AmazonConnectServiceLinkedRolePolicy
Last Modified
Oct 3, 2026
October 3, 2026 at 12:02 AM UTC
Version
v56
Total Versions
42
Created
Oct 2, 2026
Actions
67
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Full connect access on every resource
Uses connect:* with Resource "*" and no condition, so every action AWS adds to that service later is granted too.
connect:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
IAM Access Analyzer (2)
- Suggestion / ALLOW_WITH_UNSUPPORTED_TAG_CONDITION_KEY_FOR_SERVICE
Using the effect Allow with the condition key aws:ResourceTag/AmazonConnectEnabled and actions for services with the following prefixes does not affect the policy: app-integrations. The actions for the listed service are not allowed by this statement. We recommend that you move these actions to a different statement without this condition key. AWS docs
- Suggestion / ALLOW_WITH_UNSUPPORTED_TAG_CONDITION_KEY_FOR_SERVICE
Using the effect Allow with the condition key aws:ResourceTag/AmazonConnectEnabled and actions for services with the following prefixes does not affect the policy: wisdom. The actions for the listed service are not allowed by this statement. We recommend that you move these actions to a different statement without this condition key. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowConnectActions",
"Effect": "Allow",
"Action": [
"connect:*"
],
"Resource": [
"*"
]
},
{
"Sid": "AllowDeleteSLR",
"Effect": "Allow",
"Action": [
"iam:DeleteRole"
],
"Resource": "arn:aws:iam::*:role/aws-service-role/connect.amazonaws.com/AWSServiceRoleForAmazonConnect_*"
},
{
"Sid": "AllowS3ObjectForConnectBucket",
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:GetObjectAcl",
"s3:PutObject",
"s3:PutObjectAcl",
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::amazon-connect-*/*"
]
},
{
"Sid": "AllowGetBucketMetadataForConnectBucket",
"Effect": "Allow",
"Action": [
"s3:GetBucketLocation",
"s3:GetBucketAcl"
],
"Resource": [
"arn:aws:s3:::amazon-connect-*"
]
},
{
"Sid": "AllowConnectLogGroupAccess",
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:DescribeLogStreams",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:*:*:log-group:/aws/connect/*:*"
]
},
{
"Sid": "AllowListLexBotAccess",
"Effect": "Allow",
"Action": [
"lex:ListBots",
"lex:ListBotAliases"
],
"Resource": "*"
},
{
"Sid": "AllowCustomerProfilesForConnectDomain",
"Effect": "Allow",
"Action": "profile:*",
"Resource": [
"arn:aws:profile:*:*:domains/amazon-connect-*",
"arn:aws:profile:*:*:/domains/amazon-connect-*",
"arn:aws:profile:*:*:/templates*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "AllowCustomerProfilesListOperations",
"Effect": "Allow",
"Action": [
"profile:ListRecommenderRecipes",
"profile:ListAccountIntegrations",
"profile:ListDomains"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "DenyCustomerProfilesForConnectDomain",
"Effect": "Deny",
"Action": [
"profile:CreateDomain",
"profile:UpdateDomain",
"profile:DeleteDomain",
"profile:CreateEventStream",
"profile:DeleteEventStream",
"profile:DeleteWorkflow",
"profile:DeleteProfileKey",
"profile:UntagResource",
"profile:TagResource",
"profile:CreateIntegrationWorkflow"
],
"Resource": "arn:aws:profile:*:*:domains/*"
},
{
"Sid": "AllowAppIntegrationsForConnectEnabledTaggedResources",
"Effect": "Allow",
"Action": [
"app-integrations:GetDataIntegration",
"app-integrations:ListDataIntegrationAssociations",
"app-integrations:CreateDataIntegrationSchedule",
"app-integrations:StartDataIntegrationExecution",
"app-integrations:ListDataIntegrationExecutions",
"app-integrations:GetDataIntegrationExecution",
"app-integrations:ListDataIntegrationSchedules",
"app-integrations:UpdateDataIntegrationSchedule",
"app-integrations:GetDataIntegrationSchedule"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/AmazonConnectEnabled": "True"
}
}
},
{
"Sid": "AllowWisdomForConnectEnabledTaggedResources",
"Effect": "Allow",
"Action": [
"wisdom:*"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/AmazonConnectEnabled": "True"
}
}
},
{
"Sid": "DenyWisdomForConnectEnabledTaggedResources",
"Effect": "Deny",
"Action": [
"wisdom:DeleteAssistant",
"wisdom:DeleteKnowledgeBase"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/AmazonConnectEnabled": "True"
}
}
},
{
"Sid": "AllowListOperationForWisdom",
"Effect": "Allow",
"Action": [
"wisdom:ListAssistants",
"wisdom:ListKnowledgeBases"
],
"Resource": "*"
},
{
"Sid": "AllowKMSListRetirableGrants",
"Effect": "Allow",
"Action": "kms:ListRetirableGrants",
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "AllowPutMetricsForConnectNamespace",
"Effect": "Allow",
"Action": "cloudwatch:PutMetricData",
"Resource": "*",
"Condition": {
"StringEquals": {
"cloudwatch:namespace": "AWS/Connect"
}
}
},
{
"Sid": "AllowSMSVoiceOperationsForConnect",
"Effect": "Allow",
"Action": [
"sms-voice:SendTextMessage",
"sms-voice:DescribePhoneNumbers"
],
"Resource": "arn:aws:sms-voice:*:*:phone-number/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "AllowCognitoForConnectEnabledTaggedResources",
"Effect": "Allow",
"Action": [
"cognito-idp:DescribeUserPool",
"cognito-idp:ListUserPoolClients"
],
"Resource": "arn:aws:cognito-idp:*:*:userpool/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/AmazonConnectEnabled": "True"
}
}
},
{
"Sid": "AllowChimeSDKVoiceConnectorGetOperationForConnect",
"Effect": "Allow",
"Action": [
"chime:GetVoiceConnector"
],
"Resource": "arn:aws:chime:*:*:vc/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/AmazonConnectEnabled": "True"
}
}
},
{
"Sid": "AllowChimeSDKVoiceConnectorListOperationForConnect",
"Effect": "Allow",
"Action": [
"chime:ListVoiceConnectors"
],
"Resource": "arn:aws:chime:*:*:vc/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SESPermissionsForManagingReceiptRules",
"Effect": "Allow",
"Action": [
"ses:DescribeReceiptRule",
"ses:UpdateReceiptRule"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SESPermissionForManagingConnectProvidedSESIdentity",
"Effect": "Allow",
"Action": [
"ses:DeleteEmailIdentity"
],
"Resource": "arn:aws:ses:*:*:identity/*.email.connect.aws*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "SESConfigurationSetPermissionsForSendingEmail",
"Effect": "Allow",
"Action": [
"ses:SendRawEmail"
],
"Resource": "arn:aws:ses:*:*:configuration-set/configuration-set-for-connect-DO-NOT-DELETE",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "PassRoleToSESForReceiptRuleManagement",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": [
"arn:aws:iam::*:role/service-role/AmazonConnectEmailSESAccessRole"
],
"Condition": {
"StringLike": {
"iam:PassedToService": "ses.amazonaws.com"
}
}
},
{
"Sid": "AllowSocialMessagingOperations",
"Effect": "Allow",
"Action": [
"social-messaging:SendWhatsAppMessage",
"social-messaging:PostWhatsAppMessageMedia",
"social-messaging:GetWhatsAppMessageMedia",
"social-messaging:GetLinkedWhatsAppBusinessAccountPhoneNumber",
"social-messaging:SendWhatsAppCallEvent"
],
"Resource": "arn:aws:social-messaging:*:*:phone-number-id/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/AmazonConnectEnabled": "True"
}
}
},
{
"Sid": "AllowRetrievalOfWabas",
"Effect": "Allow",
"Action": [
"social-messaging:ListLinkedWhatsAppBusinessAccounts"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "AllowRetrievalOfWhatsAppTemplates",
"Effect": "Allow",
"Action": [
"social-messaging:GetWhatsAppMessageTemplate",
"social-messaging:ListWhatsAppMessageTemplates"
],
"Resource": "arn:aws:social-messaging:*:*:waba/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/AmazonConnectEnabled": "True"
}
}
},
{
"Sid": "AllowMobileTargetingOperationsForConnect",
"Effect": "Allow",
"Action": "mobiletargeting:SendMessages",
"Resource": "arn:aws:mobiletargeting:*:*:apps/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "AllowPollyActions",
"Effect": "Allow",
"Action": [
"polly:ListLexicons",
"polly:DescribeVoices",
"polly:SynthesizeSpeech"
],
"Resource": [
"*"
]
}
]
},
"VersionId": "v56",
"IsDefaultVersion": true,
"CreateDate": "2026-10-02T23:27:08+00:00"
}
}Version History (47 recorded)
Raw history1 action added
12 actions added, 63 removed
2 actions added, 73 removed
AmazonConnectServiceLinkedRolePolicy - Policy Version v53
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
a894f27AmazonConnectServiceLinkedRolePolicy - Policy Version v53
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
dd1c294AmazonConnectServiceLinkedRolePolicy - Policy Version v42
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
f2d53c1AmazonConnectServiceLinkedRolePolicy - Policy Version v31
No recorded action delta - this version predates the change index. View the raw diff.
Nov 19, 2025
9d34d69AmazonConnectServiceLinkedRolePolicy - Policy Version v30
No recorded action delta - this version predates the change index. View the raw diff.
Nov 7, 2025
bd4c76eAmazonConnectServiceLinkedRolePolicy - Policy Version v29
No recorded action delta - this version predates the change index. View the raw diff.
Oct 28, 2025
b922443AmazonConnectServiceLinkedRolePolicy - Policy Version v28
No recorded action delta - this version predates the change index. View the raw diff.
Jul 30, 2025
7ab858eAmazonConnectServiceLinkedRolePolicy - Policy Version v27
No recorded action delta - this version predates the change index. View the raw diff.
Jul 16, 2025
bfbfa63Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jul 1, 2025
97e4708Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 23, 2025
51bc21dUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2025
81ace52Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jan 16, 2025
e0244b2Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 26, 2024
942dac4Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 22, 2024
59767f0Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 14, 2024
19d93bdUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 29, 2024
bc2431cUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 28, 2024
cf16ac2