Independent study lab
This is an independent, free, learning-only student project. It respects every company and vendor. Trademarks belong to their owners. It is not affiliated with or endorsed by Amazon Web Services, Cisco, Genesys, Salesforce, Twilio, or any other company. If you have a concern, the page will be removed or corrected promptly through the contact form. Nothing here is sold. There are no ads. The author is happy to volunteer for any organization.
IAM is not the security profile — Learn it in 5 minutes
About five minutes of reading
Agents get a security profile. Automations get an IAM principal. Mixing the names produces a policy that cannot place a call and a user who can.
A security profile decides which buttons a user sees in the admin site and the CCP. An IAM policy decides which AWS API calls a role may make. Connect also relies on resource policies, especially lambda:InvokeFunction for principal connect.amazonaws.com.
The service-linked role is what Connect uses to write recordings and logs. A customer-managed KMS key still needs a key policy that trusts that role, or the put succeeds in your mind and fails in S3.
- connect:StartOutboundVoiceContact and StartChatContact are privileged. Do not put them on a public web role.
- profile and cases are separate IAM services.
- wisdom is still the prefix you will see for agent assist in the service authorization reference.
- Least privilege means the instance ARN, not Resource star, once the design is real.
Number on this page: Prefixes 5+. connect, profile, cases, wisdom, voiceid
Confirm before relying. Prices, quotas, and exam names change. Use the source linked on this page.
Sources and go deeper
- Configure SAML with IAM for Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10
- What is IAM? - AWS Identity and Access Management AWS docs. last checked 2026-10
- Security in Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10
- Identity and access management - Wikipedia Wikipedia. last checked 2026-10