Independent study lab
This is an independent, free, learning-only student project. It respects every company and vendor. Trademarks belong to their owners. It is not affiliated with or endorsed by Amazon Web Services, Cisco, Genesys, Salesforce, Twilio, or any other company. If you have a concern, the page will be removed or corrected promptly through the contact form. Nothing here is sold. There are no ads. The author is happy to volunteer for any organization.
Encryption is a key policy — Learn it in 5 minutes
About five minutes of reading
A customer-managed key you created and then forgot to share with Connect is an outage, not a security win.
Recordings and exported reports can use a customer-managed key. The key policy must allow the Connect service role to generate data keys and decrypt. CloudTrail should record key use. Rotation is available and does not re-encrypt old objects by itself.
TLS covers the CCP and the APIs in transit. That does not encrypt the recording at rest. Those are separate controls.
- Test a recording end to end after you change the key.
- A replica Region needs a key strategy you have actually written down.
- Do not use the same key for recordings and for unrelated application secrets if your blast radius matters.
- Access to the bucket and access to the key are both required to listen.
Number on this page: At rest KMS. Plus the bucket policy
Confirm before relying. Prices, quotas, and exam names change. Use the source linked on this page.
Sources and go deeper
- Encryption at rest in Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10
- AWS Key Management Service - AWS Key Management Service AWS docs. last checked 2026-10
- RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 | RFC Editor RFC. last checked 2026-10
- Transport Layer Security - Wikipedia Wikipedia. last checked 2026-10