Getting started with Amazon Connect Talent

To start using Amazon Connect Talent, you create a Talent instance from the AWS console. The instance creation wizard walks you through identity management, administrator setup, permissions, and resource provisioning. You can also configure SAML 2.0-based authentication for single sign-on access, prepare Amazon SES for candidate email, and set up your instance for recruiters.

Start using Amazon Connect Talent

Complete the following high-level steps to start using Amazon Connect Talent:

Create an Amazon Connect Talent instance

The instance creation wizard walks you through identity management, administrator setup, permissions, and resource provisioning. The process takes a few minutes.

Prerequisites

Before you create an Amazon Connect Talent instance, verify that you have the following:

To navigate to Amazon Connect Talent

You can open Amazon Connect Talent in the AWS Management Console in any of the following ways:

The Amazon Connect Talent instances page shows your instances. The page includes the following columns:

Choose Add an instance to start the creation wizard.

Step 1: Set identity

Choose your identity management option:

For Access URL, enter a unique alias for your instance. The alias must use lowercase letters, numbers, and hyphens. It must be 1–45 characters and end with -hiring.

Step 2: Add administrator

Add at least one administrator to your instance.

If you chose Store users in Amazon Connect Talent, provide the username, first name, last name, email, and a password (entered twice to verify).

If you chose SAML 2.0-based authentication, provide the username, first name, last name, and email.

You can add multiple administrators.

Step 3: Permissions

Review the IAM roles that Amazon Connect Talent creates automatically. These roles allow Amazon Connect Talent to manage its resources and to send email on your behalf. For more information about how Amazon Connect Talent uses IAM, see Identity and access management for Amazon Connect Talent.

Step 4: Review and create

Review your configuration. The review page shows your identity settings, administrator details, and the AWS resources that Amazon Connect Talent provisions for your instance, such as IAM roles, data storage, and email.

Choose Create instance to start provisioning.

View instance details

After creation completes, choose the instance alias to view details, including the access information for your instance, distribution settings such as the instance ARN, and the AWS resources that Amazon Connect Talent manages for the instance.

Configure SAML with IAM for Amazon Connect Talent

Amazon Connect Talent supports identity federation with SAML 2.0 through AWS IAM. This enables web-based single sign-on (SSO) from your organization's identity provider to your talent instance.

Overview of the SAML authentication flow

The following steps describe the SAML authentication flow for Amazon Connect Talent:

To enable SAML-based authentication

Complete the following high-level steps to enable SAML-based authentication:

To enable SAML federation between your IdP and AWS

IAM policy examples

The following example shows an IAM policy that allows all users in a specific instance to federate into Amazon Connect Talent.

{
    "Version": "2012-10-17", 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "connect:GetFederationToken",
            "Resource": "arn:aws:connect:region:123456789012:instance/instance-id/user/${aws:userid}"
        }
    ]
}

The following example uses an instance ID condition instead of a resource ARN.

{
    "Version": "2012-10-17", 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "connect:GetFederationToken",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "connect:InstanceId": "instance-id"
                }
            }
        }
    ]
}

Configure regional SAML endpoints

The session duration is 12 hours. We recommend that users log out of both Amazon Connect Talent and the identity provider when they finish their session.

Move Amazon SES out of sandbox mode

Amazon Connect Talent uses Amazon SES to send email to candidates. New Amazon SES accounts start in the sandbox, where you can send email only to verified addresses and lower sending limits apply. To send email to candidates who are not verified addresses, request production access for Amazon SES.

For instructions, see Request production access (moving out of the Amazon SES sandbox) in the Amazon Simple Email Service Developer Guide.

Set up your instance

After you create your instance, set it up for your recruiting team. Add users and assign security profiles, add your company values to your knowledge base, and configure your candidate-facing branding. For more information, see Settings.

After you set up your instance, see the Amazon Connect Talent User Guide to learn how to create evaluations and start hiring.