Amazon Connect IAM Roles and Provisioning Policies for Service Cloud Voice

AWS IAM Role

To enable a trusted relationship with the Salesforce Management AWS account, create an Identity and Access Management (IAM) role during setup. Using this role, Salesforce configures artifacts in your Amazon Connect instance that are required for Service Cloud Voice. These resources are nondestructive IAM permissions, such as resetPassword and delete and deactivate roles.

To define access, add policies to the IAM role. The requirements for this role are based on these principles.

• Following the principle of least privilege, we granted this role the minimum level of permissions needed to perform its job.
• We built enough flexibility into this role to add new features and enhancements in the future.
• To reduce the footprint, all permissions and restrictions are included in one IAM role policy: SCVProvisioningPolicy.json.
• This role includes only the permission to the services required by Service Cloud Voice. 
• To mitigate security risk associated with Service Cloud Voice Provisioning Service, add an IAM permissions boundary.

See Configure AWS Identity and Access Management (IAM) Role for Voice.

AWS IAM Role for GovCloud

If you operate in the public sector domain in the US and uses the AWS GovCloud region, use the SCVGovProvisioningPolicy.json file available on GitHub. The value of GOV prod MPA account ID must be 383319876315.

If you operate in the public sector domain in the US but uses the commercial AWS account, you can use the general SCVProvisioningPolicy.json file.

Wildcard Access

The WildcardAccess section lists all resources that have wildcard-service actions and wildcard-resource access. The ds (directory service) and logs (cloud watch logs) policies require wildcard access for provisioning and run-time actions.

The Lambda service also has wildcard actions.

Event Access

The EventAccess section defines who has access to the events. Only the Lambda functions in the Resource section have access to events.

LambdaEventSourceAccess

The LambdaEventSourceAccess section lists which Lambda functions can act on an event triggered by AWS resources. You can map only the specified Lambda functions to event sources. For example, you can map the CTRStream event source to CTRDataSyncFunction and the S3 event source to VoiceMailAudioProcessingFunction.

LambdaAccess

The LambdaAccess section imposes resource-based restrictions on Lambda access. To prevent unwanted access to user-defined Lambda functions, Salesforce provisions and works only with the specified Lambda functions.

S3Write

The S3Write section defines the policy for the S3-related actions. Service Cloud Voice Provisioning Service creates two S3 buckets for your Salesforce org. One bucket stores the conversation audio recording files. The second stores all AWS activity captured by the CloudTrail service. The IAM Policies and Roles Matrix in this page references S3 buckets that are required to download Lambda function code and layer code. 

ResourceBasedAccess

The ResourceBasedAccess section grants wildcard access to the actions of different services. This section lists the resource regular expressions (regexes) that are required only for the Service Cloud Voice Provisioning Service. These resources are in your AWS account with ID AWS_ACCOUNT_ID.

IAMAccess

Service Cloud Voice Provisioning Service creates Lambda functions. Some functions are application-specific, such as pausing and resuming call recordings, and generating presigned S3 credentials for playing back audio recordings. All these functions use the IAM role and are based on Salesforce infrastructure security. Service Cloud Voice adds required actions on IAM roles. The IAM role that you create grants access only to those IAM role resources that Service Cloud Voice requires. They’re nondestructive IAM permissions, such as resetPassword and delete and deactivate roles.

CloudformationAccess

The CloudformationAccess section lists all AWS CloudFormation actions that Service Cloud Voice requires. Service Cloud Voice provisions two Cloudformation stacks. One stack is in the us-east-1 region and sets up AWS account-level infrastructure, such as IAM Roles, Identity Provider, and CloudTrail. The other stack is in the contact center region of your choice. This CloudFormation access is constrained by the resource-level restrictions.

ConnectAccess

The ConnectAccess section grants fine-grained Amazon Connect permissions that are required to operate the contact center.

IAM Policies and Roles Matrix

During provisioning, these IAM policies and roles are created automatically in your AWS account.

ssm:GetParameter*
ssm:PutParameter
ssm:DeleteParameter*

arn:aws:ssm:*:${AWS::AccountId}:parameter/*-salesforce-*
arn:aws:ssm:*:${AWS::AccountId}:parameter/*-scrt-jwt-auth-private-key

lambda:InvokeFunction
lambda:InvokeAsync
lambda:ListFunctions
lambda:AddPermission
lambda:RemovePermission

VoiceMailTranscribeFunction
ContactLensProcessorFunction
kvsTranscriber
kvsConsumerTrigger
InvokeTelephonyIntegrationApiFunction
ContactLensProcessorFunction
ContactLensConsumerFunction
CTRDataSyncFunction
InvokeSalesforceRestApiFunction
AuthKeysSSMUtilFunction
HandleContactEventsFunction
CustomSSMFunction
RealtimeAlert
ConnectConfigurationFunction
S3BucketPolicyConfigurationFunction
S3BucketPolicyConfigurationFunction
S3BucketEventBridgeConfigurationFunction
TDGConfigurationFunction
VoiceMailAudioProcessingFunction
VoiceMailTranscribeFunction
VoiceMailPackagingFunction

kms:CreateGrant
kms:DescribeKey
kms:ListAliases
kms:RetireGrant
kms:Decrypt
Resource:
alias/aws/kinesisvideo
alias/aws/lambda
alias/aws/ssm
Action:
kms:CreateGrant
kms:DescribeKey
kms:ListAliases
kms:RetireGrant
kms:Decrypt

KMS keys tagged with resourceOwner:scv

"connect:Get*",
"connect:List*",
"connect:Search*",
"connect:Describe*",
"connect:AssociateApprovedOrigin",
"connect:AssociateInstanceStorageConfig",
"connect:AssociateLambdaFunction",
"connect:AssociatePhoneNumberContactFlow",
"connect:AssociateQueueQuickConnects",
"connect:AssociateRoutingProfileQueues",
"connect:AssociateTrafficDistributionGroupUser",
"connect:CreateContactFlow",
"connect:CreateInstance",
"connect:CreateHoursOfOperation",
"connect:CreateContactFlowModule",
"connect:CreateQueue",
"connect:CreateQuickConnect",
"connect:CreateRoutingProfile",
"connect:CreateTrafficDistributionGroup",
"connect:CreateUser",
"connect:ReplicateInstance",
"connect:StartOutboundVoiceContact",
"connect:TagResource",
"connect:UpdateTrafficDistribution",
"connect:UpdateQuickConnectName",
"connect:UpdateInstanceAttribute",
"connect:UpdateHoursOfOperation",
"connect:UpdateQueueName",
"connect:DeleteQueue",
"connect:DeleteUser",
"connect:DisassociateLambdaFunction",
"connect:DisassociateApprovedOrigin",
"connect:DisassociateQueueQuickConnects",
"connect:DisassociateTrafficDistributionGroupUser"

"ssm:Describe*",
"ssm:Get*",
"ssm:List*",
"ssm:Put*",
"lambda:*"

"kinesis:DescribeStream",
"kinesis:DescribeStreamSummary",
"kinesis:GetRecords",
"kinesis:GetShardIterator",
"kinesis:ListShards",
"kinesis:ListStreams",
"kinesis:SubscribeToShard",
"kms:Decrypt",
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents",
"lambda:InvokeFunction"

"CTRStream",
"ContactLensStream"

secretsmanager:GetSecretValue  
secretsmanager:DescribeSecret  
secretsmanager:UpdateSecret    
secretsmanager:CreateSecret 

arn:${AWS::Partition}:secretsmanager:*:${AWS::AccountId}:secret:*-salesforce-*

IAM Roles with Policies Created by Service Cloud Voice Provisioning Service

With the exception of a few IAM roles, Service Cloud Voice Provisioning Service creates the IAM roles at runtime. The Provisioning Service creates the SCVIDPLambdaRole, SCVAmazonConnectManagementRole, SCVConnectConfiguratorLambdaRole roles during setup.

{
"Action": "connect:GetFederationToken",
"Resource": [
"arn:aws:connect:*:403503132786:instance/83ccfc13-d248-4768-af7c-9970643cb520/user/${aws:userid}"
],
"Effect": "Allow",
"Sid": "ConnectSSOPolicySid"
}

{
"Action": [
"connect:SuspendContactRecording",
"connect:ResumeContactRecording"
],
"Resource": "arn:aws:connect:*:AWS ACCOUNT NUMBER :instance/AMAZON CONNECT INSTANCE ID/contact/*",
"Effect": "Allow",
"Sid": "ConnectCallRoleSid"
}

Permission Boundary

Some resources have wildcard access and service actions. To set up tighter access, create permission boundaries.