Encryption is a key policy

About five minutes of reading

A customer-managed key you created and then forgot to share with Connect is an outage, not a security win.

Recordings and exported reports can use a customer-managed key. The key policy must allow the Connect service role to generate data keys and decrypt. CloudTrail should record key use. Rotation is available and does not re-encrypt old objects by itself.

TLS covers the CCP and the APIs in transit. That does not encrypt the recording at rest. Those are separate controls.

• Test a recording end to end after you change the key.
• A replica Region needs a key strategy you have actually written down.
• Do not use the same key for recordings and for unrelated application secrets if your blast radius matters.
• Access to the bucket and access to the key are both required to listen.

Number on this page: At rest KMS. Plus the bucket policy

Confirm before relying. Prices, quotas, and exam names change. Use the source linked on this page.

Picture from this room.

1. Key policy. Trust the role.
2. Call. One test.
3. Object. It exists.
4. Play. A permitted user can open it.

What usually goes wrong: Enabling the key in the console and not calling a test number.

Encryption at rest in Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10

The prose is a study paraphrase. The link is the source of the facts.

Glossary

• Security profile What a user may do in the admin site and the CCP. Different from an IAM policy.
• IAM policy What an AWS principal may call. Connect, Profiles, Cases, and agent assist use different IAM prefixes.
• Service-linked role The role AWS creates so Connect can write to S3, CloudWatch, and other services you name.
• KMS key policy The key's own allow list. Recordings stay unreadable if the key does not trust the Connect role.

Mind map

Open the Security, quotas, price mind map

Sister technologies

A design that cannot name its IAM prefix, its key, and its quota will fail the first real week.

Config and troubleshooting

Enabling the key in the console and not calling a test number.

A security profile is not an IAM policy. This statement allows two read actions on one instance ARN. Lambda's resource policy is a separate document.

Service authorization

Resources:
  OperatorPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - connect:DescribeInstance
              - connect:ListQueues
            Resource: !GetAtt CampusInstance.Arn

Integration map

Join records on ContactId. The integration map room lists the seams.

Cross-platform bridges

A CUCM calling search space is not a routing profile, but the profile is the closest idea of 'who can receive what'. A partition is not a Connect object. A UCCX CSQ and a UCCE skill group map to a queue. Precision steps map to routing criteria. A script, an Architect flow, and an Avaya vector map to a contact flow.

Open the mapping room

Future hooks

Hooks you can adopt later: EventBridge contact events, the CTR stream, agent events, Kinesis Video, Customer Profiles events, Cases, Show view, data tables, External Tool, and the flow language JSON in your pipeline. Live Sync and Agentic CX are the 2026 hooks for guided and agentic experiences.