Connect LabAmazon Connect study

Lambda

Association, resource policy, and the log that says AccessDenied

Learn it in 5 minutes

HTML

About five minutes of reading

The flow log is telling the truth. The function never ran.

AccessDenied in the flow log means Connect could not invoke the function. Add the function on the instance and allow connect.amazonaws.com to invoke that version or alias. A permission on the flow author is irrelevant at runtime.

If there is no Lambda log line at all, you are in this case or the payload was rejected. If there is a log line, the bug is inside the function.

  • Use an alias, not $LATEST, in production.
  • Resource-based policy and identity policy answer different questions.
  • VPC-attached functions need a path to their dependency and still must return in time.
  • Terraform's association resource is the reviewable form of the console click.

Number on this page: Principal connect. connect.amazonaws.com on the function policy

Visual

HTML
Association, resource policy, and the log that says AccessDenied
Diagram SVGDiagram PNGDiagram HTMLFlow SVGFlow PNGFlow HTML

Permission or payload, versus a bug in the code.

Worked example

HTML
  1. Read the flow log. AccessDenied or not.
  2. Fix the policy. Or the return shape.
  3. Retest. One ContactId.

What usually goes wrong: Adding lambda:InvokeFunction to the admin user and retesting the call.

Quiz

HTML

Question 1

Which term matches this description? A policy on the resource, such as Lambda, that allows connect.amazonaws.com to invoke it. An identity policy on a user is not enough.

Show the cited answer

A policy on the resource, such as Lambda, that allows connect.amazonaws.com to invoke it. An identity policy on a user is not enough. The term is Resource policy.

Troubleshoot Lambda function failures in Amazon Connect | AWS re:Post community. last checked 2026-10

Question 2

Which term matches this description? At most 8 seconds. The function's own timeout can be longer. The flow still takes the Error or Timeout branch at 8 seconds.

Show the cited answer

At most 8 seconds. The function's own timeout can be longer. The flow still takes the Error or Timeout branch at 8 seconds. The term is Lambda synchronous timeout.

Flow block in Connect Customer: AWS Lambda function - Amazon Connect Customer AWS docs. last checked 2026-10

Question 3

Which term matches this description? A stack resource whose content is flow-language JSON. Use it to move a flow between instances.

Show the cited answer

A stack resource whose content is flow-language JSON. Use it to move a flow between instances. The term is CloudFormation AWS::Connect::ContactFlow.

Connect Customer Flow language - Amazon Connect AWS docs. last checked 2026-10

Sources

HTML

Troubleshoot Lambda function failures in Amazon Connect | AWS re:Post community. last checked 2026-10

The prose is a study paraphrase. The link is the source of the facts.

Ecosystem

HTML

Glossary

  • Lambda synchronous timeout At most 8 seconds. The function's own timeout can be longer. The flow still takes the Error or Timeout branch at 8 seconds.
  • Lambda asynchronous mode The flow continues without waiting. You can wait up to 60 seconds with a Wait block. A sequence of Lambda calls must finish within 20 seconds.
  • String map A flat object of string keys and string values. One of the two Lambda response shapes.
  • CloudFormation AWS::Connect::ContactFlow A stack resource whose content is flow-language JSON. Use it to move a flow between instances.

Mind map

Open the Lambda mind map

Sister technologies

Most 'random' flow errors are a Lambda response that missed the timeout or the shape Connect accepts.

Config and troubleshooting

Adding lambda:InvokeFunction to the admin user and retesting the call.

Two pieces: a resource policy that trusts connect.amazonaws.com, and an integration association so the flow can select the function. The block still waits at most 8 seconds when InvocationType is SYNCHRONOUS.

Lambda functions IntegrationAssociation

CloudFormation study snippet
Resources:
  InvokePermission:
    Type: AWS::Lambda::Permission
    Properties:
      FunctionName: !Ref FlowHook
      Action: lambda:InvokeFunction
      Principal: connect.amazonaws.com
      SourceArn: !GetAtt CampusInstance.Arn
  LambdaAssociation:
    Type: AWS::Connect::IntegrationAssociation
    Properties:
      InstanceId: !GetAtt CampusInstance.Id
      IntegrationType: LAMBDA_FUNCTION
      IntegrationArn: !GetAtt FlowHook.Arn

Integration map

Join records on ContactId. The integration map room lists the seams.

Cross-platform bridges

A CUCM calling search space is not a routing profile, but the profile is the closest idea of 'who can receive what'. A partition is not a Connect object. A UCCX CSQ and a UCCE skill group map to a queue. Precision steps map to routing criteria. A script, an Architect flow, and an Avaya vector map to a contact flow.

Open the mapping room

Future hooks

Hooks you can adopt later: EventBridge contact events, the CTR stream, agent events, Kinesis Video, Customer Profiles events, Cases, Show view, data tables, External Tool, and the flow language JSON in your pipeline. Live Sync and Agentic CX are the 2026 hooks for guided and agentic experiences.

Sources and go deeper

sources.json