Setting up an Amazon Connect instance

Do

AWS recommends anchoring either the phone numbers or the agents in the AWS Region where they are geographically located 33. If both are in a different Region from the instance, WebRTC round-trip network latency is extended above 500 ms and call quality may suffer 33. AWS advises calculating latency in a test environment before production, using the Connect Customer Endpoint Test Utility 23. If you need Apple Messages for Business, SMS, WhatsApp Business Messaging or push notifications, AWS GovCloud (US-West) does not offer those integrations 26.

Verify

AWS recommends under 500 ms end-to-end latency for best call quality, says up to 900 ms combined network and telephony latency may be acceptable, and states that above 900 ms causes significant delay between agents and customers 34. Suggested check: record the latency measured from each agent location and keep it with your design notes.

Store users in Connect Customer

Do

Choose the left-most label of the instance Access URL now; it must be unique across all Connect Customer instances in all Regions and cannot be changed after the instance is created 3.

Verify

Suggested check: write down the chosen label and have a second administrator confirm the spelling before you continue.

Link to an existing Directory Service directory

Do

Set up an AWS Managed Microsoft Active Directory, AD Connector or Simple AD directory 22. The directory must be associated with your AWS account, set up in Directory Service, and active in the same AWS Region in which you create the instance 21. A Directory Service directory can be associated with only 1 Connect Customer instance at a time 20.

Verify

Confirm the directory is active in the target Region and associated with your account 21. Confirm it is not already associated with another Connect Customer instance, because to reuse it you must delete the instance it is associated with 20.

Rollback

Suggested rollback: until you link the directory in Step 3, nothing outside the directory itself has changed. A directory cannot be unbound from a Connect Customer instance after it has been associated 19.

SAML 2.0-based authentication using an existing identity provider

Do

AWS advises configuring the SAML environment before creating the instance, and with SAML users can log in only through the link configured in the identity provider 52. Choose the left-most label of the Access URL; it must be unique across all Connect Customer instances in all Regions and cannot be changed after creation 3. Pick the administrator user name, which must exactly match a user name in your existing network directory 47.

Verify

Suggested check: confirm that someone who administers the identity provider is available to finish the federation setup in Step 5.

Store users in Connect Customer

Do

Choose Store users in Connect Customer as the identity management option 31. Enter the Access URL label you chose earlier 3. Specify the administrator with a name, password and email 5.

Verify

The administrator named during creation is created as a Connect Customer user account and assigned the Admin security profile 6. Suggested check: before you continue, confirm the identity option and administrator details shown for review match your plan.

Rollback

Suggested rollback: before the instance is created, return to the identity page and correct it. After creation, moving to a different identity option requires deleting the instance and creating a new one 29.

Link to an existing Directory Service directory

Do

Choose Link to an existing directory and select the directory you prepared 31. For this option the directory name is used as the Access URL label 3. Enter an existing directory username as the administrator; the directory manages that user's password 5.

Verify

The administrator is created as a Connect Customer user account and assigned the Admin security profile 6. Suggested check: confirm the directory and administrator shown for review are the ones you intended.

Rollback

A directory cannot be unbound from a Connect Customer instance after it has been associated 19. To use the directory with a different instance you must delete the instance it is associated with 20.

SAML 2.0-based authentication using an existing identity provider

Do

Choose SAML 2.0-based authentication 31. Enter the Access URL label you chose earlier 3. Enter an administrator name that exactly matches a user name in your network directory; there is no option to set a password for it 47.

Verify

User names on a SAML instance are case sensitive 57. Suggested check: compare the administrator name shown for review character by character with the directory entry.

Rollback

Suggested rollback: before the instance is created, return to the identity page and correct it. After creation, moving to a different identity option requires deleting the instance and creating a new one 29.

Do

On the Set telephony step, select Receive inbound calls and Make outbound calls as needed; the same step also offers Enable early media and multi-party calls and chats of up to 6 participants with enhanced monitoring 60. Review data storage: by default instance creation creates Amazon S3 buckets for call recordings, chat transcripts, exported reports, flow logs and email messages, with data encrypted using AWS KMS 15.

Verify

Instances using Connect-managed users or a Directory Service directory are accessed through the instance Access URL, while SAML instances are accessed through the identity provider 2. Suggested check: confirm the new instance is listed in the Region you chose in Step 1.

Rollback

A deleted Connect Customer instance cannot be restored, and its settings, data, metrics and reports become inaccessible 17. Flow-log CloudWatch log groups must be deleted separately if no longer needed 17. Deleting an instance releases its claimed phone numbers back to inventory, and callers to a released number hear that it is not a working number 18.

Store users in Connect Customer

Do

Open the instance Access URL and sign in as the administrator, because instances using Connect-managed users are accessed through the Access URL 2.

Verify

The administrator holds the Admin security profile 6. Suggested check: confirm the admin website loads and that you can open its user management pages.

Link to an existing Directory Service directory

Do

Open the instance Access URL, because instances using a Directory Service directory are accessed through it 2. Sign in with the administrator's directory username, whose password the directory manages 5.

Verify

The administrator holds the Admin security profile 6. Suggested check: confirm the admin website loads and that you can open its user management pages.

SAML 2.0-based authentication using an existing identity provider + A Region other than Africa (Cape Town) or AWS GovCloud (US-West), such as US West (Oregon) or Europe (London)

Do

Create a SAML identity provider in IAM and a single IAM role for SAML 2.0 federation whose policy allows connect:GetFederationToken for the instance, and leave the identity provider's Application Start URL blank 50. Set the relay state to https://{region-id}.console.aws.amazon.com/connect/federate/{instance-id}, where the instance ID is the value after /instance in the instance ARN 54. AWS recommends overriding the identity provider's Assertion Consumer Service URL from the global sign-in endpoint, which is hosted in US East, to https://{region-id}.signin.aws.amazon.com/saml for the instance's Region, and adding that URL to a multivalued SAML:aud condition in the role trust policy 53.

Verify

Connect Customer does not support service-provider-initiated SAML federation, so going to the instance directly produces a Session Expired message 51. Suggested check: start from the identity provider's portal as the administrator and confirm the admin website loads.

Rollback

Suggested rollback: remove the identity provider application, the federation role and the SAML identity provider you created in this step. The instance keeps its SAML identity option either way, because that option cannot be changed after creation 30.

SAML 2.0-based authentication using an existing identity provider + Africa (Cape Town)

Do

Create a SAML identity provider in IAM and a single IAM role for SAML 2.0 federation whose policy allows connect:GetFederationToken for the instance, and leave the identity provider's Application Start URL blank 50. AWS documents the relay state for a commercial-Region SAML instance as https://{region-id}.console.aws.amazon.com/connect/federate/{instance-id}, where the instance ID is the value after /instance in the instance ARN 54. AWS recommends overriding the Assertion Consumer Service URL from the global sign-in endpoint to https://{region-id}.signin.aws.amazon.com/saml for the instance's Region, and adding that URL to a multivalued SAML:aud condition in the role trust policy 53.

Verify

Going to the instance directly produces a Session Expired message, because users must authenticate at the identity provider 51. Suggested check: start from the identity provider's portal as the administrator and confirm the admin website loads.

Rollback

Suggested rollback: remove the identity provider application, the federation role and the SAML identity provider you created in this step. The instance keeps its SAML identity option either way, because that option cannot be changed after creation 30.

SAML 2.0-based authentication using an existing identity provider + AWS GovCloud (US-West)

Do

Create a SAML identity provider in IAM and a single IAM role for SAML 2.0 federation whose policy allows connect:GetFederationToken for the instance, and leave the identity provider's Application Start URL blank 50. For an AWS GovCloud instance, set the relay state to https://console.amazonaws-us-gov.com/connect/federate/{instance-id} 49. AWS recommends overriding the Assertion Consumer Service URL from the global sign-in endpoint, hosted in US East, to the regional sign-in endpoint for the instance's Region, and adding that URL to a multivalued SAML:aud condition in the role trust policy 53.

Verify

Going to the instance directly produces a Session Expired message, because users must authenticate at the identity provider 51. Suggested check: start from the identity provider's portal as the administrator and confirm the admin website loads.

Rollback

Suggested rollback: remove the identity provider application, the federation role and the SAML identity provider you created in this step. The instance keeps its SAML identity option either way, because that option cannot be changed after creation 30.

A Region other than Africa (Cape Town) or AWS GovCloud (US-West), such as US West (Oregon) or Europe (London)

Do

As an Admin or a user with Phone numbers - Claim permission, choose Channels, Phone numbers, Claim a number, pick a toll-free or DID number (with an optional area code filter in the US), optionally attach a flow in Flow / IVR, and save 10. Since July 2023, claiming numbers located in countries outside the instance's AWS Region no longer requires opt-in approval; AWS provides best-practice design guidance instead 14. Country or region regulations often require a local office address and specific identification documents, and addresses such as PO boxes are not valid in any country 36. If no numbers display for a country or region, or a wanted area code or prefix is not listed, create an Account and billing support case 12.

Verify

You can call a newly claimed number immediately, and Connect Customer uses the default flows for that initial experience 61. The default quota is 10 phone numbers per instance, and the "You've reached the limit of Phone Numbers" error can appear even on a first claim and requires AWS Support to resolve 38.

Rollback

After you release a claimed number you cannot claim the same number again 43. Claiming and releasing beyond 200% of the phone number quota within a rolling 180-day cycle blocks further claims until 180 days after the oldest released number, unless you obtain a quota exception 11.

Africa (Cape Town)

Do

As an Admin or a user with Phone numbers - Claim permission, choose Channels, Phone numbers, Claim a number, pick a toll-free or DID number, optionally attach a flow in Flow / IVR, and save 10. The published ID requirements for ordering and porting numbers apply to all AWS Regions except Africa (Cape Town) and AWS GovCloud (US-West) unless noted otherwise per country 37. If no numbers display, or a wanted area code or prefix is not listed, create an Account and billing support case 12.

Verify

You can call a newly claimed number immediately, and Connect Customer uses the default flows for that initial experience 61. The "You've reached the limit of Phone Numbers" error can appear even on a first claim and requires AWS Support to resolve 38.

Rollback

After you release a claimed number you cannot claim the same number again 43. Claiming and releasing beyond 200% of the phone number quota within a rolling 180-day cycle blocks further claims unless you obtain a quota exception 11.

AWS GovCloud (US-West)

Do

As an Admin or a user with Phone numbers - Claim permission, choose Channels, Phone numbers, Claim a number, pick a toll-free or DID number, optionally attach a flow in Flow / IVR, and save 10. The published ID requirements for ordering and porting numbers apply to all AWS Regions except Africa (Cape Town) and AWS GovCloud (US-West) unless noted otherwise per country 37. If no numbers display, or a wanted area code or prefix is not listed, create an Account and billing support case 12.

Verify

You can call a newly claimed number immediately, and Connect Customer uses the default flows for that initial experience 61. The "You've reached the limit of Phone Numbers" error can appear even on a first claim and requires AWS Support to resolve 38.

Rollback

After you release a claimed number you cannot claim the same number again 43. Claiming and releasing beyond 200% of the phone number quota within a rolling 180-day cycle blocks further claims unless you obtain a quota exception 11.

Do

As an Admin or a user with Routing - Hours of operation - Create permission, choose Routing, Hours of operation, Add new set of hours, enter a name, choose a time zone and set the operational hours 28.

Verify

Hours of operation are specified on a queue and can be tested in flows with the Check hours of operation block to branch contacts outside hours 27. Suggested check: confirm the new set appears in the list of hours.

Rollback

Suggested rollback: edit the set of hours, or select a different set on the queue.

Do

Choose Routing, Queues, Add new queue, and set the hours of operation you created, the outbound caller ID, the maximum contacts and any quick connects 40. Only phone numbers claimed in or ported to the instance can be used as the outbound caller ID number, unless an external number has been activated for custom caller ID through an AWS Support case 62.

Verify

A new queue is automatically active 40. A routing profile is what links queues to agents 45.

Rollback

Suggested rollback: edit the queue's settings, or stop using it by removing it from routing profiles.

Do

Choose Users, Routing profiles, Add routing profile, set channel availability and concurrency, add the queue you created with a channel, priority and delay, and choose a default outbound queue, whose settings such as caller ID outbound contacts respect 46. In the Queues section a lower priority number is handled first, and the delay is the minimum time in seconds a contact must be in the queue before it is routed to an available agent 63.

Verify

The channel set for a queue in the routing profile must also be enabled in the profile's Channel Settings, otherwise contacts from that channel will not be routed to agents 44. Suggested check: confirm that Voice is enabled in the profile and on the queue entry.

Rollback

Each agent is assigned exactly 1 routing profile 45. Suggested rollback: edit the profile, or assign affected agents to a different profile.

Do

Connect Customer includes 4 default security profiles: Admin, Agent (access to the CCP), CallCenterManager (user management, metrics and routing) and QualityAnalyst (metrics) 16. AWS advises using a default profile only if it matches what users need and otherwise creating a profile that grants only the needed permissions, and notes new permissions are added regularly 35. A user with Security profiles - Create permission creates one under Users, Security profiles, Add new security profile, and choosing an action automatically selects the actions it depends on, such as View when Edit is chosen 59.

Verify

By default, users assigned the Agent security profile can access the Contact Control Panel and make outbound calls 8. Suggested check: if you built a narrower agent profile, confirm it still grants panel access and outbound calling.

Rollback

Suggested rollback: edit the profile, or assign users back to a default profile.

Store users in Connect Customer

Do

Choose Users, Add new users, enter name, email and password, and choose the routing profile you created and a security profile 4. Then edit the user and set Phone Type to Soft phone; for soft phone AWS recommends enabling persistent connection 4 7.

Verify

Each agent is assigned exactly 1 routing profile 45. Suggested check: confirm the user is listed with the routing profile from Step 9.

Rollback

Suggested rollback: edit the user's settings or remove the user.

Link to an existing Directory Service directory

Do

Choose Users, Add new users, and choose the routing profile you created and a security profile 4. Then edit the user and set Phone Type to Soft phone; for soft phone AWS recommends enabling persistent connection 4 7.

Verify

Each agent is assigned exactly 1 routing profile 45. Suggested check: confirm the user is listed with the routing profile from Step 9.

Rollback

Suggested rollback: edit the user's settings or remove the user.

SAML 2.0-based authentication using an existing identity provider

Do

Add the user with a user name that exactly matches the RoleSessionName attribute in your identity provider's SAML response; user names are case sensitive 57. SAML users have no primary email address or password, and they need a secondary email configured to receive email notifications 56. Edit the user afterwards and set Phone Type to Soft phone; for soft phone AWS recommends enabling persistent connection 4 7.

Verify

A user with no matching account sees an Access denied message 57. Suggested check: have the agent sign in through the identity provider and confirm no access error appears.

Rollback

Suggested rollback: edit the user's settings or remove the user.

Do

Choose Channels, Phone numbers, choose the number you claimed, and select the flow in Flow / IVR; only published flows appear in that list 24.

Verify

To test a customised flow you assign a number to it and call that number 61. Suggested check: call the number from an outside phone and confirm you hear the flow you selected.

Rollback

Suggested rollback: reselect the previously attached flow on the same number.

Store users in Connect Customer

Do

Use Chrome, Edge or Firefox and grant the browser microphone access 58. Open https://{instance name}.my.connect.aws/ccp-v2/ and sign in as the agent you added 9.

Verify

Suggested check: set the agent to a state that receives contacts, then call the number from an outside phone. Agents have 20 seconds to accept a voice contact, after which their status becomes Missed and the contact routes to the next available agent; this window is not configurable 1. The default quota for concurrent active calls per instance is 10, and calls beyond it receive a reorder (fast busy) tone 13.

Link to an existing Directory Service directory

Do

Use Chrome, Edge or Firefox and grant the browser microphone access 58. Open https://{instance name}.my.connect.aws/ccp-v2/ and sign in as the agent you added 9.

Verify

Suggested check: set the agent to a state that receives contacts, then call the number from an outside phone. Agents have 20 seconds to accept a voice contact, after which their status becomes Missed and the contact routes to the next available agent 1. The default quota for concurrent active calls per instance is 10, and calls beyond it receive a reorder (fast busy) tone 13.

SAML 2.0-based authentication using an existing identity provider

Do

Use Chrome, Edge or Firefox and grant the browser microphone access 58. Sign in through the identity provider, because users must authenticate there 51. A URL-encoded destination parameter on the relay state URL, such as destination=%2Fccp-v2, can send users straight to the CCP if their security profile grants access to it 48.

Verify

Suggested check: set the agent to a state that receives contacts, then call the number from an outside phone. Agents have 20 seconds to accept a voice contact, after which their status becomes Missed and the contact routes to the next available agent 1. The default quota for concurrent active calls per instance is 10, and calls beyond it receive a reorder (fast busy) tone 13. SAML sessions expire 12 hours after login and the user is logged out even if on a call, so agents working longer must log out of Connect Customer and the identity provider and log in again before expiry 55.