Prepare Amazon Connect Environment for Real-Time Third Party Telephony Recording (Multi-ACD)

This topic describes the AWS environment preparation steps required before Real-Time Third Party Telephony Recording (Multi-ACD) can record calls from your Amazon Connect instance. You perform all steps in your AWS account. After you complete these steps, your NiCE CXone Account Representative uses the values you collect to finish the configuration on the NiCE CXone side.

Before You Begin

• Ensure you have administrative access to your AWS account and Amazon Connect instance.

• Your NiCE Professional Services Engineer will provide the NiCE-specific values referenced in this procedure.

• Do we need to add licensing and permissions info here or is it the same as the main page?

Workflow

Perform these steps in the correct order to prepare your AWS environment for recording.

Step 1: Find Your Amazon Connect Instance ARN

Step 2: Enable Live Media Streaming

Step 3: Configure Amazon Connect Flows

Step 4: Create the KVS Access IAM Role

Step 5: Configure EventBridge

Step 6: Configure Agent Events

Step 1: Find Your Amazon Connect Instance ARN

You need your Amazon Connect instance ARN for several steps in this procedure. Find it and save it securely for reference.

To find your instance ARN:

1. Open the AWS Console and go to Amazon Connect.

2. Select your instance.

3. Copy the Instance ARN from the instance overview page and save somewhere secure.

Step 2: Enable Live Media Streaming

Amazon Connect must stream call audio to Kinesis Video Streams (KVS) before NiCE can retrieve it. Amazon Connect automatically creates a KVS stream for each call once live media streaming is enabled. The stream ARN is included in the contact event payload, and NiCE CXone uses it to retrieve the audio.

To enable live media streaming:

1. Open the AWS Console and go to Amazon Connect.

2. Select your instance.

3. Go to Data storage.

4. Under Live media streaming, turn on live media streaming and configure a stream prefix and retention period.

5. In the encryption settings, select one of the following options:

   • Use the default AWS-managed key: aws/kinesisvideo.

   • Use a customer managed key (CMK).

6. Save the configuration.

Step 3: Configure Amazon Connect Flows

You must perform these steps for each Amazon Connect flow where recording is required. The Start Media Streaming and Contact Tags blocks must be included in all relevant flows, specifically:

• Agent Transfer flows

• Queue Transfer flows

• Inbound flows

To configure flows:

1. Open the flow editor in the AWS Console.

2. Select the flow that you want to configure for recording.

3. Add the Start Media Streaming Block.

4. Under Start streaming, select the following checkboxes:

   • From the customer

   • To the customer

5. Next, add the Contact Tags Block.

   The Contact tags block must be added after the Start media streaming block.

6. For Select tag action, select Tag.

7. For Tag key, enter kvsStreamArn (case-sensitive).

8. Set the value dynamically, using Media streams as the namespace and Customer audio stream ARN as the key.

9. Lastly, add Custom Business Data (if required).

10. Create a new Contact tags block.

11. Set the tag key to the business data field.

12. Set the value manually or dynamically.

13. Click Confirm.

Step 4: Create the KVS Access IAM Role

NiCE CXone reads call audio from your Kinesis Video Streams using cross-account access. You must create an IAM role that NiCE CXone can assume.

Before you create the role, obtain the following values from your NiCE Professional Services Engineer:

To create the KVS access IAM role:

1. Create an IAM role with the following trust policy. Replace the placeholder values with those provided by your NiCE Professional Services Engineer.

   var(--codeSnippetCopyLabel)

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "AWS": "arn:aws:iam::<NiCE-account>:root"
         },
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": {
             "sts:ExternalId": "<cxone-tenant-id>"
           }
         }
       }
     ]
   }

2. Attach the following permission policy to the role to grant NiCE CXone read access to your Kinesis Video Streams.

   var(--codeSnippetCopyLabel)

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "kinesisvideo:GetDataEndpoint",
           "kinesisvideo:GetMedia",
           "kinesisvideo:GetMediaForFragmentList",
           "kinesisvideo:ListFragments",
           "kinesisvideo:DescribeStream"
         ],
         "Resource": "arn:aws:kinesisvideo:<region>:<customer-account-id>:stream/kvs-connect-*"
       }
     ]
   }

3. Save the role ARN. You will need it to enter into the NiCE CXone configuration as KVS Access Role ARN.

Step 5: Configure EventBridge

Amazon Connect forwards contact and agent events from your AWS account to NiCE CXone using Amazon EventBridge. You need to create a forwarding IAM role and an EventBridge rule on your default event bus.

Before you proceed, obtain the following values from your NiCE Professional Services Engineer:

To create the forwarding IAM role:

1. Create an IAM role that allows EventBridge to send events cross-account to the NiCE event bus.

2. Use the following trust policy. Replace the placeholder values with those provided by your NiCE Professional Services Engineer.

   var(--codeSnippetCopyLabel)

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": { "Service": "events.amazonaws.com" },
         "Action": "sts:AssumeRole"
       }
     ]
   }

3. Attach the following permission policy to the role to send events cross-account to the NiCE event bus.

   var(--codeSnippetCopyLabel)

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": "events:PutEvents",
         "Resource": "arn:aws:events:<NiCE-region>:<NiCE-account>:event-bus/<target-event-bus-name>"
       }
     ]
   }

4. Save the role ARN.

To create the EventBridge rule:

1. On your default EventBridge event bus, create a rule with the following event pattern. This pattern matches both Amazon Connect contact events and agent events.

   var(--codeSnippetCopyLabel)

   {
     "source": ["aws.connect", "cxone.amc.agentdata.kinesis"],
     "detail-type": [
       "Amazon Connect Contact Event",
       "Amazon Connect Agent Event via Kinesis"
     ],
     "resources": [
       "arn:aws:connect:<region>:<customer-account-id>:instance/<instance-id>"
     ]
   }

2. Set the rule target to the NiCE CXone event bus:

   setting	value
   Target type	EventBridge event bus
   Target event bus	arn:aws:events:<region>:<NiCE-openrec-account>:event-bus/<target-event-bus-name>
   Execution role	The forwarding IAM role you created above

Step 6: Configure Agent Events

Agent events require two additional components: a Kinesis data stream connected to your Amazon Connect instance, and an EventBridge Pipe that republishes those events to your default event bus so the rule you created above can pick them up.

To create the Kinesis Data Stream:

1. Open the AWS Console and go to Kinesis.

2. Create a new data stream.

3. Configure the shard count based on your expected agent events volume.

   For small deployments, one shard is typically sufficient. A single shard supports up to 1 MB/sec of ingress or 1,000 records/sec.
   For larger deployments, increase the shard count as needed.

4. Set retention to 24 hours, at minimum.

5. In the AWS console, go to Data Streaming>Agent Events.

6. Associate the Kinesis stream with your Amazon Connect instance.

7. Save the configuration.

To create the EventBridge Pipe:

Create an EventBridge Pipe to read from the Kinesis stream and republish to the default event bus.

1. Configure the settings according to the table below.

   setting	value
   Source	The Kinesis data stream you created above (starting position: LATEST, batch size: one)
   Target	Default EventBridge event bus
   Target > Source field	cxone.amc.agentdata.kinesis
   Target > Detail type	Amazon Connect Agent Event via Kinesis
   Target > Resources	Your Amazon Connect instance ARN

2. Use the following input template for the pipe target:

   var(--codeSnippetCopyLabel)

   {"data": <$.data>, "sequenceNumber": "<$.sequenceNumber>"}

Parameters

CDK Template Parameters

NiCE CXone provides a CDK template that automates the creation of all resources described in this topic. To use it, supply the parameter values listed below.

Parameters provided by NiCE CXone Services

Setup Checklist

Use this checklist to verify you have completed all steps before handing off to your NiCE Professional Services Engineer:

• Live media streaming is enabled on the Amazon Connect instance.

• Each recorded flow includes the Start media streaming and Contact tags blocks.

• The KVS access IAM role is created, with both the trust policy and the permission policy attached.

• The Kinesis data stream is created and associated with the Amazon Connect instance as agent events storage.

• The EventBridge Pipe is created with the correct source, detail type, resources, and input template.

• The EventBridge forwarding IAM role is created.

• The EventBridge rule is created on the default event bus using the event pattern above, with the target set to the NiCE CXone cross-account bus using the forwarding role.

• If you plan to use the CDK template, you have all the parameters listed in the CDK Template Parameters section above.