AWS connect documentation change
Summary
Added granular permissions documentation for contact search access controls, including redacted/unredacted call recording/transcript access management based on hierarchy groups
Security assessment
Expands documentation about security features by detailing how to restrict sensitive data access (recordings/transcripts) through permission splits (redacted vs unredacted) and hierarchy-based filtering. Enhances guidance for least-privilege access but doesn't indicate a specific vulnerability being patched.
Diff
diff --git a/connect/latest/adminguide/contact-search.md b/connect/latest/adminguide/contact-search.md index 424b557dd..7a126ed39 100644 --- a//connect/latest/adminguide/contact-search.md +++ b//connect/latest/adminguide/contact-search.md @@ -5 +5 @@ -Important things to knowKey search featuresRequired permissionsHow to search for a contactAdditional fields: Add columns to your search resultsDownload search resultsAPIs to search contacts +Important things to knowKey search featuresManage who can search for contacts and access detailed informationHow to search for a contactAdditional fields: Add columns to your search resultsDownload search resultsAPIs to search contacts @@ -14,0 +15,23 @@ This topic is for administrators and contact center managers who need to search +###### Contents + + * Important things to know + + * Key search features + + * Manage who can search for contacts and access detailed information + + * How to search for a contact + + * Additional fields: Add columns to your search results + + * Download search results + + * APIs to search contacts + + * [Search for in-progress contacts in Amazon Connect](./search-in-progress-contacts.html) + + * [Search for contacts in Amazon Connect by using custom contact attributes or contact segment attributes](./search-custom-attributes.html) + + + + @@ -95 +118,3 @@ Before users can search for contacts in Amazon Connect, or access detailed conta - * **Restrict contact access** (Optional): Manage a user's access to results on the **Contact search** page based on their agent hierarchy group. + * **Restrict contact access** (Optional): Manage a user's access to results on the **Contact search** page based on their agent hierarchy group. For example: + + * Agents who are assigned to AgentGroup-1 can only view contact records for contacts handled by agents in that hierarchy group, and any groups below them. (If they have permissions for **Recorded conversations** , they can also listen to call recordings and view transcripts.) @@ -97 +122 @@ Before users can search for contacts in Amazon Connect, or access detailed conta -For example, agents who are assigned to AgentGroup-1 can only view contact records for contacts handled by agents in that hierarchy group, and any groups below them. (If they have permissions for **Recorded conversations** , they can also listen to call recordings and view transcripts.) Agents assigned to AgentGroup-2 can only access contact records for contacts handled by their group, and any groups below them. + * Agents assigned to AgentGroup-2 can only access contact records for contacts handled by their group, and any groups below them. @@ -99 +124 @@ For example, agents who are assigned to AgentGroup-1 can only view contact recor -Managers and others who are in higher level groups can view contact records for contacts handled by all the groups below them, such as AgentGroup-1 and 2. + * Managers and others who are in higher level groups can view contact records for contacts handled by all the groups below them, such as AgentGroup-1 and 2. @@ -111 +136 @@ For more information about hierarchy groups, see [Organize agents into teams and -The following table lists the typical permissions and what contacts can be views on Contact search and Contact details pages. +The following table lists the typical permissions and what contacts can be views on **Contact search** and **Contact details** pages. @@ -126 +151,5 @@ We do not recommend assigning permissions in any other combination than what is - * **Recorded conversations (redacted)** : If your organization uses Contact Lens, you can assign this permission so agents access only those call recordings and transcripts in which sensitive data has been removed. + * **Call recordings (redacted) - Access** : If your organization uses Contact Lens, you can assign this permission so agents access only those agent call recordings in which sensitive data has been redacted. + + * **Contact transcripts (redacted) - Access** : If your organization uses Contact Lens, you can assign this permission so agents access only those contact transcripts in which sensitive data has been redacted. + + * **Call recordings (unredacted) - Access** : Use this permission to manage who can access recordings on the **Contact search** and **Contact details** pages. If desired, you can use **Restrict contact access** to ensure they only have access to detailed information for those contacts handled by their hierarchy group. @@ -128 +157 @@ We do not recommend assigning permissions in any other combination than what is - * **Recorded conversations (unredacted)** : If your organization isn't using Contact Lens, agents need **Recorded conversations (unredacted)** to listen to call recordings or view transcripts. If desired, you can use **Restrict contact access** to ensure they only have access to detailed information for those contacts handled by their hierarchy group. + * **Contact transcripts (unredacted) - Access** : Use this permission to manage who can view unredacted chat and email conversations, and unredacted voice transcripts produced by Contact Lens on the **Contact search** and **Contact details** pages. If desired, you can use **Restrict contact access** to ensure they only have access to detailed information for those contacts handled by their hierarchy group.