AWS connecthealth documentation change

Service: connecthealth · 2026-04-25 · Documentation low

File: connecthealth/latest/userguide/security-iam.md

Summary

Updated IAM policy with numerous permission changes including adding CloudFormation, Connect, Health Agent, HealthLake, IAM, KMS, Lambda, Lex, Organizations, S3, SSO permissions and reorganizing existing permissions.

Security assessment

The change updates IAM policy documentation which is security-related documentation. However, there is no evidence this addresses a specific security vulnerability or incident. The changes appear to be routine updates to the required permissions for the Amazon Connect Health service, adding new service integrations (like Lex, Lambda, S3) and reorganizing existing permissions. This is normal IAM policy maintenance as services evolve.

Diff

diff --git a/connecthealth/latest/userguide/security-iam.md b/connecthealth/latest/userguide/security-iam.md
index d30d8bc45..1a69b6eef 100644
--- a//connecthealth/latest/userguide/security-iam.md
+++ b//connecthealth/latest/userguide/security-iam.md
@@ -99,0 +100,18 @@ Full access console policy:
+            "cloudformation:CreateStack",
+            "cloudformation:DescribeStackEvents",
+            "cloudformation:DescribeStacks",
+            "cloudformation:GetTemplate",
+            "cloudformation:ListStacks",
+            "connect:AssociatePhoneNumberContactFlow",
+            "connect:ClaimPhoneNumber",
+            "connect:DescribeInstance",
+            "connect:DescribePhoneNumber",
+            "connect:ListInstances",
+            "connect:ListPhoneNumbersV2",
+            "connect:ReleasePhoneNumber",
+            "connect:SearchAvailablePhoneNumbers",
+            "connect:TagResource",
+            "connect:UpdatePhoneNumber",
+            "connect:UpdatePhoneNumberMetadata",
+            "ds:DescribeDirectories",
+            "health-agent:CreateAgent",
@@ -100,0 +119,2 @@ Full access console policy:
+            "health-agent:CreateIntegration",
+            "health-agent:DeleteAgent",
@@ -102 +122,3 @@ Full access console policy:
-            "health-agent:ListDomains",
+            "health-agent:DeleteIntegration",
+            "health-agent:GenerateMedicalCodes",
+            "health-agent:GetAgent",
@@ -104,3 +125,0 @@ Full access console policy:
-            "health-agent:StartPatientInsightsJob",
-            "health-agent:GetPatientInsightsJob",
-            "health-agent:CreateIntegration",
@@ -108,3 +127 @@ Full access console policy:
-            "health-agent:UpdateIntegration",
-            "health-agent:DeleteIntegration",
-            "health-agent:ListIntegrations",
+            "health-agent:GetPatientInsightsJob",
@@ -112,3 +129,2 @@ Full access console policy:
-            "health-agent:CreateAgent",
-            "health-agent:UpdateAgent",
-            "health-agent:GetAgent",
+            "health-agent:ListDomains",
+            "health-agent:ListIntegrations",
@@ -116 +132,3 @@ Full access console policy:
-            "health-agent:DeleteAgent",
+            "health-agent:StartPatientInsightsJob",
+            "health-agent:UpdateAgent",
+            "health-agent:UpdateIntegration",
@@ -117,0 +136 @@ Full access console policy:
+            "healthlake:SearchEverything",
@@ -120,6 +138,0 @@ Full access console policy:
-            "healthlake:SearchEverything",
-            "organizations:DescribeOrganization",
-            "organizations:ListAccounts",
-            "iam:CreateRole",
-            "iam:PutRolePolicy",
-            "iam:CreatePolicy",
@@ -127 +140 @@ Full access console policy:
-            "iam:PassRole",
+            "iam:CreatePolicy",
@@ -128,0 +142,2 @@ Full access console policy:
+            "iam:CreateRole",
+            "iam:CreateServiceLinkedRole",
@@ -130,10 +145,4 @@ Full access console policy:
-            "cloudformation:CreateStack",
-            "cloudformation:DescribeStacks",
-            "cloudformation:DescribeStackEvents",
-            "cloudformation:GetTemplate",
-            "cloudformation:ListStacks",
-            "connect:DescribeInstance",
-            "connect:ListInstances",
-            "connect:AssociatePhoneNumberContactFlow",
-            "connect:ListPhoneNumbersV2",
-            "kms:ListKeys",
+            "iam:GetRole",
+            "iam:GetRolePolicy",
+            "iam:PassRole",
+            "iam:PutRolePolicy",
@@ -141,0 +151,44 @@ Full access console policy:
+            "kms:ListKeys",
+            "lambda:AddPermission",
+            "lambda:CreateFunction",
+            "lambda:GetFunction",
+            "lex:BuildBotLocale",
+            "lex:CreateBot",
+            "lex:CreateBotAlias",
+            "lex:CreateBotLocale",
+            "lex:CreateBotVersion",
+            "lex:CreateCustomVocabulary",
+            "lex:CreateIntent",
+            "lex:CreateResourcePolicy",
+            "lex:CreateSlot",
+            "lex:CreateSlotType",
+            "lex:CreateUploadUrl",
+            "lex:DeleteBotLocale",
+            "lex:DeleteCustomVocabulary",
+            "lex:DeleteIntent",
+            "lex:DeleteSlot",
+            "lex:DeleteSlotType",
+            "lex:DescribeBot",
+            "lex:DescribeBotAlias",
+            "lex:DescribeBotLocale",
+            "lex:DescribeBotVersion",
+            "lex:DescribeImport",
+            "lex:ListBotLocales",
+            "lex:ListBots",
+            "lex:ListTagsForResource",
+            "lex:StartImport",
+            "lex:TagResource",
+            "lex:UpdateBot",
+            "lex:UpdateBotAlias",
+            "lex:UpdateBotLocale",
+            "lex:UpdateCustomVocabulary",
+            "lex:UpdateIntent",
+            "lex:UpdateResourcePolicy",
+            "lex:UpdateSlot",
+            "lex:UpdateSlotType",
+            "organizations:DescribeOrganization",
+            "organizations:ListAccounts",
+            "s3:GetObject",
+            "s3:ListAllMyBuckets",
+            "s3:ListBucket",
+            "s3:PutObject",
@@ -142,0 +196 @@ Full access console policy:
+            "sso:CreateApplicationAssignment",
@@ -143,0 +198 @@ Full access console policy:
+            "sso:ListDirectoryAssociations",
@@ -147,3 +201,0 @@ Full access console policy:
-            "sso:CreateApplicationAssignment",
-            "sso:ListDirectoryAssociations",
-            "sso-directory:SearchUsers",
@@ -151,4 +203 @@ Full access console policy:
-            "s3:putObject",
-            "s3:getObject",
-            "s3:ListBucket",
-            "s3:ListAllMyBuckets"
+            "sso-directory:SearchUsers"