IAM is not the security profile

About five minutes of reading

Agents get a security profile. Automations get an IAM principal. Mixing the names produces a policy that cannot place a call and a user who can.

A security profile decides which buttons a user sees in the admin site and the CCP. An IAM policy decides which AWS API calls a role may make. Connect also relies on resource policies, especially lambda:InvokeFunction for principal connect.amazonaws.com.

The service-linked role is what Connect uses to write recordings and logs. A customer-managed KMS key still needs a key policy that trusts that role, or the put succeeds in your mind and fails in S3.

• connect:StartOutboundVoiceContact and StartChatContact are privileged. Do not put them on a public web role.
• profile and cases are separate IAM services.
• wisdom is still the prefix you will see for agent assist in the service authorization reference.
• Least privilege means the instance ARN, not Resource star, once the design is real.

Number on this page: Prefixes 5+. connect, profile, cases, wisdom, voiceid

Confirm before relying. Prices, quotas, and exam names change. Use the source linked on this page.

Who is allowed to click, versus who is allowed to call an API.

1. User. Security profile and routing profile.
2. Role. IAM for APIs and S3.
3. Resource policy. Lambda allows Connect.
4. Key policy. KMS allows the service role.

What usually goes wrong: Granting an agent AdministratorAccess because the security profile looked empty.

Configure SAML with IAM for Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10

The prose is a study paraphrase. The link is the source of the facts.

Glossary

• Contact One interaction: a call, chat, task, or email. A transfer usually creates another contact linked by PreviousContactId and NextContactId.
• Connect Customer The name used from 28 Apr 2026 for the contact center product previously called Amazon Connect.
• CloudWatch Metrics and flow logs. Alarm at 80 percent of a quota, which is the operations guidance in the email quota note.
• Kinesis Data Streams The durable stream for CTRs and agent events when more than one consumer must read them.

Mind map

Open the Foundations mind map

Sister technologies

A flow fails in IAM, a Region, a log group, or a network rule long before it fails as a 'Connect bug'.

Config and troubleshooting

Granting an agent AdministratorAccess because the security profile looked empty.

IAM, Lambda, S3, Kinesis, and CloudWatch are not inside the instance. This stack creates the instance and turns on flow logs and Contact Lens.

CfnInstance AWS::Connect::Instance

AWSTemplateFormatVersion: "2010-09-09"
Description: Connect instance with flow logs and Contact Lens
Resources:
  CampusInstance:
    Type: AWS::Connect::Instance
    Properties:
      IdentityManagementType: SAML
      InstanceAlias: campus-demo
      Attributes:
        InboundCalls: true
        OutboundCalls: true
        ContactflowLogs: true
        ContactLens: true

Integration map

Join records on ContactId. The integration map room lists the seams.

Cross-platform bridges

A CUCM calling search space is not a routing profile, but the profile is the closest idea of 'who can receive what'. A partition is not a Connect object. A UCCX CSQ and a UCCE skill group map to a queue. Precision steps map to routing criteria. A script, an Architect flow, and an Avaya vector map to a contact flow.

Open the mapping room

Future hooks

Hooks you can adopt later: EventBridge contact events, the CTR stream, agent events, Kinesis Video, Customer Profiles events, Cases, Show view, data tables, External Tool, and the flow language JSON in your pipeline. Live Sync and Agentic CX are the 2026 hooks for guided and agentic experiences.