How do I integrate with Amazon Connect? – EvaluAgent

The Amazon Connect integration will enable you to evaluate your calls and chat sessions from Amazon Connect in Evaluagent. You will need admin access to Amazon Connect, Amazon Kinesis, AWS IAM and AWS S3 to complete this configuration.

There are 5 steps in the process:

Set up Amazon Connect to record calls and chat sessions
Set up Amazon Connect to store the conversation metadata
Configure the Evaluagent Amazon Connect Integration
Create/Apply security policies to grant Evaluagent access to your Amazon Connect data
Confirm that everything works from the Evaluagent platform

Step 1: Set up Amazon Connect to record calls and chat sessions

Set up recording for any conversation that you want to evaluate within the appropriate Contact Flow in Amazon Connect. When configuring recording please use this guide and ensure that the Agent and Customer option is selected.

Step 2: Set up Amazon Connect to store the conversation metadata

From your Amazon Connect console click on the instance alias of the Amazon Connect instance you would like to integrate with and then click on Data Streaming. Check the box Enable data streaming and under Contact Trace Records select Kinesis Firehose.

Select your Kinesis Firehose from the dropdown and click Save. If you do not already have a configured Kinesis Firehose for this Amazon Connect instance, then click the link Create a new Kinesis Firehose.

Creating a new Kinesis Firehose

On the Amazon Kinesis Firehose tab click Create delivery stream.

Under Source select Direct PUT or other sources and under Destination select Amazon S3.

If necessary, amend the Delivery stream name. Leave Data transformation and Convert record format as default disabled.

Create an S3 bucket to store Amazon Connect Contact Trace Records and give it a descriptive name like "contact-trace-records-{instance name}". Keep this bucket name handy as you will need to reference it in the final integration configuration.

The remainder of the settings can be left as default.

Click Create delivery stream, close the tab and refresh your original Amazon Connect tab. Click on Data Streaming and under Contact Trace Records select Kinesis Firehose. Use the dropdown menu to select the name of the stream you just created.

Finally, click Save.

Step 3: Configure the Evaluagent Amazon Connect Integration

1. Find your Amazon Connect details

From your Amazon Connect console click on the instance alias of the Amazon Connect instance you would like to integrate. Click on Overview and under Distribution settings use the ARN to determine your Amazon Connect region (e.g., eu-west-2) and Amazon Connect ID which is the UUID at the end of the ARN.

Enter your region and Amazon Connect ID in the Evaluagent Authentication configuration.

2. Find your Amazon Connect S3 Storage details

Now click on Data storage. Copy the default S3 bucket for Calls and Chat transcript storage.

Enter the Contact Trace Records S3 bucket configured from step 2 in the format {bucket name}/{prefix} in the Evaluagent Authentication configuration.

Enter the S3 bucket details from above in the format {bucket name}/connect/{Amazon Connect instance name}/{Prefix} in the Evaluagent Authentication configuration.

This will generate an AWS Policy which can be applied in the next step.

Step 4: Create/Apply IAM security policies to grant EvaluAgent access your Amazon Connect data

You will need to complete 3 steps

Create the IAM Policy to allow Evaluagent access data
Create the IAM Role with custom trust policy for EvaluAgent to assume access
Grant the IAM Role permission to access the Encryption Key.

1. Create the IAM Policy to allow Evaluagent access data

Copy the JSON from the Policy created for you (similar to the JSON below)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::My_Amazon_Call_Bucket",
        "arn:aws:s3:::My_Amazon_Call_Bucket/connect/My_Amazon_Instance/CallRecordings/*",
        "arn:aws:s3:::contact-trace-records-My_Amazon_Instance",
        "arn:aws:s3:::contact-trace-records-My_Amazon_Instance/*",
        "arn:aws:s3:::My_Amazon_Chat_Bucket",
        "arn:aws:s3:::My_Amazon_Chat_Bucket/connect/My_Amazon_Instance/ChatTranscripts/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "connect:ListUsers",
        "connect:DescribeUser"
      ],
      "Resource": "*"
    }
  ]
}

From your AWS Console, navigate to IAM (Identity and Access Management). Click on Policies then click on Create policy. Use the Visual Editor or enter the policy in JSON. Click Save.

Note: If a prefix ends with a wildcard '*' then the year will be used in place of that wildcard. eg: my-bucket/connect-* would be "my-bucket/connect-2023/07/18". If no wild card is provided the structure would look like "my-bucket/2023/07/18"

2. Create the IAM Role with custom trust policy for EvaluAgent to assume access

You will need a new Role that has access to Amazon Connect and AWS S3.

Click on Create role then Trusted Entities and select AWS Account. Select "Another AWS account".

You will need the 12-digit Evaluagent AWS account ID is which is in the highlighted area below and can be found in the generated JSON under the Role section for your integration.

We also recommend checking the "Require an External ID" option. You can enter any value you wish - make a note of the value and enter it here in the Evaluagent integration configuration, leaving the field blank if necessary.

You will then be asked to Add Permission policies where you should select the policy you created above.

Click Next at the bottom of the page.

Name your Role following your company guidelines. Finally, in the Trusted entities section you should see something similar to the JSON below.

Click Save.

You may also wish to follow this process using Infrastructure as Code with a solution such as Terraform, AWS Cloud Formation, etc.

3. Grant the IAM Role permission to access the Encryption Key

You will need to ensure that the role you've setup has the permissions to access the Encryption Key used to encrypt your Amazon Connect data and AWS S3 buckets.

Navigate to Key Management Services in your AWS console and click on AWS managed keys. Select the Key configured for Amazon Connect, by default this is aws/connect. Ensure the AWS Role you created above has access to this key.

Repeat the process for your AWS S3 Key.

Step 4: Confirm that everything works from the Evaluagent platform

You can then return to the EvaluAgent platform and click Authenticate

On clicking Save, EvaluAgent will start fetching calls & chat on a regular (typically hourly) cycle.