Connect LabAmazon Connect study

Instance

SAML attributes that make a user real

Learn it in 5 minutes

HTML

About five minutes of reading

A successful SAML login that lands without a routing profile is a user who cannot take a contact.

Map the role, the security profile, and the routing profile from the assertion. Hierarchy is optional and easy to get wrong if your IdP sends a display name and Connect expects the configured group.

IAM Identity Center is a reasonable IdP. It still federates with SAML. Global Resiliency adds a Regional sign-in endpoint. The CCP allow list includes it only when you have onboarded.

  • Test with one user and one profile before you federate the whole center.
  • Role session name problems show up as opaque access errors. Read the IdP logs and the Connect login error together.
  • Do not create a parallel local admin and forget it when people leave.
  • The replica instance needs the same identity story or failover signs nobody in.

Number on this page: Required 3. Role, security profile, routing profile

Confirm before relying. Prices, quotas, and exam names change. Use the source linked on this page.

Visual

HTML
SAML attributes that make a user real
Diagram SVGDiagram PNGDiagram HTMLFlow SVGFlow PNGFlow HTML

Picture from this room.

Worked example

HTML
  1. Map. Three attributes.
  2. Sign in. One test user.
  3. Take a contact. Prove the profile.
  4. Replica. Repeat on the pair.

What usually goes wrong: Declaring SAML done because the IdP returned a success code.

Quiz

HTML

Question 1

Which term matches this description? Agent or admin user when you are not using SAML-only creation.

Show the cited answer

Agent or admin user when you are not using SAML-only creation. The term is IaC: AWS::Connect::User.

Configure SAML with IAM for Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10

Question 2

Which term matches this description? Test with one user and one profile before you federate the whole center.

Show the cited answer

Test with one user and one profile before you federate the whole center. The term is SAML attributes that make a user real (1).

Configure SAML with IAM for Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10

Question 3

Which term matches this description? User, queue, or phone-number quick connect.

Show the cited answer

User, queue, or phone-number quick connect. The term is IaC: AWS::Connect::QuickConnect.

Create quick connects in Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10

Sources

HTML

Configure SAML with IAM for Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10

The prose is a study paraphrase. The link is the source of the facts.

Ecosystem

HTML

Glossary

  • Instance The Connect container in one Region. It holds users, flows, queues, and numbers. A new account starts at two instances per Region.
  • my.connect.aws The current instance domain. awsapps.com is the old domain the docs say is going away.

Mind map

Open the Instance mind map

Sister technologies

Every number, user, and flow lives in one instance in one Region. Get this wrong and the rest of the design has no home.

Config and troubleshooting

Declaring SAML done because the IdP returned a success code.

One instance, one Region. IdentityManagementType is SAML or CONNECT_MANAGED. The alias becomes the instance name.

CfnInstance AWS::Connect::Instance

CloudFormation study snippet
Resources:
  CampusInstance:
    Type: AWS::Connect::Instance
    Properties:
      IdentityManagementType: CONNECT_MANAGED
      InstanceAlias: campus-demo
      Attributes:
        InboundCalls: true
        OutboundCalls: true
        ContactflowLogs: true

Integration map

Join records on ContactId. The integration map room lists the seams.

Cross-platform bridges

A CUCM calling search space is not a routing profile, but the profile is the closest idea of 'who can receive what'. A partition is not a Connect object. A UCCX CSQ and a UCCE skill group map to a queue. Precision steps map to routing criteria. A script, an Architect flow, and an Avaya vector map to a contact flow.

Open the mapping room

Future hooks

Hooks you can adopt later: EventBridge contact events, the CTR stream, agent events, Kinesis Video, Customer Profiles events, Cases, Show view, data tables, External Tool, and the flow language JSON in your pipeline. Live Sync and Agentic CX are the 2026 hooks for guided and agentic experiences.

Sources and go deeper

sources.json