Independent study lab
This is an independent, free, learning-only student project. It respects every company and vendor. Trademarks belong to their owners. It is not affiliated with or endorsed by Amazon Web Services, Cisco, Genesys, Salesforce, Twilio, or any other company. If you have a concern, the page will be removed or corrected promptly through the contact form. Nothing here is sold. There are no ads. The author is happy to volunteer for any organization.
Association, resource policy, and the log that says AccessDenied — Learn it in 5 minutes
About five minutes of reading
The flow log is telling the truth. The function never ran.
AccessDenied in the flow log means Connect could not invoke the function. Add the function on the instance and allow connect.amazonaws.com to invoke that version or alias. A permission on the flow author is irrelevant at runtime.
If there is no Lambda log line at all, you are in this case or the payload was rejected. If there is a log line, the bug is inside the function.
- Use an alias, not $LATEST, in production.
- Resource-based policy and identity policy answer different questions.
- VPC-attached functions need a path to their dependency and still must return in time.
- Terraform's association resource is the reviewable form of the console click.
Number on this page: Principal connect. connect.amazonaws.com on the function policy
Sources and go deeper
- Troubleshoot Lambda function failures in Amazon Connect | AWS re:Post community. last checked 2026-10
- Flow block in Connect Customer: AWS Lambda function - Amazon Connect Customer AWS docs. last checked 2026-10
- What is AWS Lambda? - AWS Lambda AWS docs. last checked 2026-10
- AWS Lambda - Wikipedia Wikipedia. last checked 2026-10