Amazon Connect Calls & Chat

Conversation Intelligence (CI) supports Amazon Connect Customer (previously known as AWS Connect).

The Amazon Connect service provides a cloud contact centre solution that leverages AWS resources, such as S3 Buckets and Kinesis data streaming, and supports inbound and outbound call recording & Chats/messaging for agents and customers.

This document covers the configuration of Amazon Connect as it applies to CI, including the requirements for exporting call recordings and metadata to an AWS S3 bucket.

Create Instance

Set Identity

Navigate to Amazon Connect Customer in the AWS Management Console
Select Add an Instance
Select the appropriate user management option and set your preferred Access URL

This example setup uses an identity name of capacity-dev. The identity name forms part of the S3 path, so choose a meaningful and consistent name.

Select Next
Configure an administrator account if a specific one is required for this Amazon Connect instance
Select Next

Set Telephony

Select the appropriate telephony options for your deployment

Select Next

Data Storage

On the Data Storage step:

Select Enable Customer Profiles and/or Enable Email if required
Select Customize data storage (advanced)
Select Call recordings at a minimum
- Also select Chat transcripts if you plan to process Chats into CI.

Enable Select KMS key by name
Select the appropriate AWS KMS key

Call Recordings

Select Create a new S3 bucket for me (recommended)
Enter a desired S3 bucket Name and Path prefix
The resulting path format will be:

{S3 bucket name}/connect/{instance name}/{path prefix}

Select Enable encryption
Enable Select KMS key by name
Select aws/connect from the AWS KMS key dropdown menu

The KMS key must be in the same region as the S3 bucket.

Chat Transcripts

Follow these steps only if a Chat integration is also required

Select Create a new S3 bucket for me (recommended)
Enter a desired S3 bucket Name and Path prefix

The resulting path format will be:

{S3 bucket name}/connect/{instance name}/{path prefix}

Select Enable encryption
Enable Select KMS key by name
Select aws/connect from the AWS KMS key dropdown menu

Email Messages

Follow these steps only if a Chat integration is also required

Select Create a new S3 bucket for me (recommended)
Enter a desired S3 bucket Name and Path prefix

The resulting path format will be:

{S3 bucket name}/connect/{instance name}/{path prefix}

Select Enable encryption
Enable Select KMS key by name
Select aws/connect from the AWS KMS key dropdown menu

Select Next
Review settings, then select Create instance

Contact Flow

Inbound Call Recording

This flow will also work for Chat transcripts where the entry point contact attribute is CHAT

The default and sample contact flows are used to illustrate call recording settings.
From the Amazon Connect instance, navigate to your Access URL.

Navigate to Routing >> Flows
Select the Sample recording behavior contact flow

This contact flow consists of the following staged components:

Entry point
Check contact attributes
Play prompt
Get customer input
Set recording and analytics behavior
Transfer to flow
Play prompt
Disconnect

In this section, the fifth stage in the contact flow will be configured to record agent and customer interaction.

Select the first Set recording and analytics behavior element in the fifth stage. A pop-out panel will appear with a list of configuration options
Within Enable recording and analytics, expand Voice and select On >> Agent and Customer
Configure any other appropriate settings
Select Confirm
Select Save and then Publish

Configuration changes must be saved and published to apply. Changes that are saved but not published do not go into effect.

Outbound Call Recording

Navigate back to Routing >> Flows
Select the Default outbound contact flow

This contact flow consists of the following staged components:

Entry point
Set recording and analytics behavior
Play prompt
End flow / Resume

In this section, the second stage in the contact flow will be configured to record agent and customer interaction.

Select the Set recording and analytics behavior element in the second stage. A pop-out panel will appear with a list of configuration options
Within Enable recording and analytics, expand Voice and select On >> Agent and Customer
Configure any other appropriate settings
Select Confirm
Select Save and then Publish

Configuration changes must be saved and published to apply. Changes that are saved but not published do not go into effect

Call Recording Metadata: Data Streaming

Call recording metadata is exported to an AWS S3 bucket via Amazon Data Firehose, an AWS managed service for loading streaming data into storage destinations.

There are two types of Amazon Data streaming services: Kinesis Firehose and Kinesis Stream. Firehose is the only method for this integration as it supports direct delivery to an S3 bucket with minimal configuration.

Create a Firehose Delivery Stream

From the Amazon Connect Customer instance, select your instance.

Within Data streaming, select Enable data streaming
Select Kinesis Firehose

Select Create a new Kinesis Firehose

Select Amazon Data Firehose then Create Firehose stream

Source and Destination

Within Source select Direct PUT
Within Destination select Amazon S3
Enter a Firehose stream name

Transform and Convert Records

Within Process records, disable Record transformation and Record format conversion

Do not enable any options within Transform and convert records — optional. Enabling these is not required for the CI integration and may cause delivery failures.

Destination Settings

Within Destination settings, select Create then select Browse to choose the bucket.

Enter an S3 bucket prefix. In this example the prefix metadata is used.

Buffer sizes and intervals should be left at their defaults (5 MB / 300 seconds). Changes may be required depending on your call volume.

Service Access

Within Service access, select Create or update IAM role

This ensures default permissions are applied. Only use an existing IAM role where your organisation has a specific governance requirement.

Select Create Firehose stream

Connect the Stream to Amazon Connect

Go back to Data Streaming within the Amazon Connect instance.
Within Contact Trace Records, ensure that the newly created Firehose stream is selected from the dropdown menu.

If the Firehose stream does not appear in the dropdown, confirm the IAM user or role has both firehose:ListDeliveryStreams and kinesis:ListStreams permissions. The dropdown will appear empty without any error message if either permission is missing.

Select Save

Granting Capacity Access to Your S3 Buckets

Once your call recordings and CTR metadata files are being delivered to S3, CI's ingestor retrieves them from your bucket(s) for processing. To enable this, you need to grant Capacity read access to those buckets. Optionally, if you enable automated file cleanup, delete permissions are also required.

There are two supported authentication methods. Before starting, obtain the values listed in the What Capacity Provides to You section at the end of this guide.

Method	When to use
Option A — IAM Role with AssumeRole	Preferred for most deployments. No long-lived credentials; access is controlled via a trust relationship between AWS accounts.
Option B — IAM User with Access Keys	Use only where your organisation cannot support cross-account IAM role federation.

Option A: IAM Role with AssumeRole (Recommended)

Step 1 — Create the IAM Role

In the AWS Management Console, navigate to IAM > Roles and select Create role

For Trusted entity type, select AWS account
Select Another AWS account and enter the Capacity AWS Account ID provided to you
Select Next. Skip the permissions attachment — you will add the policy in Step 2
Name the role exactly: Capacity-connect-ingestor. This name is required
Select Create role

Step 2 — Attach the Permission Policy

Attach a new inline or managed policy to the role. Assemble it from the blocks below, including only the optional blocks that apply to your setup. All placeholder values (shown in uppercase) must be replaced before saving — see the Placeholder Reference table at the end of this guide.

Required — S3 Read Access (always include)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListBucketContents",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR-RECORDINGS-BUCKET",
        "arn:aws:s3:::YOUR-CTR-BUCKET"
      ]
    },
    {
      "Sid": "DownloadFiles",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR-RECORDINGS-BUCKET/*",
        "arn:aws:s3:::YOUR-CTR-BUCKET/*"
      ]
    }
  ]
}

If your recordings and CTR metadata files are stored in the same S3 bucket, use the same bucket name in all four resource ARN entries and remove the duplicate.

Optional — File Deletion (include only if enabling automated file cleanup in CI)

If CI has been configured to delete files from S3 after a set number of days, add the following as an additional statement. Do not include this block unless the deletion feature has been explicitly agreed with Capacity.

{
    "Sid": "DeleteProcessedFiles",
    "Effect": "Allow",
    "Action": [
        "s3:DeleteObject"
    ],
    "Resource": [
        "arn:aws:s3:::YOUR-RECORDINGS-BUCKET/*",
        "arn:aws:s3:::YOUR-CTR-BUCKET/*"
    ]
}

Only add this permission if you intend to use the automated deletion feature. Files removed from S3 cannot be recovered unless you have versioning or a backup policy in place.

Optional — KMS Decryption (include if your bucket uses SSE-KMS encryption)

AWS Connect enables KMS encryption by default. If you followed the Data Storage steps in this guide, your bucket is KMS-encrypted and this block is required. To verify: navigate to your S3 bucket → Properties → Default encryption. If it shows SSE-KMS, include this block. If it shows SSE-S3 (AES-256), it is not needed.

Add the following as an additional statement inside the Statement array of the policy created above:

{
    "Sid": "DecryptKMSObjects",
    "Effect": "Allow",
    "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
    ],
    "Resource": "arn:aws:kms:YOUR-REGION:YOUR-ACCOUNT-ID:key/YOUR-KMS-KEY-ID",
    "Condition": {
        "StringEquals": {
            "kms:ViaService": "s3.YOUR-REGION.amazonaws.com"
        }
    }
}

To find your KMS Key ID: navigate to AWS Key Management Service > Customer managed keys and locate the key associated with your Connect S3 bucket. Copy the Key ID (not the alias).

Step 3 — Verify the Trust Policy

Select the newly created role from the IAM Roles list and navigate to the Trust relationships tab. Verify the trust policy matches the following. All values shown in uppercase are provided by Capacity.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCapacityAssumeRole",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::973339273290:user/[Customer Name]-service-account-user"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Option B: IAM User with Access Keys

Use this option only if your organisation cannot support cross-account IAM role federation. Confirm with your Capacity representative before proceeding.

Step 1 — Create the IAM User

In the AWS Management Console, navigate to IAM > Users and select Create user. Enter a recognisable user name (e.g. Capacity-ingestor). Do not enable AWS Management Console access — this user requires programmatic access only. Select Next.

Step 2 — Attach the Permission Policy

Attach the same permission policy as described in Option A Step 2, using the Required block and any applicable Optional blocks (KMS, Delete). All placeholder values must be replaced before attaching.

Step 3 — Create Access Keys

Select the newly created user and navigate to the Security credentials tab
Under Access keys, select Create access key
Select Third-party service as the use case and acknowledge the recommendation
Select Create access key
Copy or download the Access Key ID and Secret Access Key immediately — the Secret Access Key cannot be retrieved after this screen is closed

Securely share both values with your Capacity representative. Do not transmit via unencrypted email. Your Capacity contact will advise on an appropriate secure transfer method.

Access keys should be rotated periodically in line with your organisation’s credential management policy. Notify Capacity before rotating so the ingestor can be updated without interruption.

What Capacity Provides to You

Capacity will supply the following values during onboarding. These are required before you can complete the IAM role setup under Option A:

Item	Details
Capacity AWS Account ID	973339273290
IAM User Role ARN	A unique value generated per customer by Capacity. Required for the trust policy Condition. E.g. arn:aws:iam::973339273290:user/{{customer-name}}-service-account-user

Contact Capacity to request the IAM Role ARN

What to Share with Capacity

Once your IAM role or user is configured, provide the following details to your Capacity onboarding contact. The required fields depend on whether you are using Contact Lens only, or Contact Lens together with AWS Transcribe.

Scenario 1 — Contact Lens (Capacity transcription)

Use this scenario if you are using Contact Lens for call recording and metadata, and Capacity will handle transcription.

Item	Where to find it
AWS Region	The AWS region your Amazon Connect instance and S3 buckets are deployed in, e.g. us-east-1, eu-west-2.
AWS Assume Role ARN (if applicable)	IAM > Roles > [role name] > ARN field. Format: arn:aws:iam::ACCOUNT-ID:role/ROLE-NAME. Only required if using Option A (AssumeRole).
Access Key ID (if applicable)	IAM > Users > [user name] > Security credentials > Access keys. Only required if using Option B (IAM User).
Key Secret (if applicable)	Generated at the same time as the Access Key ID. Store securely and share via a secure channel only.
Audio bucket name	S3 > Buckets. The bucket where call recordings (.wav files) are stored, created during the Data Storage setup in this guide.
Metadata bucket name	S3 > Buckets. The bucket receiving Contact Trace Record (CTR) output from the Firehose stream. May be the same as the audio bucket.
Bucket prefixes (if not in the root)	The S3 folder prefixes under which files are stored, e.g. CallRecordings/, connect/INSTANCE-ID/ctr/. Leave blank if files are delivered to the root of the bucket.

Scenario 2 — Contact Lens with AWS Transcribe (AWS transcription)

Use this scenario if you are using Contact Lens and AWS Transcribe, and you want Creovai to access the transcript produced by AWS rather than transcribing the audio itself. In addition to the IAM permissions for audio and metadata buckets, ensure the role or user also has s3:GetObject access to the bucket and prefix where Contact Lens transcripts are stored.

Item	Where to find it
AWS Region	The AWS region your Amazon Connect instance and S3 buckets are deployed in, e.g. us-east-1, eu-west-2.
AWS Assume Role ARN (if applicable)	IAM > Roles > [role name] > ARN field. Format: arn:aws:iam::ACCOUNT-ID:role/ROLE-NAME. Only required if using Option A (AssumeRole).
Access Key ID (if applicable)	IAM > Users > [user name] > Security credentials > Access keys. Only required if using Option B (IAM User).
Key Secret (if applicable)	Generated at the same time as the Access Key ID. Store securely and share via a secure channel only.
Audio bucket name	S3 > Buckets. The bucket where call recordings (.wav files) are stored, created during the Data Storage setup in this guide.
Metadata bucket name	S3 > Buckets. The bucket receiving Contact Trace Record (CTR) output from the Firehose stream. May be the same as the audio bucket.
Bucket prefixes (if not in the root)	The S3 folder prefixes under which files are stored, e.g. CallRecordings/, connect/INSTANCE-ID/ctr/. Leave blank if files are delivered to the root of the bucket.
Transcript path (CTR attribute name)	The name of the Contact Attribute in the CTR that contains the path to the Contact Lens transcript file. Provide this in the format used in the CTR, e.g. {Attributes.ContactLensTranscriptionPath}. This is set in your Contact Flow.

Always share credentials securely, never send as plain text in an email

Was this article helpful?