Independent study lab

This is an independent, free, learning-only student project. It respects every company and vendor. Trademarks belong to their owners. It is not affiliated with or endorsed by Amazon Web Services, Cisco, Genesys, Salesforce, Twilio, or any other company. If you have a concern, the page will be removed or corrected promptly through the contact form. Nothing here is sold. There are no ads. The author is happy to volunteer for any organization.

Contact: https://cyphermonkeylabs.com/#contact

Encryption is a key policy — Ecosystem

Glossary

Security profile What a user may do in the admin site and the CCP. Different from an IAM policy.
IAM policy What an AWS principal may call. Connect, Profiles, Cases, and agent assist use different IAM prefixes.
Service-linked role The role AWS creates so Connect can write to S3, CloudWatch, and other services you name.
KMS key policy The key's own allow list. Recordings stay unreadable if the key does not trust the Connect role.

Mind map

Open the Security, quotas, price mind map

Sister technologies

A design that cannot name its IAM prefix, its key, and its quota will fail the first real week.

Config and troubleshooting

Enabling the key in the console and not calling a test number.

A security profile is not an IAM policy. This statement allows two read actions on one instance ARN. Lambda's resource policy is a separate document.

Service authorization

CloudFormation study snippet

Resources:
  OperatorPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - connect:DescribeInstance
              - connect:ListQueues
            Resource: !GetAtt CampusInstance.Arn

Integration map

Join records on ContactId. The integration map room lists the seams.

Cross-platform bridges

A CUCM calling search space is not a routing profile, but the profile is the closest idea of 'who can receive what'. A partition is not a Connect object. A UCCX CSQ and a UCCE skill group map to a queue. Precision steps map to routing criteria. A script, an Architect flow, and an Avaya vector map to a contact flow.

Open the mapping room

Future hooks

Hooks you can adopt later: EventBridge contact events, the CTR stream, agent events, Kinesis Video, Customer Profiles events, Cases, Show view, data tables, External Tool, and the flow language JSON in your pipeline. Live Sync and Agentic CX are the 2026 hooks for guided and agentic experiences.

Sources and go deeper

Encryption at rest in Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10
AWS Key Management Service - AWS Key Management Service AWS docs. last checked 2026-10
RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 | RFC Editor RFC. last checked 2026-10
Transport Layer Security - Wikipedia Wikipedia. last checked 2026-10

sources.json