Use this reference to review what the Amazon Connect integration reads from your AWS account and how it gets access, for example during a security review. Assembled only reads data. It never changes anything in your AWS account or in Amazon Connect.
To set up the integration, see Amazon Connect integration.
How Assembled accesses your AWS account
Assembled doesn’t store credentials for your AWS account. It uses AWS Security Token Service (STS) role assumption, a standard and auditable AWS pattern:
- The CloudFormation template creates an IAM role named
AllowAssembledReadAccessin your AWS account. Its trust policy lets Assembled’s AWS account assume the role. - When Assembled syncs, it assumes the role and gets short-lived credentials. They aren’t stored.
- With those credentials, Assembled reads your agent events stream, your CTR bucket, and your Amazon Connect users.
To revoke access at any time, delete the AllowAssembledReadAccess role.
The role’s policies only allow reading:
| Policy | Actions | Applies to |
|---|---|---|
<region>-assembled-read-kinesis-policy |
kinesis:DescribeStream, kinesis:GetRecords, kinesis:GetShardIterator, kinesis:ListShards |
Your agent events stream |
assembled-read-s3-policy |
s3:GetObject, s3:ListBucket |
Your CTR bucket and the files in it |
assembled-read-connect-policy |
connect:ListUsers, connect:DescribeUser, connect:ListSecurityProfiles |
Your Amazon Connect users and security profiles, used to match team members and import people |
What data Assembled reads
Assembled reads contact trace records (CTRs) from your S3 bucket, agent events from your Kinesis stream, and user details from the Amazon Connect API.
Contact trace records
Amazon Connect creates a CTR when a contact ends. Assembled reads these fields from each one.
Contact details:
| Field | What it is |
|---|---|
ContactId |
The contact’s unique ID |
InitialContactId |
The ID of the first segment of a transferred contact |
NextContactId, PreviousContactId |
Links between the segments of a contact |
Channel |
VOICE, CHAT, EMAIL, or TASK |
InitiationMethod |
How the contact started, such as INBOUND, OUTBOUND, TRANSFER, or DISCONNECT |
InitiationTimestamp |
When the contact started |
ConnectedToSystemTimestamp |
When the contact connected to Amazon Connect |
DisconnectTimestamp |
When the contact ended |
DisconnectReason |
Why the contact ended |
LastUpdateTimestamp |
When the CTR was last updated |
ScheduledTimestamp |
When a scheduled contact was set to start |
TransferCompletedTimestamp |
When a transfer finished |
Transferred |
Whether the contact was transferred out |
AWSAccountId |
The AWS account the contact came from |
InstanceARN |
The Amazon Connect instance the contact belongs to |
AWSContactTraceRecordFormatVersion |
The record’s format version |
AgentConnectionAttempts |
How many times Amazon Connect tried to reach a team member |
MediaStreams |
The media types used, such as AUDIO |
Attributes |
Custom attributes set on the contact. Assembled only keeps them if your integration is set up to use them, for example to route contacts into queues. To turn this on, contact our team. |
Team member details:
| Field | What it is |
|---|---|
Agent.ARN |
The team member’s unique ID |
Agent.Username |
The team member’s login username |
Agent.RoutingProfile |
The name and ARN of the team member’s routing profile |
Agent.ConnectedToAgentTimestamp |
When the contact connected to the team member |
Agent.AgentInteractionDuration |
Seconds the team member spent handling the contact |
Agent.AgentPauseDuration |
Seconds the contact was paused |
Agent.AfterContactWorkDuration |
Seconds spent in after-contact work (ACW) |
Agent.AfterContactWorkStartTimestamp |
When ACW started |
Agent.AfterContactWorkEndTimestamp |
When ACW ended |
Agent.CustomerHoldDuration |
Total seconds the customer was on hold |
Agent.LongestHoldDuration |
The longest single hold, in seconds |
Agent.NumberOfHolds |
How many times the customer was put on hold |
Queue details:
| Field | What it is |
|---|---|
Queue.ARN |
The queue’s unique ID |
Queue.Name |
The queue’s name |
Queue.EnqueueTimestamp |
When the contact entered the queue |
Queue.DequeueTimestamp |
When the contact left the queue |
Queue.Duration |
Seconds the contact spent in the queue |
Agent events
Amazon Connect publishes an agent event each time a team member’s state changes. Assembled reads these fields:
| Field | What it is |
|---|---|
EventId |
The event’s unique ID |
EventType |
The kind of event, such as STATE_CHANGE |
EventTimestamp |
When the event happened |
AgentARN |
The team member’s unique ID |
AWSAccountId |
The AWS account the event came from |
InstanceARN |
The Amazon Connect instance the event belongs to |
Version |
The event’s format version |
CurrentAgentSnapshot, PreviousAgentSnapshot |
The team member’s status, routing profile, first name, last name, and username, and the contacts they’re on, after and before the change |
Amazon Connect users
To match team members to their Amazon Connect users, Assembled lists your Amazon Connect users and reads each user’s ARN, username, email, secondary email, first name, last name, and security profile. It matches on email first, then secondary email, then username.
Keep personal data out of Assembled
You can have Assembled clear the fields below before it stores or processes your data. Everything else, including contact IDs, timestamps, durations, queue names, and routing profiles, is kept. To turn this on for your company, contact our team.
| Field | Where it comes from | What Assembled keeps |
|---|---|---|
Agent.Username |
CTR | An empty value |
DisconnectReason |
CTR | An empty value |
Configuration.FirstName |
Agent events, in both the current and previous snapshot | An empty value |
Configuration.LastName |
Agent events, in both the current and previous snapshot | An empty value |
Configuration.Username |
Agent events, in both the current and previous snapshot | An empty value |