AWS connect documentation change
Summary
Formatting changes to use code blocks for IAM policy names and actions, added 'AWS managed policy' labels, and standardized permission list formatting
Security assessment
Changes are primarily formatting improvements (markdown syntax for code blocks) and organizational updates. No new security vulnerabilities or mitigations are introduced. The updates clarify existing security documentation but do not address specific security issues or add new security features.
Diff
diff --git a/connect/latest/adminguide/security-iam-amazon-connect-permissions.md b/connect/latest/adminguide/security-iam-amazon-connect-permissions.md index 22f2db814..1f690d6dd 100644 --- a//connect/latest/adminguide/security-iam-amazon-connect-permissions.md +++ b//connect/latest/adminguide/security-iam-amazon-connect-permissions.md @@ -13 +13 @@ If you're using custom [IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/in -Using **connect:*** in a custom IAM policy grants your users all of the Amazon Connect permissions listed in this article. +Using `connect:*` in a custom IAM policy grants your users all of the Amazon Connect permissions listed in this article. @@ -68 +68 @@ Certain pages on the Amazon Connect console, such as Tasks and Customer Profiles -## AmazonConnect_FullAccess policy +## AWS managed policy: AmazonConnect_FullAccess policy @@ -70 +70 @@ Certain pages on the Amazon Connect console, such as Tasks and Customer Profiles -To allow full read/write access to Amazon Connect, you must attach two policies to your users, groups, or roles. Attach the **AmazonConnect_FullAccess** policy and a custom policy with the following contents: +To allow full read/write access to Amazon Connect, you must attach two policies to your users, groups, or roles. Attach the `AmazonConnect_FullAccess` policy and a custom policy with the following contents: @@ -85 +85 @@ To allow full read/write access to Amazon Connect, you must attach two policies -To allow a user to create an instance, ensure that they have the permissions granted by the AmazonConnect_FullAccess policy. +To allow a user to create an instance, ensure that they have the permissions granted by the `AmazonConnect_FullAccess` policy. @@ -87 +87 @@ To allow a user to create an instance, ensure that they have the permissions gra -When you use AmazonConnect_FullAccess policy, note the following: +When you use `AmazonConnect_FullAccess` policy, note the following: @@ -89 +89 @@ When you use AmazonConnect_FullAccess policy, note the following: - * Additional privileges are required to create an Amazon S3 bucket with a name of your choosing, or to use an existing bucket while creating or updating an instance from the Amazon Connect admin website. If you choose default storage locations for your call recordings, chat transcripts, email messages, attachments, call transcripts, and other data, the system prepends "amazon-connect-" to those objects. + * Additional privileges are required to create an Amazon S3 bucket with a name of your choosing, or to use an existing bucket while creating or updating an instance from the Amazon Connect admin website. If you choose default storage locations for your call recordings, chat transcripts, email messages, attachments, call transcripts, and other data, the system prepends `"amazon-connect-"` to those objects. @@ -91 +91 @@ When you use AmazonConnect_FullAccess policy, note the following: - * The aws/connect KMS key is available to use as a default encryption option. To use a custom encryption key, assign users additional KMS privileges. + * The `aws/connect` KMS key is available to use as a default encryption option. To use a custom encryption key, assign users additional KMS privileges. @@ -98 +98 @@ When you use AmazonConnect_FullAccess policy, note the following: -## AmazonConnectReadOnlyAccess policy +## AWS managed policy: AmazonConnectReadOnlyAccess policy @@ -100 +100 @@ When you use AmazonConnect_FullAccess policy, note the following: -To allow read-only access, you need to attach only the **AmazonConnectReadOnlyAccess** policy. +To allow read-only access, you need to attach only the `AmazonConnectReadOnlyAccess` policy. @@ -112,4 +112,4 @@ Action/Use case | Permissions needed -List instance | connect:ListInstances ds:DescribeDirectories -Describe instance: View the details of the instance/ current settings | connect:DescribeInstance connect:ListLambdaFunctions connect:ListLexBots connect:ListInstanceStorageConfigs connect:ListApprovedOrigins connect:ListSecurityKeys connect:DescribeInstanceAttributes connect:DescribeInstanceStorageConfig ds:DescribeDirectories -Create instance | connect:AssociateCustomerProfilesDomain connect:CreateInstance connect:DescribeInstance connect:ListInstances connect:AssociateInstanceStorageConfig connect:UpdateInstanceAttribute ds:CheckAlias ds:CreateAlias ds:AuthorizeApplication ds:UnauthorizeApplication ds:CreateIdentityPoolDirectory ds:DescribeDirectories iam:CreateServiceLinkedRole iam:PutRolePolicy kms:CreateGrant kms:DescribeKey kms:ListAliases kms:RetireGrant logs:CreateLogGroup s3:CreateBucket s3:GetBucketLocation s3:ListAllMyBuckets servicequotas:GetServiceQuota profile:CreateDomain profile:GetDomain profile:GetProfileObjectType profile:ListAccountIntegrations profile:ListDomains profile:ListProfileObjectTypeTemplates profile:PutIntegration -Delete instance | connect:DescribeInstance connect:DeleteInstance connect:ListInstances ds:DescribeDirectories ds:DeleteDirectory ds:UnauthorizeApplication +List instance | `connect:ListInstances` `ds:DescribeDirectories` +Describe instance: View the details of the instance/ current settings | `connect:DescribeInstance` `connect:ListLambdaFunctions` `connect:ListLexBots` `connect:ListInstanceStorageConfigs` `connect:ListApprovedOrigins` `connect:ListSecurityKeys` `connect:DescribeInstanceAttributes` `connect:DescribeInstanceStorageConfig` `ds:DescribeDirectories` +Create instance | `connect:AssociateCustomerProfilesDomain` `connect:CreateInstance` `connect:DescribeInstance` `connect:ListInstances` `connect:AssociateInstanceStorageConfig` `connect:UpdateInstanceAttribute` `ds:CheckAlias` `ds:CreateAlias` `ds:AuthorizeApplication` `ds:UnauthorizeApplication` `ds:CreateIdentityPoolDirectory` `ds:DescribeDirectories` `iam:CreateServiceLinkedRole` `iam:PutRolePolicy` `kms:CreateGrant` `kms:DescribeKey` `kms:ListAliases` `kms:RetireGrant` `logs:CreateLogGroup` `s3:CreateBucket` `s3:GetBucketLocation` `s3:ListAllMyBuckets` `servicequotas:GetServiceQuota` `profile:CreateDomain` `profile:GetDomain` `profile:GetProfileObjectType` `profile:ListAccountIntegrations` `profile:ListDomains` `profile:ListProfileObjectTypeTemplates` `profile:PutIntegration` +Delete instance | `connect:DescribeInstance` `connect:DeleteInstance` `connect:ListInstances` `ds:DescribeDirectories` `ds:DeleteDirectory` `ds:UnauthorizeApplication` @@ -135 +135 @@ Action/Use case | Permissions needed -Create service-linked role | connect:DescribeInstance connect:ListInstances connect:DescribeInstanceAttribute connect:UpdateInstanceAttribute connect:ListIntegrationAssociations profile:ListAccountIntegrations ds:DescribeDirectories iam:CreateServiceLinkedRole iam:PutRolePolicy +Create service-linked role | `connect:DescribeInstance` `connect:ListInstances` `connect:DescribeInstanceAttribute` `connect:UpdateInstanceAttribute` `connect:ListIntegrationAssociations` `profile:ListAccountIntegrations` `ds:DescribeDirectories` `iam:CreateServiceLinkedRole` `iam:PutRolePolicy` @@ -141,4 +141,4 @@ Action/Use case | Permissions needed -View telephony options | connect:DescribeInstance -Enable/Disable telephony options | connect:UpdateInstanceAttribute -View outbound campaigns | connect-campaigns:GetConnectInstanceConfig connect-campaigns:GetInstanceOnboardingJobStatus connect:DescribeInstance connect:DescribeInstanceAttribute kms:DescribeKey -Enable/disable outbound campaigns | connect-campaigns:GetConnectInstanceConfig connect-campaigns:GetInstanceOnboardingJobStatus connect-campaigns:StartInstanceOnboardingJob connect-campaigns:DeleteInstanceOnboardingJob connect-campaigns:DeleteConnectInstanceConfig connect:DescribeInstance connect:DescribeInstanceAttribute connect:UpdateInstanceAttribute iam:CreateServiceLinkedRole iam:DeleteServiceLinkedRole iam:AttachRolePolicy iam:PutRolePolicy iam:DeleteRolePolicy events:PutRule events:PutTargets events:DeleteRule events:RemoveTargets events:DescribeRule events:ListTargetsByRule ds:DescribeDirectories kms:DescribeKey kms:ListKeys kms:CreateGrant kms:RetireGrant +View telephony options | `connect:DescribeInstance` +Enable/Disable telephony options | `connect:UpdateInstanceAttribute` +View outbound campaigns | `connect-campaigns:GetConnectInstanceConfig` `connect-campaigns:GetInstanceOnboardingJobStatus` `connect:DescribeInstance` `connect:DescribeInstanceAttribute` `kms:DescribeKey` +Enable/disable outbound campaigns | `connect-campaigns:GetConnectInstanceConfig` `connect-campaigns:GetInstanceOnboardingJobStatus` `connect-campaigns:StartInstanceOnboardingJob` `connect-campaigns:DeleteInstanceOnboardingJob` `connect-campaigns:DeleteConnectInstanceConfig` `connect:DescribeInstance` `connect:DescribeInstanceAttribute` `connect:UpdateInstanceAttribute` `iam:CreateServiceLinkedRole` `iam:DeleteServiceLinkedRole` `iam:AttachRolePolicy` `iam:PutRolePolicy` `iam:DeleteRolePolicy` `events:PutRule` `events:PutTargets` `events:DeleteRule` `events:RemoveTargets` `events:DescribeRule` `events:ListTargetsByRule` `ds:DescribeDirectories` `kms:DescribeKey` `kms:ListKeys` `kms:CreateGrant` `kms:RetireGrant` @@ -152,2 +152,2 @@ Action/Use case | Permissions needed -View call recording | connect:DescribeInstance connect:ListInstanceStorageConfigs connect:DescribeInstanceStorageConfig -Edit call recording | connect:AssociateInstanceStorageConfig connect:UpdateInstanceStorageConfig connect:DisassociateInstanceStorageConfig s3:ListAllMyBuckets s3:GetBucketLocation s3:GetBucketAcl s3:CreateBucket kms:CreateGrant kms:DescribeKey kms:ListAliases kms:RetireGrant iam:PutRolePolicy +View call recording | `connect:DescribeInstance` `connect:ListInstanceStorageConfigs` `connect:DescribeInstanceStorageConfig` +Edit call recording | `connect:AssociateInstanceStorageConfig` `connect:UpdateInstanceStorageConfig` `connect:DisassociateInstanceStorageConfig` `s3:ListAllMyBuckets` `s3:GetBucketLocation` `s3:GetBucketAcl` `s3:CreateBucket` `kms:CreateGrant` `kms:DescribeKey` `kms:ListAliases` `kms:RetireGrant` `iam:PutRolePolicy` @@ -159,2 +159,2 @@ Action/Use case | Permissions needed -View screen recording | connect:DescribeInstance connect:ListInstanceStorageConfigs connect:DescribeInstanceStorageConfig -Edit screen recording | connect:AssociateInstanceStorageConfig connect:UpdateInstanceStorageConfig connect:DisassociateInstanceStorageConfig s3:ListAllMyBuckets s3:GetBucketLocation s3:GetBucketAcl s3:CreateBucket iam:PutRolePolicy kms:CreateGrant kms:DescribeKey kms:ListAliases kms:RetireGrant +View screen recording | `connect:DescribeInstance` `connect:ListInstanceStorageConfigs` `connect:DescribeInstanceStorageConfig` +Edit screen recording | `connect:AssociateInstanceStorageConfig` `connect:UpdateInstanceStorageConfig` `connect:DisassociateInstanceStorageConfig` `s3:ListAllMyBuckets` `s3:GetBucketLocation` `s3:GetBucketAcl` `s3:CreateBucket` `iam:PutRolePolicy` `kms:CreateGrant` `kms:DescribeKey` `kms:ListAliases` `kms:RetireGrant` @@ -166,2 +166,2 @@ Action/Use case | Permissions needed -View chat transcripts | connect:DescribeInstance connect:DescribeInstanceStorageConfig connect:ListInstanceStorageConfigs -Edit chat transcripts | connect:AssociateInstanceStorageConfig connect:UpdateInstanceStorageConfig connect:DisassociateInstanceStorageConfig s3:ListAllMyBuckets s3:GetBucketLocation s3:GetBucketAcl s3:CreateBucket kms:CreateGrant kms:DescribeKey kms:ListAliases kms:RetireGrant iam:PutRolePolicy +View chat transcripts | `connect:DescribeInstance` `connect:DescribeInstanceStorageConfig` `connect:ListInstanceStorageConfigs` +Edit chat transcripts | `connect:AssociateInstanceStorageConfig` `connect:UpdateInstanceStorageConfig` `connect:DisassociateInstanceStorageConfig` `s3:ListAllMyBuckets` `s3:GetBucketLocation` `s3:GetBucketAcl` `s3:CreateBucket` `kms:CreateGrant` `kms:DescribeKey` `kms:ListAliases` `kms:RetireGrant` `iam:PutRolePolicy` @@ -173,2 +173,2 @@ Action/Use case | Permissions needed -View attachments | connect:DescribeInstance connect:DescribeInstanceStorageConfig connect:ListInstanceStorageConfigs -Edit attachments | connect:AssociateInstanceStorageConfig connect:UpdateInstanceStorageConfig connect:DisassociateInstanceStorageConfig s3:ListAllMyBuckets s3:GetBucketLocation s3:CreateBucket s3:GetBucketAcl kms:CreateGrant kms:DescribeKey kms:ListAliases kms:RetireGrant iam:PutRolePolicy +View attachments | `connect:DescribeInstance` `connect:DescribeInstanceStorageConfig` `connect:ListInstanceStorageConfigs` +Edit attachments | `connect:AssociateInstanceStorageConfig` `connect:UpdateInstanceStorageConfig` `connect:DisassociateInstanceStorageConfig` `s3:ListAllMyBuckets` `s3:GetBucketLocation` `s3:CreateBucket` `s3:GetBucketAcl` `kms:CreateGrant` `kms:DescribeKey` `kms:ListAliases` `kms:RetireGrant` `iam:PutRolePolicy` @@ -180,2 +180,2 @@ Action/Use case | Permissions needed -View live media streaming | connect:DescribeInstance connect:ListInstanceStorageConfigs connect:DescribeInstanceStorageConfig -Edit live media streaming | connect:AssociateInstanceStorageConfig connect:UpdateInstanceStorageConfig connect:DisassociateInstanceStorageConfig kms:CreateGrant kms:DescribeKey kms:RetireGrant iam:PutRolePolicy +View live media streaming | `connect:DescribeInstance` `connect:ListInstanceStorageConfigs` `connect:DescribeInstanceStorageConfig` +Edit live media streaming | `connect:AssociateInstanceStorageConfig` `connect:UpdateInstanceStorageConfig` `connect:DisassociateInstanceStorageConfig` `kms:CreateGrant` `kms:DescribeKey` `kms:RetireGrant` `iam:PutRolePolicy` @@ -187,2 +187,2 @@ Action/Use case | Permissions needed -View exported reports | connect:DescribeInstance connect:ListInstanceStorageConfigs connect:DescribeInstanceStorageConfig -Edit exported reports | connect:AssociateInstanceStorageConfig connect:UpdateInstanceStorageConfig connect: DisassociateInstanceStorageConfig s3:ListAllMyBuckets s3:GetBucketLocation s3:CreateBucket kms:DescribeKey kms:ListAliases kms:RetireGrant kms:CreateGrant iam:PutRolePolicy +View exported reports | `connect:DescribeInstance` `connect:ListInstanceStorageConfigs` `connect:DescribeInstanceStorageConfig` +Edit exported reports | `connect:AssociateInstanceStorageConfig` `connect:UpdateInstanceStorageConfig` `connect: DisassociateInstanceStorageConfig` `s3:ListAllMyBuckets` `s3:GetBucketLocation` `s3:CreateBucket` `kms:DescribeKey` `kms:ListAliases` `kms:RetireGrant` `kms:CreateGrant` `iam:PutRolePolicy` @@ -196,2 +196,2 @@ Action/Use case | Permissions needed -View data streaming - Contact records | connect:DescribeInstance connect:ListInstanceStorageConfigs connect:DescribeInstanceStorageConfig -Edit contact record | connect:AssociateInstanceStorageConfig connect:UpdateInstanceStorageConfig connect:DisassociateInstanceStorageConfig firehose:ListDeliveryStreams firehose:DescribeDeliveryStream kinesis:ListStreams kinesis:DescribeStream iam:PutRolePolicy +View data streaming - Contact records | `connect:DescribeInstance` `connect:ListInstanceStorageConfigs` `connect:DescribeInstanceStorageConfig` +Edit contact record | `connect:AssociateInstanceStorageConfig` `connect:UpdateInstanceStorageConfig` `connect:DisassociateInstanceStorageConfig` `firehose:ListDeliveryStreams` `firehose:DescribeDeliveryStream` `kinesis:ListStreams` `kinesis:DescribeStream` `iam:PutRolePolicy` @@ -203,2 +203,2 @@ Action/Use case | Permissions needed -View data streaming - Agent events | connect:DescribeInstance connect:ListInstanceStorageConfigs connect:DescribeInstanceStorageConfig -Edit agent events | connect:AssociateInstanceStorageConfig connect:UpdateInstanceStorageConfig connect:DisassociateInstanceStorageConfig kinesis:ListStreams kinesis: DescribeStream iam:PutRolePolicy +View data streaming - Agent events | `connect:DescribeInstance` `connect:ListInstanceStorageConfigs` `connect:DescribeInstanceStorageConfig` +Edit agent events | `connect:AssociateInstanceStorageConfig` `connect:UpdateInstanceStorageConfig` `connect:DisassociateInstanceStorageConfig` `kinesis:ListStreams` `kinesis: DescribeStream` `iam:PutRolePolicy` @@ -212,2 +212,2 @@ Action/Use case | Permissions needed -View flow security keys | connect:DescribeInstance connect:ListSecurityKeys -Add/remove flow security keys | connect:AssociateSecurityKey connect:DisassociateSecurityKey +View flow security keys | `connect:DescribeInstance` `connect:ListSecurityKeys` +Add/remove flow security keys | `connect:AssociateSecurityKey` `connect:DisassociateSecurityKey` @@ -219,2 +219,2 @@ Action/Use case | Permissions needed -View Lex bots | connect:ListLexBots connect:ListBots -Add/remove Lex bots | lex:GetBots lex:GetBot lex:CreateResourcePolicy lex:DeleteResourcePolicy lex:UpdateResourcePolicy lex:DescribeBotAlias lex:ListBotAliases lex:ListBots connect:AssociateBot connect:DisassociateBot connect:ListBots connect:AssociateLexBot connect:DisassociateLexBot connect:ListLexBots iam:PutRolePolicy +View Lex bots | `connect:ListLexBots` `connect:ListBots` +Add/remove Lex bots | `lex:GetBots` `lex:GetBot` `lex:CreateResourcePolicy` `lex:DeleteResourcePolicy` `lex:UpdateResourcePolicy` `lex:DescribeBotAlias` `lex:ListBotAliases` `lex:ListBots` `connect:AssociateBot` `connect:DisassociateBot` `connect:ListBots` `connect:AssociateLexBot` `connect:DisassociateLexBot` `connect:ListLexBots` `iam:PutRolePolicy` @@ -226,2 +226,2 @@ Action/Use case | Permissions needed -View Lambda functions | connect:ListLambdaFunctions -Add/remove Lambda functions | connect:ListLambdaFunctions connect:AssociateLambdaFunction connect:DisassociateLambdaFunction iam:PutRolePolicy lambda:ListFunctions lambda:AddPermission lambda:RemovePermission +View Lambda functions | `connect:ListLambdaFunctions` +Add/remove Lambda functions | `connect:ListLambdaFunctions` `connect:AssociateLambdaFunction` `connect:DisassociateLambdaFunction` `iam:PutRolePolicy` `lambda:ListFunctions` `lambda:AddPermission` `lambda:RemovePermission` @@ -233,2 +233,2 @@ Action/Use case | Permissions needed -View flow log config | connect:DescribeInstance connect:DescribeInstanceAttribute -Enable/disable flow log | logs:CreateLogGroup +View flow log config | `connect:DescribeInstance` `connect:DescribeInstanceAttribute` +Enable/disable flow log | `logs:CreateLogGroup` @@ -240,2 +240,2 @@ Action/Use case | Permissions needed -View Amazon Polly option | connect:DescribeInstance connect:DescribeInstanceAttribute -Update Amazon Polly option | connect:UpdateInstanceAttribute +View Amazon Polly option | `connect:DescribeInstance` `connect:DescribeInstanceAttribute` +Update Amazon Polly option | `connect:UpdateInstanceAttribute` @@ -247,2 +247,2 @@ Action/Use case | Permissions needed -View Contact Lens connectors | chime:GetVoiceConnector chime:GetVoiceConnectorLoggingConfiguration chime:GetVoiceConnectorTermination chime:GetVoiceConnectorTerminationHealth chime:ListVoiceConnectors chime:ListVoiceConnectorTerminationCredentials chime:GetVoiceConnectorExternalSystemsConfiguration -Add/Update/Remove Contact Lens connectors | chime:CreateVoiceConnector chime:DeleteVoiceConnector chime:DeleteVoiceConnectorTermination chime:DeleteVoiceConnectorTerminationCredentials chime:GetVoiceConnector chime:GetVoiceConnectorLoggingConfiguration chime:GetVoiceConnectorTermination chime:GetVoiceConnectorTerminationHealth chime:ListVoiceConnectors chime:ListVoiceConnectorTerminationCredentials chime:PutVoiceConnectorLoggingConfiguration chime:PutVoiceConnectorTermination chime:PutVoiceConnectorTerminationCredentials chime:UpdateVoiceConnector chime:CreateConnectAnalyticsConnector chime:PutVoiceConnectorExternalSystemsConfiguration chime:GetVoiceConnectorExternalSystemsConfiguration chime:DeleteVoiceConnectorExternalSystemsConfiguration chime:AssociateVoiceConnectorConnect chime:DisassociateVoiceConnectorConnect chime:TagResources chime:UntagResources chime:ListTagsForResource +View Contact Lens connectors | `chime:GetVoiceConnector` `chime:GetVoiceConnectorLoggingConfiguration` `chime:GetVoiceConnectorTermination` `chime:GetVoiceConnectorTerminationHealth` `chime:ListVoiceConnectors` `chime:ListVoiceConnectorTerminationCredentials` `chime:GetVoiceConnectorExternalSystemsConfiguration` +Add/Update/Remove Contact Lens connectors | `chime:CreateVoiceConnector` `chime:DeleteVoiceConnector` `chime:DeleteVoiceConnectorTermination` `chime:DeleteVoiceConnectorTerminationCredentials` `chime:GetVoiceConnector` `chime:GetVoiceConnectorLoggingConfiguration` `chime:GetVoiceConnectorTermination` `chime:GetVoiceConnectorTerminationHealth` `chime:ListVoiceConnectors` `chime:ListVoiceConnectorTerminationCredentials` `chime:PutVoiceConnectorLoggingConfiguration` `chime:PutVoiceConnectorTermination` `chime:PutVoiceConnectorTerminationCredentials` `chime:UpdateVoiceConnector` `chime:CreateConnectAnalyticsConnector` `chime:PutVoiceConnectorExternalSystemsConfiguration` `chime:GetVoiceConnectorExternalSystemsConfiguration` `chime:DeleteVoiceConnectorExternalSystemsConfiguration` `chime:AssociateVoiceConnectorConnect` `chime:DisassociateVoiceConnectorConnect` `chime:TagResources` `chime:UntagResources` `chime:ListTagsForResource` @@ -254,2 +254,2 @@ Action/Use case | Permissions needed -View external voice transfer connectors | chime:GetVoiceConnector chime:GetVoiceConnectorLoggingConfiguration chime:GetVoiceConnectorTermination chime:GetVoiceConnectorTerminationHealth chime:ListVoiceConnectors chime:ListVoiceConnectorTerminationCredentials chime:GetVoiceConnectorExternalSystemsConfiguration -Add/Update/Remove external voice transfer connectors | chime:CreateVoiceConnector chime:DeleteVoiceConnector chime:DeleteVoiceConnectorTermination chime:DeleteVoiceConnectorTerminationCredentials chime:GetVoiceConnector chime:GetVoiceConnectorLoggingConfiguration chime:GetVoiceConnectorTermination chime:GetVoiceConnectorTerminationHealth chime:ListVoiceConnectors chime:ListVoiceConnectorTerminationCredentials chime:PutVoiceConnectorLoggingConfiguration chime:PutVoiceConnectorTermination chime:PutVoiceConnectorTerminationCredentials chime:UpdateVoiceConnector chime:CreateConnectAnalyticsConnector chime:PutVoiceConnectorExternalSystemsConfiguration chime:GetVoiceConnectorExternalSystemsConfiguration chime:DeleteVoiceConnectorExternalSystemsConfiguration chime:AssociateVoiceConnectorConnect chime:DisassociateVoiceConnectorConnect chime:TagResources chime:UntagResources chime:ListTagsForResource +View external voice transfer connectors | `chime:GetVoiceConnector` `chime:GetVoiceConnectorLoggingConfiguration` `chime:GetVoiceConnectorTermination` `chime:GetVoiceConnectorTerminationHealth` `chime:ListVoiceConnectors` `chime:ListVoiceConnectorTerminationCredentials` `chime:GetVoiceConnectorExternalSystemsConfiguration` +Add/Update/Remove external voice transfer connectors | `chime:CreateVoiceConnector` `chime:DeleteVoiceConnector` `chime:DeleteVoiceConnectorTermination` `chime:DeleteVoiceConnectorTerminationCredentials` `chime:GetVoiceConnector` `chime:GetVoiceConnectorLoggingConfiguration` `chime:GetVoiceConnectorTermination` `chime:GetVoiceConnectorTerminationHealth` `chime:ListVoiceConnectors` `chime:ListVoiceConnectorTerminationCredentials` `chime:PutVoiceConnectorLoggingConfiguration` `chime:PutVoiceConnectorTermination` `chime:PutVoiceConnectorTerminationCredentials` `chime:UpdateVoiceConnector` `chime:CreateConnectAnalyticsConnector` `chime:PutVoiceConnectorExternalSystemsConfiguration` `chime:GetVoiceConnectorExternalSystemsConfiguration` `chime:DeleteVoiceConnectorExternalSystemsConfiguration` `chime:AssociateVoiceConnectorConnect` `chime:DisassociateVoiceConnectorConnect` `chime:TagResources` `chime:UntagResources` `chime:ListTagsForResource` @@ -261,2 +261,2 @@ Action/Use case | Permissions needed -View approved origins | connect:DescribeInstance connect:ListApprovedOrigins -Edit approved origins | connect: AssociateApprovedOrigin connect:ListApprovedOrigins connect:DisassociateApprovedOrigin +View approved origins | `connect:DescribeInstance` `connect:ListApprovedOrigins` +Edit approved origins | `connect: AssociateApprovedOrigin` `connect:ListApprovedOrigins` `connect:DisassociateApprovedOrigin` @@ -268,2 +268,2 @@ Action/Use case | Permissions needed -View customer profiles | app-integrations:ListEventIntegrations appflow:DescribeConnectorEntity appflow:DescribeConnectorProfiles appflow:DescribeFlow appflow:ListFlows appflow:ListConnectorEntities appflow:ListConnectorProfiles cloudwatch:GetMetricData connect:DescribeInstance connect:ListInstances ds:DescribeDirectories iam:ListRoles kinesis:DescribeStreamSummary kms:Decrypt kms:DescribeKey kms:GenerateDataKey kms:ListKeys profile:GetCalculatedAttributeDefinition profile:GetDomain profile:GetEventStream profile:GetIdentityResolutionJob profile:GetIntegration profile:GetProfileObjectType profile:GetProfileObjectTypeTemplate profile:GetWorkflow profile:ListAccountIntegrations profile:ListCalculatedAttributeDefinitions profile:ListDomains profile:ListDomainLayouts profile:ListEventStreams profile:ListIdentityResolutionJobs profile:ListIntegrations profile:ListProfileObjectTypes profile:ListProfileObjectTypeTemplates profile:ListSegmentDefinitions sqs:ListQueues -Edit customer profiles | app-integrations:CreateEventIntegration app-integrations:ListEventIntegrations appflow:CreateFlow appflow:CreateConnectorProfile appflow:DescribeFlow appflow:DeleteFlow appflow:DescribeConnectorEntity appflow:DescribeConnectorProfiles appflow:ListFlows appflow:ListConnectorEntities appflow:ListConnectorProfiles appflow:StartFlow cloudwatch:GetMetricData connect:DescribeInstance connect:ListInstances ds:DescribeDirectories events:CreateEventBus events:DescribeEventBus events:DescribeEventSource events:ListEventSources iam:CreateRole iam:CreatePolicy iam:AttachRolePolicy iam:ListRoles iam:PutRolePolicy kinesis:DescribeStreamSummary kinesis:ListStreams kms:CreateGrant kms:Decrypt kms:DescribeKey kms:GenerateDataKey kms:ListAliases kms:ListKeys kms:ListGrants profile:CreateCalculatedAttributeDefinition profile:CreateDomain profile:CreateDomainLayout profile:CreateEventStream profile:CreateIntegrationWorkflow profile:CreateSegmentDefinition profile:DeleteEventStream profile:DeleteIntegration profile:DeleteDomain profile:DeleteProfileObjectType profile:DetectProfileObjectType profile:GetCalculatedAttributeDefinition profile:GetDomain profile:GetEventStream profile:GetIdentityResolutionJob profile:GetIntegration profile:GetProfileObjectType profile:GetProfileObjectTypeTemplate profile:GetWorkflow profile:ListAccountIntegrations profile:ListCalculatedAttributeDefinitions profile:ListDomains profile:ListDomainLayouts profile:ListEventStreams profile:ListIdentityResolutionJobs profile:ListIntegrations profile:ListProfileObjectTypes profile:ListProfileObjectTypeTemplates profile:ListSegmentDefinitions profile:PutIntegration profile:PutProfileObjectType profile:TagResource profile:UntagResource profile:UpdateDomain s3:GetBucketLocation s3:GetBucketPolicy s3:GetObject s3:HeadBucket s3:ListAllMyBuckets s3:ListBucket s3:ListObjectsV2 s3:PutBucketPolicy s3:SelectObjectContent sqs:ListQueues +View customer profiles | `app-integrations:ListEventIntegrations` `appflow:DescribeConnectorEntity` `appflow:DescribeConnectorProfiles` `appflow:DescribeFlow` `appflow:ListFlows` `appflow:ListConnectorEntities` `appflow:ListConnectorProfiles` `cloudwatch:GetMetricData` `connect:DescribeInstance` `connect:ListInstances` `ds:DescribeDirectories` `iam:ListRoles` `kinesis:DescribeStreamSummary` `kms:Decrypt` `kms:DescribeKey` `kms:GenerateDataKey` `kms:ListKeys` `profile:GetCalculatedAttributeDefinition` `profile:GetDomain` `profile:GetEventStream` `profile:GetIdentityResolutionJob` `profile:GetIntegration` `profile:GetProfileObjectType` `profile:GetProfileObjectTypeTemplate` `profile:GetWorkflow` `profile:ListAccountIntegrations` `profile:ListCalculatedAttributeDefinitions` `profile:ListDomains` `profile:ListDomainLayouts` `profile:ListEventStreams` `profile:ListIdentityResolutionJobs` `profile:ListIntegrations` `profile:ListProfileObjectTypes` `profile:ListProfileObjectTypeTemplates` `profile:ListSegmentDefinitions` `sqs:ListQueues` +Edit customer profiles | `app-integrations:CreateEventIntegration` `app-integrations:ListEventIntegrations` `appflow:CreateFlow` `appflow:CreateConnectorProfile` `appflow:DescribeFlow` `appflow:DeleteFlow` `appflow:DescribeConnectorEntity` `appflow:DescribeConnectorProfiles` `appflow:ListFlows` `appflow:ListConnectorEntities` `appflow:ListConnectorProfiles` `appflow:StartFlow` `cloudwatch:GetMetricData` `connect:DescribeInstance` `connect:ListInstances` `ds:DescribeDirectories` `events:CreateEventBus` `events:DescribeEventBus` `events:DescribeEventSource` `events:ListEventSources` `iam:CreateRole` `iam:CreatePolicy` `iam:AttachRolePolicy` `iam:ListRoles` `iam:PutRolePolicy` `kinesis:DescribeStreamSummary` `kinesis:ListStreams` `kms:CreateGrant` `kms:Decrypt` `kms:DescribeKey` `kms:GenerateDataKey` `kms:ListAliases` `kms:ListKeys` `kms:ListGrants` `profile:CreateCalculatedAttributeDefinition` `profile:CreateDomain` `profile:CreateDomainLayout` `profile:CreateEventStream` `profile:CreateIntegrationWorkflow` `profile:CreateSegmentDefinition` `profile:DeleteEventStream` `profile:DeleteIntegration` `profile:DeleteDomain` `profile:DeleteProfileObjectType` `profile:DetectProfileObjectType` `profile:GetCalculatedAttributeDefinition` `profile:GetDomain` `profile:GetEventStream` `profile:GetIdentityResolutionJob` `profile:GetIntegration` `profile:GetProfileObjectType` `profile:GetProfileObjectTypeTemplate` `profile:GetWorkflow` `profile:ListAccountIntegrations` `profile:ListCalculatedAttributeDefinitions` `profile:ListDomains` `profile:ListDomainLayouts` `profile:ListEventStreams` `profile:ListIdentityResolutionJobs` `profile:ListIntegrations` `profile:ListProfileObjectTypes` `profile:ListProfileObjectTypeTemplates` `profile:ListSegmentDefinitions` `profile:PutIntegration` `profile:PutProfileObjectType` `profile:TagResource` `profile:UntagResource` `profile:UpdateDomain` `s3:GetBucketLocation` `s3:GetBucketPolicy` `s3:GetObject` `s3:HeadBucket` `s3:ListAllMyBuckets` `s3:ListBucket` `s3:ListObjectsV2` `s3:PutBucketPolicy` `s3:SelectObjectContent` `sqs:ListQueues` @@ -275,2 +275,2 @@ Action/Use case | Permissions needed -View Tasks integrations | app-integrations:GetEventIntegration connect:ListIntegrationAssociations -Edit Tasks integrations | app-integrations:CreateEventIntegration app-integrations:GetEventIntegration app-integrations:ListEventIntegrations app-integrations:DeleteEventIntegrationAssociation app-integrations:CreateEventIntegrationAssociation appflow:CreateFlow appflow:CreateConnectorProfile appflow:DescribeFlow appflow:DeleteFlow appflow:DeleteConnectorProfile appflow:DescribeConnectorEntity appflow:ListFlows appflow:ListConnectorEntities appflow:StartFlow connect:ListIntegrationAssociations connect:DeleteIntegrationAssociation connect:ListUseCases connect:DeleteUseCase events:ActivateEventSource events:CreateEventBus events:DescribeEventBus events:DescribeEventSource events:ListEventSources events:ListTargetsByRule events:PutRule events:PutTargets events:DeleteRule events:RemoveTargets kms:CreateGrant kms:DescribeKey kms:ListAliases kms:ListKeys kms:ListGrants +View Tasks integrations | `app-integrations:GetEventIntegration` `connect:ListIntegrationAssociations` +Edit Tasks integrations | `app-integrations:CreateEventIntegration` `app-integrations:GetEventIntegration` `app-integrations:ListEventIntegrations` `app-integrations:DeleteEventIntegrationAssociation` `app-integrations:CreateEventIntegrationAssociation` `appflow:CreateFlow` `appflow:CreateConnectorProfile` `appflow:DescribeFlow` `appflow:DeleteFlow` `appflow:DeleteConnectorProfile` `appflow:DescribeConnectorEntity` `appflow:ListFlows` `appflow:ListConnectorEntities` `appflow:StartFlow` `connect:ListIntegrationAssociations` `connect:DeleteIntegrationAssociation` `connect:ListUseCases` `connect:DeleteUseCase` `events:ActivateEventSource` `events:CreateEventBus` `events:DescribeEventBus` `events:DescribeEventSource` `events:ListEventSources` `events:ListTargetsByRule` `events:PutRule` `events:PutTargets` `events:DeleteRule` `events:RemoveTargets` `kms:CreateGrant` `kms:DescribeKey` `kms:ListAliases` `kms:ListKeys` `kms:ListGrants` @@ -282,2 +282,2 @@ Action/Use case | Permissions needed -View email domains and addresses | ses:GetIdentityVerificationAttributes ses:DescribeReceiptRule ses:DescribeActiveReceiptRuleSet ses:GetEmailIdentity ses:DescribeReceiptRuleSet ses:GetConfigurationSetEventDestinations ses:GetConfigurationSet -Edit email domains and addresses | ses:CreateReceiptRule ses:UpdateReceiptRule ses:SetActiveReceiptRuleSet ses:CreateReceiptRuleSet ses:CreateEmailIdentity ses:TagResource ses:UntagResource ses:DeleteReceiptRule ses:DeleteReceiptRuleSet ses:CloneReceiptRuleSet ses:CreateConfigurationSet ses:CreateConfigurationSetEventDestination ses:PutEmailIdentityConfigurationSetAttributes ses:CreateEmailIdentityPolicy ses:UpdateEmailIdentityPolicy ses:DeleteEmailIdentityPolicy iam:CreateServiceLinkedRole iam:PassRole iam:CreateRole iam:CreatePolicy +View email domains and addresses | `ses:GetIdentityVerificationAttributes` `ses:DescribeReceiptRule` `ses:DescribeActiveReceiptRuleSet` `ses:GetEmailIdentity` `ses:DescribeReceiptRuleSet` `ses:GetConfigurationSetEventDestinations` `ses:GetConfigurationSet` +Edit email domains and addresses | `ses:CreateReceiptRule` `ses:UpdateReceiptRule` `ses:SetActiveReceiptRuleSet` `ses:CreateReceiptRuleSet` `ses:CreateEmailIdentity` `ses:TagResource` `ses:UntagResource` `ses:DeleteReceiptRule` `ses:DeleteReceiptRuleSet` `ses:CloneReceiptRuleSet` `ses:CreateConfigurationSet` `ses:CreateConfigurationSetEventDestination` `ses:PutEmailIdentityConfigurationSetAttributes` `ses:CreateEmailIdentityPolicy` `ses:UpdateEmailIdentityPolicy` `ses:DeleteEmailIdentityPolicy` `iam:CreateServiceLinkedRole` `iam:PassRole` `iam:CreateRole` `iam:CreatePolicy` @@ -289,2 +289,2 @@ Action/Use case | Permissions needed -View Cases domain details | connect:ListInstances ds:DescribeDirectories connect:ListIntegrationAssociations cases:GetDomain -Onboard to Cases | connect:ListInstances connect:ListIntegrationAssociations cases:GetDomain cases:CreateDomain connect:CreateIntegrationAssociation connect:DescribeInstance iam:PutRolePolicy +View Cases domain details | `connect:ListInstances` `ds:DescribeDirectories` `connect:ListIntegrationAssociations` `cases:GetDomain` +Onboard to Cases | `connect:ListInstances` `connect:ListIntegrationAssociations` `cases:GetDomain` `cases:CreateDomain` `connect:CreateIntegrationAssociation` `connect:DescribeInstance` `iam:PutRolePolicy` @@ -296,2 +296,2 @@ Action/Use case | Permissions needed -View customer authentication | connect:ListIntegrationAssociations cognito-idp:ListUserPools cognito-idp:DescribeUserPool -Onboard to customer authentication | connect:CreateIntegrationAssociation connect:DeleteIntegrationAssociation connect:ListIntegrationAssociations cognito-idp:ListUserPools cognito-idp:DescribeUserPool cognito-idp:ListUserPoolClients cognito-idp:TagResource cognito-idp:CreateUserPool +View customer authentication | `connect:ListIntegrationAssociations` `cognito-idp:ListUserPools` `cognito-idp:DescribeUserPool` +Onboard to customer authentication | `connect:CreateIntegrationAssociation` `connect:DeleteIntegrationAssociation` `connect:ListIntegrationAssociations` `cognito-idp:ListUserPools` `cognito-idp:DescribeUserPool` `cognito-idp:ListUserPoolClients` `cognito-idp:TagResource` `cognito-idp:CreateUserPool` @@ -303,2 +303,2 @@ Action / Use case | Permissions needed -View outbound campaigns | connect:ListIntegrationAssociations connect:ListPhoneNumbersV2 connect:SearchEmailAddresses connect:DescribeInstance connect:DescribeInstanceAttribute kms:DescribeKey kms:ListKeys profile:ListAccountIntegrations profile:ListIntegrations profile:ListDomains profile:GetDomain wisdom:ListKnowledgeBases wisdom:GetKnowledgeBase connect-campaigns:GetInstanceOnboardingJobStatus connect-campaigns:GetConnectInstanceConfig connect-campaigns:ListConnectInstanceIntegrations -Create outbound campaigns | connect-campaigns:StartInstanceOnboardingJob connect-campaigns:DeleteInstanceOnboardingJob connect-campaigns:GetConnectInstanceConfig connect-campaigns:GetInstanceOnboardingJobStatus connect-campaigns:DeleteConnectInstanceConfig connect:DescribeInstance connect:DescribeInstanceAttribute connect:UpdateInstanceAttribute iam:CreateServiceLinkedRole iam:DeleteServiceLinkedRole iam:AttachRolePolicy iam:PutRolePolicy iam:DeleteRolePolicy events:PutRule events:PutTargets events:DeleteRule events:RemoveTargets events:DescribeRule events:ListTargetsByRule ds:DescribeDirectories kms:DescribeKey kms:ListKeys kms:CreateGrant kms:RetireGrant profile:CreateDomain profile:ListAccountIntegrations profile:ListIntegrations profile:PutIntegration profile:PutProfileObjectType connect:CreateIntegrationAssociation connect:ListIntegrationAssociations connect:UpdateInstanceAttribute connect:AssociateCustomerProfilesDomain connect-campaigns:ListConnectInstanceIntegrations connect-campaigns:PutConnectInstanceIntegration wisdom:CreateKnowledgeBase wisdom:ListKnowledgeBases +View outbound campaigns | `connect:ListIntegrationAssociations` `connect:ListPhoneNumbersV2` `connect:SearchEmailAddresses` `connect:DescribeInstance` `connect:DescribeInstanceAttribute` `kms:DescribeKey` `kms:ListKeys` `profile:ListAccountIntegrations` `profile:ListIntegrations` `profile:ListDomains` `profile:GetDomain` `wisdom:ListKnowledgeBases` `wisdom:GetKnowledgeBase` `connect-campaigns:GetInstanceOnboardingJobStatus` `connect-campaigns:GetConnectInstanceConfig` `connect-campaigns:ListConnectInstanceIntegrations` +Create outbound campaigns | `connect-campaigns:StartInstanceOnboardingJob` `connect-campaigns:DeleteInstanceOnboardingJob` `connect-campaigns:GetConnectInstanceConfig` `connect-campaigns:GetInstanceOnboardingJobStatus` `connect-campaigns:DeleteConnectInstanceConfig` `connect:DescribeInstance` `connect:DescribeInstanceAttribute` `connect:UpdateInstanceAttribute` `iam:CreateServiceLinkedRole` `iam:DeleteServiceLinkedRole` `iam:AttachRolePolicy` `iam:PutRolePolicy` `iam:DeleteRolePolicy` `events:PutRule` `events:PutTargets` `events:DeleteRule` `events:RemoveTargets` `events:DescribeRule` `events:ListTargetsByRule` `ds:DescribeDirectories` `kms:DescribeKey` `kms:ListKeys` `kms:CreateGrant` `kms:RetireGrant` `profile:CreateDomain` `profile:ListAccountIntegrations` `profile:ListIntegrations` `profile:PutIntegration` `profile:PutProfileObjectType` `connect:CreateIntegrationAssociation` `connect:ListIntegrationAssociations` `connect:UpdateInstanceAttribute` `connect:AssociateCustomerProfilesDomain` `connect-campaigns:ListConnectInstanceIntegrations` `connect-campaigns:PutConnectInstanceIntegration` `wisdom:CreateKnowledgeBase` `wisdom:ListKnowledgeBases` @@ -318,2 +318,2 @@ Action/Use case | Permissions needed -View Voice ID integrations | voiceid:DescribeDomain voiceid:ListDomains voiceid:RegisterComplianceConsent voiceid:DescribeComplianceConsent connect:ListIntegrationAssociations -Edit Voice ID integrations | voiceid:DescribeDomain voiceid:ListDomains voiceid:RegisterComplianceConsent voiceid:DescribeComplianceConsent voiceid:UpdateDomain voiceid:CreateDomain connect:ListIntegrationAssociations connect:CreateIntegrationAssociation connect:DeleteIntegrationAssociation events:PutRule events:DeleteRule events:PutTargets events:RemoveTargets iam:PutRolePolicy +View Voice ID integrations | `voiceid:DescribeDomain` `voiceid:ListDomains` `voiceid:RegisterComplianceConsent` `voiceid:DescribeComplianceConsent` `connect:ListIntegrationAssociations` +Edit Voice ID integrations | `voiceid:DescribeDomain` `voiceid:ListDomains` `voiceid:RegisterComplianceConsent` `voiceid:DescribeComplianceConsent` `voiceid:UpdateDomain` `voiceid:CreateDomain` `connect:ListIntegrationAssociations` `connect:CreateIntegrationAssociation` `connect:DeleteIntegrationAssociation` `events:PutRule` `events:DeleteRule` `events:PutTargets` `events:RemoveTargets` `iam:PutRolePolicy` @@ -325,3 +325,3 @@ Action/Use case | Permissions needed -View forecasting, capacity planning, and scheduling | connect:DescribeForecastingPlanningSchedulingIntegration -Enable forecasting, capacity planning, and scheduling | connect:UpdateInstanceAttribute connect:StartForecastingPlanningSchedulingIntegration -Disable forecasting, capacity planning, and scheduling | connect:UpdateInstanceAttribute connect:StopForecastingPlanningSchedulingIntegration +View forecasting, capacity planning, and scheduling | `connect:DescribeForecastingPlanningSchedulingIntegration` +Enable forecasting, capacity planning, and scheduling | `connect:UpdateInstanceAttribute` `connect:StartForecastingPlanningSchedulingIntegration` +Disable forecasting, capacity planning, and scheduling | `connect:UpdateInstanceAttribute` `connect:StopForecastingPlanningSchedulingIntegration` @@ -335 +335 @@ Action/Use case | Permissions needed -SAML federation | connect:GetFederationToken +SAML federation | `connect:GetFederationToken` @@ -341 +341 @@ Action/Use case | Permissions needed -Admin/Emergency federation | connect:AdminGetEmergencyAccessToken +Admin/Emergency federation | `connect:AdminGetEmergencyAccessToken`