---
schema_version: "1"
id: adaaa5de6d6682a59c70ca9f59e77e72b31d6f6529821e53d237a2c969339ce6
title: Amazon Connect IAM Roles and Provisioning Policies for Salesforce Voice
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/voice_amazon_reference_roles_policies.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.voice_amazon_reference_roles_policies.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 54af8bd9e2e5678ce451de424c8497fdcbce935f52ad31eaa8ec82987f8d0fc7
description: To integrate natively with Amazon Connect, Salesforce Voice comes with Amazon Connect artifacts, including IAM roles and provisioning policies.
products:
  - Service Cloud
  - Digital Engagement
release: "264"
---
# Amazon Connect IAM Roles and Provisioning Policies for Salesforce Voice

To integrate natively with Amazon Connect, Salesforce Voice comes with Amazon Connect artifacts, including IAM roles and provisioning policies.

### Required Editions

This article applies to:

- Salesforce Voice with Partner Telephony from Amazon Connect

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;"><a href="https://help.salesforce.com/s/articleView?id=service.voice_editions.htm&amp;release=264.0.0&amp;type=5" title="Learn about the user interfaces, editions, and add-ons that support Voice solutions by Salesforce.">View supported editions</a>.</td></tr></tbody></table>

Before analyzing the Salesforce Voice IAM Roles and Policies matrix, review the prerequisite steps for Salesforce Voice with Partner Telephony from Amazon Connect and review the resource details. You can find the latest SCVProvisioningPolicy.json at [https://github.com/service-cloud-voice/examples-from-doc/blob/main/iam\_policies/SCVProvisioningPolicy.json](https://github.com/service-cloud-voice/examples-from-doc/blob/main/iam_policies/SCVProvisioningPolicy.json). The matrix in this document describes the IAM policies and roles. If you operate in the public sector domain in the US but uses the commercial AWS account, you can use the same [SCVProvisioningPolicy.json](https://github.com/service-cloud-voice/examples-from-doc/blob/main/iam_policies/SCVProvisioningPolicy.json) file. But, if you operate in the public sector domain in the US and uses the AWS GovCloud region, use the `SCVGovProvisioningPolicy.json` file available on [GitHub](https://github.com/service-cloud-voice/examples-from-doc/tree/main/iam_policies).

## AWS IAM Role

To enable a trusted relationship with the Salesforce Management AWS account, create an Identity and Access Management (IAM) role during setup. Using this role, Salesforce configures artifacts in your Amazon Connect instance that are required for Service Cloud Voice. These resources are nondestructive IAM permissions, such as resetPassword and delete and deactivate roles.

To define access, add policies to the IAM role. The requirements for this role are based on these principles.

- Following the principle of least privilege, we granted this role the minimum level of permissions needed to perform its job.
- We built enough flexibility into this role to add new features and enhancements in the future.
- To reduce the footprint, all permissions and restrictions are included in one IAM role policy: SCVProvisioningPolicy.json.
- This role includes only the permission to the services required by Service Cloud Voice.
- To mitigate security risk associated with Salesforce Voice Provisioning Service, add an IAM permissions boundary.

See [Configure AWS Identity and Access Management (IAM) Role for Voice](https://help.salesforce.com/s/articleView?id=service.voice_ac_iam_role.htm&type=5&language=en_US).

## AWS IAM Role for GovCloud

If you operate in the public sector domain in the US and uses the AWS GovCloud region, use the `SCVGovProvisioningPolicy.json` file available on [GitHub](https://github.com/service-cloud-voice/examples-from-doc/tree/main/iam_policies). The value of GOV prod MPA account ID must be `383319876315`.

If you operate in the public sector domain in the US but uses the commercial AWS account, you can use the general [SCVProvisioningPolicy.json](https://github.com/service-cloud-voice/examples-from-doc/blob/main/iam_policies/SCVProvisioningPolicy.json) file.

## Wildcard Access

The `WildcardAccess` section lists all resources that have wildcard-service actions and wildcard-resource access. The ds (directory service) and logs (cloud watch logs) policies require wildcard access for provisioning and run-time actions.

![WildcardAccess section of Amazon Connect policy](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/support_channels/images/voice/voice_amazon_policy_wildcardaccess.png)

The Lambda service also has wildcard actions.

![Lambda service in Amazon Connect policy](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/support_channels/images/voice/voice_amazon_policy_Lambda.png)

## Event Access

The `EventAccess` section defines who has access to the events. Only the Lambda functions in the `Resource` section have access to events.

![Lambda service in Amazon Connect policy](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/support_channels/images/voice/voice_amazon_policy_EventAccess.png)

## LambdaEventSourceAccess

The `LambdaEventSourceAccess` section lists which Lambda functions can act on an event triggered by AWS resources. You can map only the specified Lambda functions to event sources. For example, you can map the CTRStream event source to `CTRDataSyncFunction` and the S3 event source to `VoiceMailAudioProcessingFunction`.

![Lambda service in Amazon Connect policy](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/support_channels/images/voice/voice_amazon_policy_LambdaEventSourceAccess.png)

## LambdaAccess

The `LambdaAccess` section imposes resource-based restrictions on Lambda access. To prevent unwanted access to user-defined Lambda functions, Salesforce provisions and works only with the specified Lambda functions.

![Lambda service in Amazon Connect policy](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/support_channels/images/voice/voice_amazon_policy_LambdaAccess.png)

## S3Write

The `S3Write` section defines the policy for the S3-related actions. Service Cloud Voice Provisioning Service creates two S3 buckets for your Salesforce org. One bucket stores the conversation audio recording files. The second stores all AWS activity captured by the CloudTrail service. The IAM Policies and Roles Matrix in this page references S3 buckets that are required to download Lambda function code and layer code. 

## ResourceBasedAccess

The `ResourceBasedAccess` section grants wildcard access to the actions of different services. This section lists the resource regular expressions (regexes) that are required only for the Salesforce Voice Provisioning Service. These resources are in your AWS account with ID `AWS_ACCOUNT_ID`.

## IAMAccess

Salesforce Voice Provisioning Service creates Lambda functions. Some functions are application-specific, such as pausing and resuming call recordings, and generating presigned S3 credentials for playing back audio recordings. All these functions use the IAM role and are based on Salesforce infrastructure security. Salesforce Voice adds required actions on IAM roles. The IAM role that you create grants access only to those IAM role resources that Salesforce Voice requires. They’re nondestructive IAM permissions, such as resetPassword and delete and deactivate roles.

## CloudformationAccess

The `CloudformationAccess` section lists all AWS CloudFormation actions that Salesforce Voice requires. Salesforce Voice provisions two Cloudformation stacks. One stack is in the us-east-1 region and sets up AWS account-level infrastructure, such as IAM Roles, Identity Provider, and CloudTrail. The other stack is in the contact center region of your choice. This CloudFormation access is constrained by the resource-level restrictions.

## ConnectAccess

The `ConnectAccess` section grants fine-grained Amazon Connect permissions that are required to operate the contact center.

## IAM Policies and Roles Matrix

During provisioning, these IAM policies and roles are created automatically in your AWS account.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small " summary="Policies Managed by Salesforce Voice">
        <caption>Policies Managed by Salesforce Voice</caption>
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d127274e322">Policy</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d127274e325">Permission</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d127274e328">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e322 ">SCVSSMAccessPolicy</td>

            <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e325 ">
              <div>
                <p>Action: </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>ssm:GetParameter*
ssm:PutParameter
ssm:DeleteParameter*
</code></pre>
              </div>
              <div>
                <p> Resource:
                </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>arn:aws:ssm:*:${AWS::AccountId}:parameter/*-salesforce-*
arn:aws:ssm:*:${AWS::AccountId}:parameter/*-scrt-jwt-auth-private-key
</code></pre>
              </div>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e328 ">This policy controls access to SSM keys created by Salesforce Voice.</td>

          </tr>
          <tr class="">
            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e322 ">SCVLambdaAccessPolicy</td>

            <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e325 ">
              <div>
                <p>Action: </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>lambda:InvokeFunction
lambda:InvokeAsync
lambda:ListFunctions
lambda:AddPermission
lambda:RemovePermission
</code></pre>
              </div>
              <div>
                <p> Resource: </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>VoiceMailTranscribeFunction
ContactLensProcessorFunction
kvsTranscriber
kvsConsumerTrigger
InvokeTelephonyIntegrationApiFunction
ContactLensProcessorFunction
ContactLensConsumerFunction
CTRDataSyncFunction
InvokeSalesforceRestApiFunction
AuthKeysSSMUtilFunction
HandleContactEventsFunction
CustomSSMFunction
RealtimeAlert
ConnectConfigurationFunction
S3BucketPolicyConfigurationFunction
S3BucketPolicyConfigurationFunction
S3BucketEventBridgeConfigurationFunction
TDGConfigurationFunction
VoiceMailAudioProcessingFunction
VoiceMailTranscribeFunction
VoiceMailPackagingFunction
</code></pre>
              </div>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e328 ">This policy controls access to the Lambda functions created by Service Cloud
              Voice.</td>

          </tr>
          <tr class="">
            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e322 ">SCVKMSAccessPolicy</td>

            <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e325 ">
              <div>
                <p>Action: </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>kms:CreateGrant
kms:DescribeKey
kms:ListAliases
kms:RetireGrant
kms:Decrypt
Resource:
alias/aws/kinesisvideo
alias/aws/lambda
alias/aws/ssm
Action:
kms:CreateGrant
kms:DescribeKey
kms:ListAliases
kms:RetireGrant
kms:Decrypt
</code></pre>
              </div>
              <div>
                <p> Resource: </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>KMS keys tagged with resourceOwner:scv</code></pre>
              </div>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e328 ">This policy controls access to KMS keys created by Salesforce Voice.</td>

          </tr>
          <tr class="">
            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e322 ">SCVAmazonConnectAccessPolicy</td>

            <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e325 ">
              <div>
                <p>Action: </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>
"connect:Get*",
"connect:List*",
"connect:Search*",
"connect:Describe*",
"connect:AssociateApprovedOrigin",
"connect:AssociateInstanceStorageConfig",
"connect:AssociateLambdaFunction",
"connect:AssociatePhoneNumberContactFlow",
"connect:AssociateQueueQuickConnects",
"connect:AssociateRoutingProfileQueues",
"connect:AssociateTrafficDistributionGroupUser",
"connect:CreateContactFlow",
"connect:CreateInstance",
"connect:CreateHoursOfOperation",
"connect:CreateContactFlowModule",
"connect:CreateQueue",
"connect:CreateQuickConnect",
"connect:CreateRoutingProfile",
"connect:CreateTrafficDistributionGroup",
"connect:CreateUser",
"connect:ReplicateInstance",
"connect:StartOutboundVoiceContact",
"connect:TagResource",
"connect:UpdateTrafficDistribution",
"connect:UpdateQuickConnectName",
"connect:UpdateInstanceAttribute",
"connect:UpdateHoursOfOperation",
"connect:UpdateQueueName",
"connect:DeleteQueue",
"connect:DeleteUser",
"connect:DisassociateLambdaFunction",
"connect:DisassociateApprovedOrigin",
"connect:DisassociateQueueQuickConnects",
"connect:DisassociateTrafficDistributionGroupUser"
</code></pre>
              </div>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e328 ">This policy controls access to your Amazon Connect instances.</td>

          </tr>
          <tr class="">
            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e322 ">InvokeSalesforceRestApiFunctionRolePolicy</td>

            <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e325 ">
              <div>
                <p>Action: </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>
"ssm:Describe*",
"ssm:Get*",
"ssm:List*",
"ssm:Put*",
"lambda:*"
</code></pre>
              </div>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e328 ">This policy controls access to the Salesforce REST API.</td>

          </tr>
          <tr class="">
            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e322 ">CTRDataSyncFunctionRolePolicy</td>

            <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e325 ">
              <div>
                <p>Action: </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>
"kinesis:DescribeStream",
"kinesis:DescribeStreamSummary",
"kinesis:GetRecords",
"kinesis:GetShardIterator",
"kinesis:ListShards",
"kinesis:ListStreams",
"kinesis:SubscribeToShard",
"kms:Decrypt",
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"lambda:InvokeFunction"
</code></pre>
              </div>
              <div>
                <p>Resource: </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>"CTRStream",
"ContactLensStream"
</code></pre>
              </div>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e328 ">This policy controls access to the contact record and Contact Lens streams created by
              Salesforce Voice. If you use an Amazon Connect instance integrated by Salesforce
              when you set up Salesforce Voice, Salesforce also controls access to the
              customer-configured contact record stream.</td>

          </tr>
          <tr class="">
            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e322 ">SCVSecretsManagerAccessPolicy</td>

            <td data-label="Permission" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e325 ">
              <div>
                <p>Action: </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>
secretsmanager:GetSecretValue  
secretsmanager:DescribeSecret  
secretsmanager:UpdateSecret    
secretsmanager:CreateSecret 
</code></pre>
              </div>
              <div>
                <p>Resource:
                </p>
                <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>arn:${AWS::Partition}:secretsmanager:*:${AWS::AccountId}:secret:*-salesforce-*</code></pre>
              </div>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e328 ">This policy controls access to Salesforce org and cert details in AWS Secrets
              Manager.</td>

          </tr>
        </tbody>
      </table>

Roles  
| Role Name | Role Description |
| --- | --- |
| `SCVKvsTranscriberRoleResource` | The `kvsTranscriber` Lambda function uses this role and Telephony Integration API to send transcription data based on Amazon Connect's video stream. See [Create a Transcript](https://developer.salesforce.com/docs/atlas.en-us.voice_developer_guide.meta/voice_developer_guide/voice_rest_voicecalls_transcript.htm). |
| `SCVProvisioningRole` | A Service Cloud user uses this role to perform provisioning functions, such as creating and updating the contact center via Salesforce Voice Provisioning Service. |
| `SCVHandleContactEventsFunct` | The `HandleContactEventsFunction` Lambda function uses this role to clear Pending Service Routing requests when Amazon Connect publishes customer disconnect events. |
| `SCVContactDataSyncFunctionRole` | The Contact Data Sync Lambda function uses this role to invoke backfill transcripts from the Contact Lens. |

## IAM Roles with Policies Created by Salesforce Voice Provisioning Service

With the exception of a few IAM roles, Salesforce Voice Provisioning Service creates the IAM roles at runtime. The Provisioning Service creates the SCVIDPLambdaRole, SCVAmazonConnectManagementRole, SCVConnectConfiguratorLambdaRole roles during setup.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small " summary="SCV-Managed Policies">
        <caption>SCV-Managed Policies</caption>
        <colgroup>
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
          <col style="width:33.33333333333333%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d127274e587">Role Name</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d127274e590">Policy</th>
            <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d127274e593">Description</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVCTRDataSyncFunctionRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>AWSLambdaKinesisExecutionRole</code></p>
              <p><code>SCVKMSAccessPolicy</code></p>
              <p style="margin-bottom:0;"><code>SCVKinesisDataStreamAccessPolicy</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The CTRDataSyncFunction Lambda function uses this role to invoke Update Voice
              Call API. See <a href="https://developer.salesforce.com/docs/atlas.en-us.voice_developer_guide.meta/voice_developer_guide/voice_rest_voicecalls_update.htm" target="_blank">Update a Voice Call Record</a>.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVPostCallAnalysisTriggerFunctionRoleResource</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>SCVSSMAccessPolicy</code></p>
              <p><code>SCVKMSAccessPolicy</code></p>
              <p><code>SCVLambdaAccessPolicy</code></p>
              <p><code>SCVAmazonConnectAccessPolicy</code></p>
              <p><code>s3:GetObject</code></p>
              <p><code>s3:GetBucketNotification
                  </code></p>
              <p style="margin-bottom:0;"><code>SCVSecretsManagerAccessPolicy</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The PostCallAnalysisTriggerFunction Lambda function uses this role to send
              analytics events after the voice call ends to persist Contact-Lens-generated
              intelligence signals.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVInvokeTelephonyIntegrationApiFunctionRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>SCVSSMAccessPolicy
                  </code></p>
              <p style="margin-bottom:0;"><code>SCVSecretsManagerAccessPolicy</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The InvokeTelephonyIntegrationApiFunction Lambda function uses this role and
              CreateVoiceCall API to create Salesforce Voice calls. See <a href="https://developer.salesforce.com/docs/atlas.en-us.voice_developer_guide.meta/voice_developer_guide/voice_rest_voicecalls_create.htm" target="_blank">Create a Voice Call Record</a>.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVInvokeSalesforceRestApiFunctionRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>SCVSSMAccessPolicy</code></p>
              <p style="margin-bottom:0;"><code>SCVSecretsManagerAccessPolicy</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The InvokeSalesforceRestApiFunction Lambda function uses this role to perform
              REST API operations.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVSSMLambdaExecutionRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>SCVSSMAccessPolicy</code></p>
              <p style="margin-bottom:0;"><code>SCVSecretsManagerAccessPolicy</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">Salesforce Voice Provisioning Service uses this role to create "Systems
              Manager" -- "Parameter Store" -- "Secure String" typed parameters.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVS3Role</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>"s3:GetObject"</code></p>
              <p><code>"kms:Decrypt"</code></p>
              <p style="margin-bottom:0;"><code>"s3:ListBucket"</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">After voice calls are stored in the AWS S3 bucket, a rep can play the recorded
              voice calls in Salesforce. Salesforce uses this role to gain access in the AWS S3
              bucket and play voice call recordings. </td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVKvsTranscriberRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>SCVKMSAccessPolicy</code></p>
              <p><code>SCVSSMAccessPolicy</code></p>
              <p><code>"transcribe:DeleteTranscriptionJob</code>"</p>
              <p><code>"transcribe:DeleteMedicalTranscriptionJob</code>"</p>
              <p><code>"transcribe:GetTranscriptionJob"</code></p>
              <p><code>"transcribe:GetMedicalTranscriptionJob"</code></p>
              <p><code>"transcribe:GetVocabulary"</code></p>
              <p><code>"transcribe:GetMedicalVocabulary"</code></p>
              <p><code>"transcribe:GetVocabularyFilter"</code></p>
              <p><code>"transcribe:ListTranscriptionJobs"</code></p>
              <p><code>"transcribe:ListMedicalTranscriptionJobs"</code></p>
              <p><code>"transcribe:ListVocabularies"</code></p>
              <p><code>"transcribe:ListMedicalVocabularies"</code></p>
              <p><code>"transcribe:ListVocabularyFilters"</code></p>
              <p><code>"transcribe:StartStreamTranscription"</code></p>
              <p><code>"transcribe:StartMedicalStreamTranscription"</code></p>
              <p><code>"transcribe:StartTranscriptionJob"</code></p>
              <p><code>"transcribe:StartMedicalTranscriptionJob"</code></p>
              <p><code>"kinesisvideo:Describe*"</code></p>
              <p><code>"kinesisvideo:Get*"</code></p>
              <p><code>"kinesisvideo:List*"</code></p>
              <p><code>"connect:UpdateContactAttributes"</code></p>
              <p style="margin-bottom:0;"><code>SCVSecretsManagerAccessPolicy</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The kvsTranscriber Lambda function uses this role and Telephony Integration API
              to send transcription data based on the Amazon Connect's video stream. See <a href="https://developer.salesforce.com/docs/atlas.en-us.voice_developer_guide.meta/voice_developer_guide/voice_rest_voicecalls_transcript.htm" target="_blank">Create a Transcript</a>. </td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVKvsConsumerTriggerRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p style="margin-bottom:0;"><code>SCVLambdaAccessPolicy</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The kvsConsumerTrigger Lambda function uses this role to trigger the
              KVSTranscriber Lambda function to invoke and process the Kinesis video
              stream.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVContactLensConsumerFunctionRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p>
                <a href="https://us-east-1.console.aws.amazon.com/iamv2/home?region=us-west-2#/policies/details/arn%3Aaws%3Aiam%3A%3Aaws%3Apolicy%2Fservice-role%2FAWSLambdaBasicExecutionRole" target="_blank"><code>AWSLambdaKinesisExecutionRole</code></a>
              </p>
              <p><code>SCVKMSAccessPolicy</code></p>
              <p><code>SCVKinesisDataStreamAccessPolicy</code></p>
              <p><code>SCVLambdaAccessPolicy</code></p>
              <p><code>SCVSSMAccessPolicy</code></p>
              <p style="margin-bottom:0;"><code>SCVSecretsManagerAccessPolicy</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The ContactLensConsumerFunction Lambda function uses this role to enable
              real-time transcription from Contact Lens.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVIDPLambdaRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>"iam:*SamlProvider"</code></p>
              <p style="margin-bottom:0;"><code>AWSLambdaBasicExecutionRole</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The ProviderCreator Lambda function uses this role to create "IAM" -- "Identity
              Provider," where Salesforce serves as the identity provider. Salesforce Voice
              Provisioning Service creates this Lambda resource.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVAmazonConnectManagementRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>SCVKinesisDataStreamAccessPolicy</code></p>
              <p><code>SCVKMSAccessPolicy</code></p>
              <p style="margin-bottom:0;"><code>SCVAmazonConnectAccessPolicy</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">Salesforce Voice Provisioning Service uses this role to perform Amazon
              Connect configuration tasks, such as creating and removing users, routing profiles,
              queues, and quick connects.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVConnectConfiguratorLambdaRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>SCVAmazonConnectAccessPolicy</code></p>
              <p><code>SCVKMSAccessPolicy</code></p>
              <p><code>SCVKinesisDataStreamAccessPolicy</code></p>
              <p><code>SCVLambdaAccessPolicy</code></p>
              <p><code>"s3:ListAllMyBuckets"</code></p>
              <p><code>"s3:GetBucketLocation"</code></p>
              <p><code>"s3:GetBucketAcl"</code></p>
              <p><code>"s3:CreateBucket"</code></p>
              <p><code>"iam:PutRolePolicy"</code></p>
              <p style="margin-bottom:0;"><code>"ds:DescribeDirectories"</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The ConnectConfigurationFunction Lambda function uses this role to execute the
              API call on the Amazon Connect instance. This role is used to perform Amazon Connect
              management and configure the Amazon Connect instance. Salesforce Voice
              Provisioning Service creates this Lambda function.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVTrailLogGroupRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>"logs:CreateLogStream"</code></p>
              <p style="margin-bottom:0;"><code>"logs:PutLogEvents"</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">
              <p>The scvCloudTrail service uses this role to produce all event record data and
                write it to the S3 Bucket for CloudTrail.</p>
              <ul>
                <li>For Salesforce Voice with Partner Telephony from Amazon Connect, the bucket
                  name is <code>scv-${AWS::AccountId}-byoa-cloudtrail.</code></li>

                <li>For Salesforce Voice, the bucket name is
                  <code>scv-${AWS::AccountId}-cloudtrail</code>.
                </li>

              </ul>
            </td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVVoiceMailAudioProcessingRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>AmazonKinesisVideoStreamsReadOnlyAccess</code></p>
              <p><code>SCVKinesisDataStreamAccessPolicy</code></p>
              <p><code>SCVLambdaAccessPolicy</code></p>
              <p><code>"s3:GetObject"</code></p>
              <p><code>"s3:PutObject"</code></p>
              <p style="margin-bottom:0;"><code>"s3:PutObjectTagging"</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The VoiceMailAudioProcessing Lambda function uses this role to process contact record
              Kinesis Data Stream and capture voicemail recording files.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVVoiceMailPackagingRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>SCVLambdaAccessPolicy</code></p>
              <p><code>SCVSSMAccessPolicy</code></p>
              <p><code>"connect:UpdateContactAttributes"</code></p>
              <p><code>"s3:GetObject"</code></p>
              <p><code>"s3:PutObject"</code></p>
              <p><code>"s3:GetObjectTagging"</code></p>
              <p><code>"s3:PutObjectTagging"</code></p>
              <p><code>"transcribe:DeleteTranscriptionJob"</code></p>
              <p><code>"transcribe:GetTranscriptionJob"</code></p>
              <p style="margin-bottom:0;"><code>"transcribe:ListTranscriptionJobs"</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The VoiceMailPackagingFunction Lambda function uses this role to call contact record and
              execute OmniFlow API to enable voicemail functionality.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVVoiceMailTranscribeRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>SCVSSMAccessPolicy</code></p>
              <p><code>"transcribe:DeleteTranscriptionJob"</code></p>
              <p><code>"transcribe:DeleteMedicalTranscriptionJob"</code></p>
              <p><code>"transcribe:GetTranscriptionJob"</code></p>
              <p><code>"transcribe:GetMedicalTranscriptionJob"</code></p>
              <p><code>"transcribe:GetVocabulary"</code></p>
              <p><code>"transcribe:GetMedicalVocabulary</code>"</p>
              <p><code>"transcribe:GetVocabularyFilter"</code></p>
              <p><code>"transcribe:ListTranscriptionJobs"</code></p>
              <p><code>"transcribe:ListMedicalTranscriptionJobs"</code></p>
              <p><code>"transcribe:ListVocabularies"</code></p>
              <p><code>"transcribe:ListMedicalVocabularies"</code></p>
              <p><code>"transcribe:ListVocabularyFilters"</code></p>
              <p><code>"transcribe:StartStreamTranscription"</code></p>
              <p><code>"transcribe:StartMedicalStreamTranscription</code>"</p>
              <p><code>"transcribe:StartTranscriptionJob"</code></p>
              <p><code>"transcribe:StartMedicalTranscriptionJob"</code></p>
              <p><code>"connect:UpdateContactAttributes"</code></p>
              <p><code>"s3:GetObject"</code></p>
              <p><code>"s3:PutObject"</code></p>
              <p><code>"s3:GetObjectTagging"</code></p>
              <p style="margin-bottom:0;"><code>"s3:PutObjectTagging"</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The VoiceMailTranscribeFunction Lambda function uses this role to process
              voicemail recording files and transcribe voicemails.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVRealtimeAlertRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>SCVSSMAccessPolicy</code></p>
              <p><code>SCVLambdaAccessPolicy</code></p>
              <p><code>"connect:Get*"</code></p>
              <p><code>"connect:Describe*"</code></p>
              <p style="margin-bottom:0;"><code>"connect:List*"</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The RealtimeAlert Lambda function uses this role and REST API to create Service
              Cloud Voice real-time alerts. REST API publishes RealtimeAlertEvent events. See
              RealtimeAlertEvent.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVHandleContactEventsRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p style="margin-bottom:0;"><code>LambdaManagedPolicyResource</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The HandleContactEventsFunction Lambda function uses this role to clear Pending
              Service Routing requests when Amazon Connect publishes customer disconnect
              events.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>[ContactCenter]-SAMLRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>{
"Action": "connect:GetFederationToken",
"Resource": [
"arn:aws:connect:*:403503132786:instance/83ccfc13-d248-4768-af7c-9970643cb520/user/${aws:userid}"
],
"Effect": "Allow",
"Sid": "ConnectSSOPolicySid"
}</code></pre>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">Amazon Connect uses this role after a user is authenticated into AWS using SAML
              protocol for rep and supervisor single sign-on. After the user is authenticated,
              Amazon Connect establishes a session based on the user's security profile.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>[ContactCenter]-ConnectCallRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <pre class="line-numbers slds-box slds-box_x-small slds-theme_shade slds-m-top_medium slds-m-bottom_medium slds-scrollable_x"><code>{
"Action": [
"connect:SuspendContactRecording",
"connect:ResumeContactRecording"
],
"Resource": "arn:aws:connect:*:AWS ACCOUNT NUMBER :instance/AMAZON CONNECT INSTANCE ID/contact/*",
"Effect": "Allow",
"Sid": "ConnectCallRoleSid"
}
</code></pre>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">A Service Cloud user uses this role to stop and resume call recordings.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVRetentionPeriodFunctionRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>AWSLambdaExecute</code></p>
              <p><code>AWSLambdaBasicExecutionRole</code></p>
              <p><code>"logs:CreateLogStream"</code></p>
              <p><code>"logs:PutRetentionPolicy"</code></p>
              <p><code>"logs:CreateLogGroup"</code></p>
              <p><code>"logs:PutLogEvents"</code></p>
              <p style="margin-bottom:0;"><code>"logs:DescribeLogGroups"</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The RetentionPeriodFunction Lambda function uses this role to clean up
              CloudWatch logs that are older than 120 days.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVTenantBucketWriteAccessRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>s3:PutObject</code></p>
              <p><code>s3:PutObjectTagging</code></p>
              <p><code>s3:GetObject</code></p>
              <p style="margin-bottom:0;"><code>s3:ListBucket</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">This role allows Salesforce to store and access objects in the
              voicemailmessages bucket of the S3BucketForTenantResources.</td>

          </tr>
          <tr class="">
            <td data-label="Role Name" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e587 "><code>SCVSecretConfiguratorLambdaRole</code></td>

            <td data-label="Policy" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e590 ">
              <p><code>SCVSecretsManagerAccessPolicy</code></p>
              <p><code>SecretsManagerManagedPolicy</code></p>
              <p><code>SSMManagedPolicy</code></p>
              <p style="margin-bottom:0;"><code>KMSManagedPolicy</code></p>
            </td>

            <td data-label="Description" class="slds-cell-wrap" style="vertical-align:top;" headers="d127274e593 ">The SecretConfiguratorFunction Lambda function uses this role to create and
              update secrets in AWS Secrets Manager.</td>

          </tr>
        </tbody>
      </table>

## Permission Boundary

Some resources have wildcard access and service actions. To set up tighter access, create permission boundaries.

- **[Contact Center Health Check Stack](https://help.salesforce.com/s/articleView?id=service.voice_health_check_policy.htm&release=264.0.0&type=5)**  
    The health check stack creates specific Identity and Access Management (IAM) roles and policies for the contact center in your AWS account. These resources provide the necessary permissions for the health check Lambda function to analyze your contact center configuration and generate a diagnostic report.

#### See Also

- [Choose Your Voice Telephony Model](https://help.salesforce.com/s/articleView?id=service.voice_telephony_models.htm&release=264.0.0&type=5 "Voice comes in multiple flavors that vary based on telephony provider, setup process, and other characteristics. Compare them to decide which is the best option for your business.")
- [Use a New Amazon Connect Instance](https://help.salesforce.com/s/articleView?id=service.voice_new_byoa.htm&type=5&language=en_US)