, queues, and quick connects.
`SCVConnectConfiguratorLambdaRole`	`AWSLambdaBasicExecutionRole` `SCVAmazonConnectAccessPolicy` `SCVKMSAccessPolicy` `SCVKinesisDataStreamAccessPolicy` `SCVLambdaAccessPolicy` `"s3:ListAllMyBuckets"` `"s3:GetBucketLocation"` `"s3:GetBucketAcl"` `"s3:CreateBucket"` `"iam:PutRolePolicy"` `"ds:DescribeDirectories"`	The ConnectConfigurationFunction Lambda function uses this role to execute the API call on the Amazon Connect instance. This role is used to perform Amazon Connect management and configure the Amazon Connect instance. Salesforce Voice Provisioning Service creates this Lambda function.
`SCVTrailLogGroupRole`	`"logs:CreateLogStream"` `"logs:PutLogEvents"`	The scvCloudTrail service uses this role to produce all event record data and write it to the S3 Bucket for CloudTrail. For Salesforce Voice with Partner Telephony from Amazon Connect, the bucket name is `scv-${AWS::AccountId}-byoa-cloudtrail.` For Salesforce Voice, the bucket name is `scv-${AWS::AccountId}-cloudtrail`.
`SCVVoiceMailAudioProcessingRole`	`AWSLambdaBasicExecutionRole` `AmazonKinesisVideoStreamsReadOnlyAccess` `SCVKinesisDataStreamAccessPolicy` `SCVLambdaAccessPolicy` `"s3:GetObject"` `"s3:PutObject"` `"s3:PutObjectTagging"`	The VoiceMailAudioProcessing Lambda function uses this role to process contact record Kinesis Data Stream and capture voicemail recording files.
`SCVVoiceMailPackagingRole`	`AWSLambdaBasicExecutionRole` `SCVLambdaAccessPolicy` `SCVSSMAccessPolicy` `"connect:UpdateContactAttributes"` `"s3:GetObject"` `"s3:PutObject"` `"s3:GetObjectTagging"` `"s3:PutObjectTagging"` `"transcribe:DeleteTranscriptionJob"` `"transcribe:GetTranscriptionJob"` `"transcribe:ListTranscriptionJobs"`	The VoiceMailPackagingFunction Lambda function uses this role to call contact record and execute OmniFlow API to enable voicemail functionality.
`SCVVoiceMailTranscribeRole`	`AWSLambdaBasicExecutionRole` `SCVSSMAccessPolicy` `"transcribe:DeleteTranscriptionJob"` `"transcribe:DeleteMedicalTranscriptionJob"` `"transcribe:GetTranscriptionJob"` `"transcribe:GetMedicalTranscriptionJob"` `"transcribe:GetVocabulary"` `"transcribe:GetMedicalVocabulary`" `"transcribe:GetVocabularyFilter"` `"transcribe:ListTranscriptionJobs"` `"transcribe:ListMedicalTranscriptionJobs"` `"transcribe:ListVocabularies"` `"transcribe:ListMedicalVocabularies"` `"transcribe:ListVocabularyFilters"` `"transcribe:StartStreamTranscription"` `"transcribe:StartMedicalStreamTranscription`" `"transcribe:StartTranscriptionJob"` `"transcribe:StartMedicalTranscriptionJob"` `"connect:UpdateContactAttributes"` `"s3:GetObject"` `"s3:PutObject"` `"s3:GetObjectTagging"` `"s3:PutObjectTagging"`	The VoiceMailTranscribeFunction Lambda function uses this role to process voicemail recording files and transcribe voicemails.
`SCVRealtimeAlertRole`	`AWSLambdaBasicExecutionRole` `SCVSSMAccessPolicy` `SCVLambdaAccessPolicy` `"connect:Get"` `"connect:Describe"` `"connect:List*"`	The RealtimeAlert Lambda function uses this role and REST API to create Service Cloud Voice real-time alerts. REST API publishes RealtimeAlertEvent events. See RealtimeAlertEvent.
`SCVHandleContactEventsRole`	`AWSLambdaBasicExecutionRole` `LambdaManagedPolicyResource`	The HandleContactEventsFunction Lambda function uses this role to clear Pending Service Routing requests when Amazon Connect publishes customer disconnect events.
`[ContactCenter]-SAMLRole`	`{ "Action": "connect:GetFederationToken", "Resource": [ "arn:aws:connect:*:403503132786:instance/83ccfc13-d248-4768-af7c-9970643cb520/user/${aws:userid}" ], "Effect": "Allow", "Sid": "ConnectSSOPolicySid" }`	Amazon Connect uses this role after a user is authenticated into AWS using SAML protocol for rep and supervisor single sign-on. After the user is authenticated, Amazon Connect establishes a session based on the user's security profile.
`[ContactCenter]-ConnectCallRole`	`{ "Action": [ "connect:SuspendContactRecording", "connect:ResumeContactRecording" ], "Resource": "arn:aws:connect::AWS ACCOUNT NUMBER :instance/AMAZON CONNECT INSTANCE ID/contact/", "Effect": "Allow", "Sid": "ConnectCallRoleSid" }`	A Service Cloud user uses this role to stop and resume call recordings.
`SCVRetentionPeriodFunctionRole`	`AWSLambdaExecute` `AWSLambdaBasicExecutionRole` `"logs:CreateLogStream"` `"logs:PutRetentionPolicy"` `"logs:CreateLogGroup"` `"logs:PutLogEvents"` `"logs:DescribeLogGroups"`	The RetentionPeriodFunction Lambda function uses this role to clean up CloudWatch logs that are older than 120 days.
`SCVTenantBucketWriteAccessRole`	`s3:PutObject` `s3:PutObjectTagging` `s3:GetObject` `s3:ListBucket`	This role allows Salesforce to store and access objects in the voicemailmessages bucket of the S3BucketForTenantResources.
`SCVSecretConfiguratorLambdaRole`	`SCVSecretsManagerAccessPolicy` `SecretsManagerManagedPolicy` `SSMManagedPolicy` `KMSManagedPolicy`	The SecretConfiguratorFunction Lambda function uses this role to create and update secrets in AWS Secrets Manager.

Permission Boundary

Some resources have wildcard access and service actions. To set up tighter access, create permission boundaries.

Contact Center Health Check Stack
The health check stack creates specific Identity and Access Management (IAM) roles and policies for the contact center in your AWS account. These resources provide the necessary permissions for the health check Lambda function to analyze your contact center configuration and generate a diagnostic report.