Connect LabAmazon Connect study

Security, quotas, price

SAML, least privilege, and the admin you forgot

Learn it in 5 minutes

HTML

About five minutes of reading

Federation does not remove the need for a break-glass admin, and it does not make that admin safe.

Use SAML for agents. Keep one local emergency admin whose password is vaulted. Security profiles should split flow editors, user admins, recording listeners, and people who may export contacts.

IAM for builders should be a role they assume, with the instance ARN, not a long-lived key in a flow.

  • Review security profiles when someone changes jobs.
  • Recording access is a security profile permission. Treat it like access to the conversation, because it is.
  • CloudTrail the control plane.
  • Global Resiliency sign-in uses an extra endpoint. The IdP and the firewall both need it.

Number on this page: Profiles 100. Security profiles per instance, default

Visual

HTML
SAML, least privilege, and the admin you forgot
Diagram SVGDiagram PNGDiagram HTMLFlow SVGFlow PNGFlow HTML

Security profile versus assumed IAM role.

Worked example

HTML
  1. Federate. Agents.
  2. Split. Who may edit flows and hear recordings.
  3. Vault. One break-glass admin.
  4. Review. On a schedule.

What usually goes wrong: Everyone is an admin because the first week was busy.

Quiz

HTML

Question 1

Which term matches this description? The form of the product that does not include every Connect Customer feature. Voice on this form is listed at 0.018 USD per minute plus telephony.

Show the cited answer

The form of the product that does not include every Connect Customer feature. Voice on this form is listed at 0.018 USD per minute plus telephony. The term is Connect Customer Basic.

Amazon Connect Customer Pricing Appendix - AWS AWS docs. last checked 2026-10

Question 2

Which term matches this description? What a user may do in the admin site and the CCP. Different from an IAM policy.

Show the cited answer

What a user may do in the admin site and the CCP. Different from an IAM policy. The term is Security profile.

List of security profile permissions in Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10

Question 3

Which term matches this description? The key's own allow list. Recordings stay unreadable if the key does not trust the Connect role.

Show the cited answer

The key's own allow list. Recordings stay unreadable if the key does not trust the Connect role. The term is KMS key policy.

Encryption at rest in Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10

Sources

HTML

List of security profile permissions in Connect Customer - Amazon Connect Customer AWS docs. last checked 2026-10

The prose is a study paraphrase. The link is the source of the facts.

Ecosystem

HTML

Glossary

  • Security profile What a user may do in the admin site and the CCP. Different from an IAM policy.
  • IAM policy What an AWS principal may call. Connect, Profiles, Cases, and agent assist use different IAM prefixes.
  • Service-linked role The role AWS creates so Connect can write to S3, CloudWatch, and other services you name.
  • KMS key policy The key's own allow list. Recordings stay unreadable if the key does not trust the Connect role.

Mind map

Open the Security, quotas, price mind map

Sister technologies

A design that cannot name its IAM prefix, its key, and its quota will fail the first real week.

Config and troubleshooting

Everyone is an admin because the first week was busy.

A security profile is not an IAM policy. This statement allows two read actions on one instance ARN. Lambda's resource policy is a separate document.

Service authorization

CloudFormation study snippet
Resources:
  OperatorPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - connect:DescribeInstance
              - connect:ListQueues
            Resource: !GetAtt CampusInstance.Arn

Integration map

Join records on ContactId. The integration map room lists the seams.

Cross-platform bridges

A CUCM calling search space is not a routing profile, but the profile is the closest idea of 'who can receive what'. A partition is not a Connect object. A UCCX CSQ and a UCCE skill group map to a queue. Precision steps map to routing criteria. A script, an Architect flow, and an Avaya vector map to a contact flow.

Open the mapping room

Future hooks

Hooks you can adopt later: EventBridge contact events, the CTR stream, agent events, Kinesis Video, Customer Profiles events, Cases, Show view, data tables, External Tool, and the flow language JSON in your pipeline. Live Sync and Agentic CX are the 2026 hooks for guided and agentic experiences.

Sources and go deeper

sources.json