---
schema_version: "1"
id: 5193c2c3a9ec972adb0c57ee660a92294e1faea58b46c5d84f64c110746adb3e
title: Set Up External ID
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/voice_external_id.md
canonical_url: https://help.salesforce.com/s/articleView?id=service.voice_external_id.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 2f5b3544227885469e1e9db6113d6bae29dd39b93d4807cb02a4d0319c637cfb
description: For additional security, you can generate a unique external ID for your AWS account. When you enable an external ID, Salesforce Voice (formerly Service Cloud Voice) can assume all cross-account management roles, including the provisioning role if used, and perform contact center admin actions in your AWS account only after external ID validation.
products:
  - Service Cloud
  - Digital Engagement
release: "264"
---
# Set Up External ID

For additional security, you can generate a unique external ID for your AWS account. When you enable an external ID, Salesforce Voice (formerly Service Cloud Voice) can assume all cross-account management roles, including the provisioning role if used, and perform contact center admin actions in your AWS account only after external ID validation.

### Required Editions

This article applies to:

- Salesforce Voice with Partner Telephony from Amazon Connect

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;"><a href="https://help.salesforce.com/s/articleView?id=service.voice_editions.htm&amp;release=264.0.0&amp;type=5" title="Learn about the user interfaces, editions, and add-ons that support Voice solutions by Salesforce.">View supported editions</a>.</td></tr></tbody></table>

The external ID is valid for all the cross-account management roles associated with your Amazon contact center type.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d69379e70">Amazon Contact Center Type</th>
          <th scope="col" class="slds-cell-wrap" style="vertical-align:top;" id="d69379e73">External ID Applicable for Roles</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="Amazon Contact Center Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d69379e70 ">Partner Amazon Contact Center with a New Amazon Connect Instance</td>

          <td data-label="External ID Applicable for Roles" class="slds-cell-wrap" style="vertical-align:top;" headers="d69379e73 ">
            <ul>
              <li>SCVProvisioningRole</li>

              <li>AmazonConnectManagementRole</li>

              <li>InstanceRecordingRole</li>

              <li>SCVS3Role</li>

            </ul>
          </td>

        </tr>
        <tr class="">
          <td data-label="Amazon Contact Center Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d69379e70 ">Partner Amazon Contact Center with an Existing Amazon Connect Instance Integrated
            by Salesforce</td>

          <td data-label="External ID Applicable for Roles" class="slds-cell-wrap" style="vertical-align:top;" headers="d69379e73 ">
            <ul>
              <li>SCVProvisioningRole</li>

              <li>AmazonConnectManagementRole</li>

              <li>InstanceRecordingRole</li>

              <li>SCVS3Role</li>

            </ul>
          </td>

        </tr>
        <tr class="">
          <td data-label="Amazon Contact Center Type" class="slds-cell-wrap" style="vertical-align:top;" headers="d69379e70 ">Partner Amazon Contact Center with an Existing Amazon Connect Instance Integrated
            by You through XML import</td>

          <td data-label="External ID Applicable for Roles" class="slds-cell-wrap" style="vertical-align:top;" headers="d69379e73 ">
            <ul>
              <li>AmazonConnectManagementRole</li>

              <li>UpdateCredentialRole</li>

              <li>InstanceRecordingRole</li>

              <li>SCVS3Role</li>

            </ul>
          </td>

        </tr>
      </tbody>
    </table>

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/images/icon_note.png)

Note When you create or update an external ID, the external ID is valid only if you add it to the Trust Relationships policy for all the cross-account management roles, including the provisioning roles if used, in your AWS account.

If you use the same IAM role ARN across multiple Salesforce orgs, the external ID mapped to the IAM role ARN in one org isn't accessible in a different org. In this case, each time you perform an action that requires a cross-account role in an org, update the external ID and save it in the Trust Relationships of all cross-account roles in your AWS account. Then use this external ID for performing the contact center admin actions.

To disable the external ID for an AWS account, use the Configure External ID option in the Salesforce Voice setup page.

## Set Up External ID for a New Contact Center

While creating a contact center, you can configure an external ID if you haven't created any other contact center in the org that uses the AWS account associated with the selected IAM role ARN.

While creating a Partner Amazon Contact Center with your existing Amazon Connect instance, you can configure an external ID for the AWS account as described in [Use an Existing Amazon Connect Instance Integrated by Salesforce](https://help.salesforce.com/s/articleView?id=service.voice_existing_byoa_auto.htm&type=5&language=en_US).

While creating a Partner Amazon Contact Center with a new Amazon Connect instance, you can configure an external ID for the AWS account as described in [Use a New Amazon Connect Instance](https://help.salesforce.com/s/articleView?id=service.voice_new_byoa.htm&type=5&language=en_US).

## Set Up External ID for an Existing Contact Center

You can use the Configure External ID option on the Salesforce Voice setup page to create, update, or disable the external ID for your AWS account.

To use the configure external ID option, you must have a Partner Amazon Contact Center created with a new or existing Amazon Connect instance integrated by Salesforce, or with an existing Amazon Connect instance integrated by you through XML import by providing either one of the AmazonConnectManagementRole, UpdateCredentialRole, InstanceRecordingRole, or SCVS3Role roles.

To generate or update external ID, use the Configure External ID option in the Service Cloud Voice setup page.

![configure external id](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/support_channels/images/voice/voice_external_id.png)

- Select the AWS account ID, and click Generate.![generate external id](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-service-support_channels-264-0-0-production-enus/f3c4b3d2-ff86-4f7c-9fe2-3d8b23d35109/support_channels/images/voice/voice_ex_id_gen.png)
- Save the external ID, and add the generated external ID in the Trusted Relationships in your AWS account. In your AWS account, add the external ID to all the management roles in the JSON file corresponding to the IAM role ARN.

You can also use the Configure option to disable the external ID for an AWS account. Select the AWS account, and disable the External ID for the AWS account. Save the changes.

#### See Also

- [Amazon Documentation: External ID](https://aws.amazon.com/blogs/security/how-to-use-external-id-when-granting-access-to-your-aws-resources/)
- [Amazon Documentation: Access to AWS accounts owned by third parties](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html)