AWS connect documentation change
Summary
Enhanced documentation for Amazon Connect email channel setup, including verification requirements for default email addresses, agent workflow details for outbound emails, and clarification of tag-based access control (TBAC) for email address visibility
Security assessment
The change introduces documentation about tag-based access control (TBAC) restricting email address visibility based on agent permissions. This improves security documentation by explaining how to enforce least-privilege access for email addresses. However, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/connect/latest/adminguide/setup-email-channel.md b/connect/latest/adminguide/setup-email-channel.md index 6045180e9..ccc50a25e 100644 --- a//connect/latest/adminguide/setup-email-channel.md +++ b//connect/latest/adminguide/setup-email-channel.md @@ -13 +13 @@ Following is an overview of the steps to set up the email channel for your conta - * [Create or update queues](./create-queue.html) for outbound email. In the **Outbound email configuration** section: + * [Create or update queues](./create-queue.html) for email: In the **Outbound email configuration** section: @@ -15 +15 @@ Following is an overview of the steps to set up the email channel for your conta - * **Default email address** : Specify the outbound email address that agents will use when sending an email. For example, if an agent is on the phone with a customer, and they need to email the customer instructions after the conversation, the agent can initiate an outbound email with this address. + * **Default email address** : Specify the outbound email address that is pre-selected for agents when they reply to or initiate emails. @@ -17 +17,21 @@ Following is an overview of the steps to set up the email channel for your conta - * **Outbound email flow** : Select the **Default outbound flow** from the dropdown menu, or select another flow that is type Outbound. + * This must be a verified email address within Amazon Connect (an email address created in Amazon Connect under an Amazon SES verified domain). + + * This should be the most commonly used email address for this queue. + + * For agent-initiated outbound emails, agents can send emails using the default email address from the default outbound queue configured in their routing profile. Agents can also select from the **Additional email addresses** configured on the queue, giving you flexibility to control which email addresses agents can use based on their role or team. + + * This model is similar to outbound voice contacts, where you specify the outbound caller ID and flow per queue, and agents use the default outbound queue from their routing profile. + + * **Outbound email flow** : Select a flow to execute for outbound emails sent from this queue. You can select the [Default outbound flow in Amazon Connect: "This call is not being recorded"](./default-outbound.html) or another flow that is type Outbound. + + * The outbound email flow you configure here applies to agent replies to inbound email contacts received on this queue, and agent-initiated outbound emails when this queue is selected as the default outbound queue in the agent's routing profile. + + * If you do not specify an outbound email flow, the [Default outbound flow in Amazon Connect: "This call is not being recorded"](./default-outbound.html) is automatically used for all outbound emails from this queue. + + * Similar to outbound voice contacts, configuring different outbound email flows per queue gives you flexibility to execute different contact flows based on the queue. This allows you to customize the outbound email experience for different teams, brands, or business units. + +In the **Additional email addresses** section: + + * **Search for email addresses** : Select up to 49 additional email addresses that agents can use when replying to or initiating emails. Agents can select from all configured email addresses (default plus additional) using a dropdown list in their workspace (see [Select a From email address](./agent-select-from-email.html)). You can configure up to 50 total email addresses per queue (1 default + 49 additional). + +The list of available email addresses respects [tag-based access control (TBAC)](https://docs.aws.amazon.com/connect/latest/adminguide/tag-based-access-control.html). Agents only see email addresses they have permission to use based on their assigned tags. @@ -25 +45 @@ In the routing profile: - * **Default outbound queue** defines the email address agents will use for any outbound emails they initiate. + * **Default outbound queue** defines the list of email addresses available to agents for any outbound emails they initiate. Agents can select from the email addresses configured on this queue.