AWS connect medium security documentation change

Service: connect · 2026-01-22 · Security-related medium

File: connect/latest/adminguide/message-streaming-ai-chat.md

Summary

Added requirements for Lex bot permissions when enabling message streaming, including policy updates and example IAM policy snippet. Removed CreateParticipant API from third-party bot options.

Security assessment

The change adds mandatory permissions (lex:RecognizeMessageAsync) to Lex bot policies, which is a security control to limit AWS service access. Without this permission, Amazon Connect cannot interact with Lex bots, potentially causing service disruption. The explicit permission requirement demonstrates a security boundary enforcement.

Diff

diff --git a/connect/latest/adminguide/message-streaming-ai-chat.md b/connect/latest/adminguide/message-streaming-ai-chat.md
index 7860361f6..98daae6d5 100644
--- a//connect/latest/adminguide/message-streaming-ai-chat.md
+++ b//connect/latest/adminguide/message-streaming-ai-chat.md
@@ -4,0 +5,2 @@
+Update Lex bot permissions
+
@@ -19 +21 @@ The following are integration options, along with features of each option:
-  * Third-party bots via Amazon Lex, Lambda, or the [CreateParticipant](https://docs.aws.amazon.com/connect/latest/APIReference/API_CreateParticipant.html) API
+  * Third-party bots via Amazon Lex or Lambda
@@ -27,0 +30,57 @@ The following are integration options, along with features of each option:
+Instances created starting December 2025 are automatically opted into this feature.
+
+To opt out of this feature, call the [UpdateInstanceAttribute](https://docs.aws.amazon.com/connect/latest/APIReference/API_UpdateInstanceAttribute.html) API and set the `MESSAGE_STREAMING` attribute to `false`. To opt instances into this feature, set this attribute to `true`.
+
+## Update Lex bot permissions
+
+After message streaming is enabled, Amazon Connect needs permission to call the Amazon Lex API:
+    
+    
+    lex:RecognizeMessageAsync
+
+You must update the resource-based policy for each Amazon Lex bot alias used by the Amazon Connect instance.
+
+### When to update the bot's resource-based policy
+
+  * **New instances** – Any newly associated Amazon Lex bot alias will have `lex:RecognizeMessageAsync` in its alias policy by default.
+
+  * **Existing instances with existing bots** – If the instance previously used Amazon Lex and you enable message streaming now, you must update the resource-based policy on all associated Amazon Lex bot aliases to include the new permission.
+
+
+
+
+### Example snippet for Lex bot alias resource-based policy
+    
+    
+    {
+      "Version": "2012-10-17",		 	 	 
+      "Statement": [
+        {
+          "Sid": "connect-us-west-2-MYINSTANCEID",
+          "Effect": "Allow",
+          "Principal": {
+            "Service": "connect.amazonaws.com"
+          },
+          "Action": [
+            "lex:RecognizeMessageAsync",
+            "lex:RecognizeText"
+          ],
+          "Resource": "arn:aws:lex:us-west-2:123456789012:bot-alias/MYBOT/MYBOTALIAS",
+          "Condition": {
+            "StringEquals": {
+              "AWS:SourceAccount": "123456789012"
+            },
+            "ArnEquals": {
+              "AWS:SourceArn": "arn:aws:connect:us-west-2:123456789012:instance/MYINSTANCEID"
+            }
+          }
+        }
+      ]
+    }
+
+You can add this permission by calling the Amazon Lex [UpdateResourcePolicy](https://docs.aws.amazon.com/lexv2/latest/APIReference/API_UpdateResourcePolicy.html) API to update the Amazon Lex bot alias resource-based policy to include the `lex:RecognizeMessageAsync` action for the Amazon Connect instance ARN resource.
+
+###### Important
+
+This feature currently does not support branching back to the same [Flow block in Amazon Connect: Get customer input](./get-customer-input.html) flow block or reusing a Amazon Lex bot with the same alias in another **Get customer input** block. Instead, create a new **Get customer input** block using a different Amazon Lex bot alias.
+