Prerequisites for Amazon Connect Talent
Before you set up Amazon Connect Talent, review the following requirements.
AWS account requirements
To create an Amazon Connect Talent instance, you need the following:
-
An active AWS account.
-
Access to a supported AWS Region. For more information, see Supported Regions and endpoints.
-
A valid email address for the first administrator of the instance.
Avoid using your AWS account root user for everyday tasks. Instead, create an administrative user in IAM and use it to set up and manage Amazon Connect Talent.
IAM permissions and managed policies
For details about how Amazon Connect Talent works with IAM, the AWS managed policies that are available, and example policies, see Identity and access management for Amazon Connect Talent.
Managing your Amazon Connect Talent instance
The following sections describe the IAM permissions required to create and delete an Amazon Connect Talent instance.
Create an instance
The IAM identity (user or role) that creates an Amazon Connect Talent instance needs permissions across several AWS services, because the setup process provisions resources in Connect Customer, Amazon Lex, Connect Customer Cases, Connect Customer Customer Profiles, Amazon Q in Connect, and Amazon SES.
As a recommended approach, grant the creating identity the following permissions:
-
AmazonConnect_FullAccess -
AmazonLexFullAccess -
Full access to Connect Customer Cases, Connect Customer Customer Profiles, Amazon Q in Connect, and Amazon SES
-
iam:CreateServiceLinkedRole,iam:PassRole, and AWS KMS grant permissions
For a least-privilege alternative, use action-level policies scoped to only the actions the setup process requires.
An identity with the AdministratorAccess managed policy can also create
instances. Use the scoped approach when possible to follow the principle of least
privilege.
When you create an instance, Amazon Connect Talent also provisions the IAM roles it needs to operate on your behalf.
Delete an instance
To delete an Amazon Connect Talent instance, the identity performing the deletion needs permissions to remove resources across the same services that were provisioned during creation.
The following permissions are required, grouped by service:
-
Connect Customer –
connect:DeleteInstance,connect:DeleteIntegrationAssociation,connect:DisassociateBot -
Amazon Lex –
lex:ListBots,lex:ListBotAliases,lex:DeleteBotAlias,lex:DeleteBot -
Connect Customer Customer Profiles –
profile:DeleteDomain,profile:DeleteIntegration,profile:DeleteProfileObjectType -
Connect Customer Cases –
cases:DeleteDomain -
Amazon Q in Connect –
wisdom:DeleteAssistant -
Amazon SES –
ses:DeleteEmailIdentity
An identity with the AdministratorAccess managed policy can also delete
instances.
Clean up resources after deleting an instance
After you delete an Amazon Connect Talent instance, some resources provisioned during instance creation might not be removed automatically. You need to manually delete these resources from your AWS account in the same AWS Region as the instance.
The following resources might need manual cleanup:
| Resource | Name pattern | How to delete |
|---|---|---|
| Amazon Lex bots (up to 3) | |
First disassociate the bot from the Connect Customer instance, then delete the bot in the Amazon Lex console. |
| Connect Customer Customer Profiles domain | amazon-connect-hiring- |
Delete in the Connect Customer Customer Profiles console. |
| Connect Customer Cases domain | Uses the instance alias | Delete in the Connect Customer Cases console. |
| Amazon Q in Connect assistant | Hiring Interview Assistant | Delete in the Amazon Q in Connect console. |
If you're unable to identify which resources were left behind, contact AWS Support
Amazon SES requirements
Amazon Connect Talent uses Amazon SES to send email to candidates, such as invitations to complete an evaluation. New Amazon SES accounts start in the Amazon SES sandbox. While your account is in the sandbox, you can send email only to verified addresses, and daily and per-second sending limits apply.
To send email to candidates who are not verified addresses, request production access to move your account out of the sandbox. For instructions, see Move Amazon SES out of sandbox mode.
