Learn it in 5 minutes
HTMLAbout five minutes of reading
Sign-in can succeed when media cannot. Those are different allow lists.
Signaling and the UI use TCP 443 to the instance, CloudFront, and the transport domains. Media uses UDP 3478 to TurnNlb. The docs recommend Option 1, the domain list, and ask you to test more than 200 calls.
VDI and VPN are the usual reasons a lab works and the floor does not. Media should go directly to AWS.
- Supported browsers only. A locked-down browser without WebRTC permissions fails closed.
- Headsets with their own DSP can still be fine. Browser permission for the microphone is not optional.
- The Endpoint Connectivity tool is the first test, before a packet capture.
- Stateless firewalls need ephemeral UDP back in.
Number on this page: Test size 200. Calls before you trust a new proxy
Glossary
- CCP Contact Control Panel. The browser phone and contact UI the agent uses.
- Agent workspace The fuller desktop around the CCP: profiles, cases, step-by-step views, and third-party apps.
- Streams API The amazon-connect-streams library. It embeds or replaces the CCP and listens to agent and contact events.
- Softphone media The WebRTC audio path. It needs outbound UDP 3478 to the Regional TurnNlb domain.
Mind map
Open the CCP and workspace mind map
Sister technologies
If UDP 3478 is blocked, the agent is signed in and cannot hear the customer.
Config and troubleshooting
Blaming the carrier for a softphone that never established ICE.
A custom CCP using amazon-connect-streams has to be served from an origin you approve on the instance. The softphone still needs UDP 3478. Approving the origin does not open that port.
ApprovedOrigin Streams
CloudFormation study snippet
Resources:
CcpOrigin:
Type: AWS::Connect::ApprovedOrigin
Properties:
InstanceId: !GetAtt CampusInstance.Id
Origin: https://ccp.example.com
Integration map
Join records on ContactId. The integration map room lists the seams.
Cross-platform bridges
A CUCM calling search space is not a routing profile, but the profile is the closest idea of 'who can receive what'. A partition is not a Connect object. A UCCX CSQ and a UCCE skill group map to a queue. Precision steps map to routing criteria. A script, an Architect flow, and an Avaya vector map to a contact flow.
Open the mapping room
Future hooks
Hooks you can adopt later: EventBridge contact events, the CTR stream, agent events, Kinesis Video, Customer Profiles events, Cases, Show view, data tables, External Tool, and the flow language JSON in your pipeline. Live Sync and Agentic CX are the 2026 hooks for guided and agentic experiences.