Tag Based restriction and historical changes

When applying tag-based access controls in Amazon Connect, it's important to note that users with these restrictions will indeed lose access to historical change logs for the resources they are restricted on. This is a limitation of the tag-based access control feature.

However, there is a potential workaround to allow users to view historical changes while still maintaining some level of tag-based restrictions:

1. Ensure that the users have at least "view" permissions for the resources you want them to access. This is crucial for avoiding permission inconsistencies that could result in denied access requests.

2. In the security profile assigned to these users, you should explicitly grant the "Access metrics" permission. This permission is typically associated with the ability to view historical changes and audit information.

3. Be cautious when applying tag-based access controls. It's considered best practice to enable these controls for all resources together, rather than restricting them independently. This helps maintain consistency in your access control strategy.

4. You may need to fine-tune the tag-based restrictions to allow access to specific resources or modules related to historical changes. This could involve adjusting the tags applied to these resources or modifying the conditions in your IAM policies.

5. Consider creating a separate security profile that includes permissions for viewing historical changes, and assign it to users who need this access alongside their tag-based restrictions.

Keep in mind that this approach may require careful balancing between maintaining the desired level of access control and allowing visibility into historical changes. It's crucial to thoroughly test any changes to ensure they meet your security and compliance requirements while providing the necessary access to historical data.

If this workaround doesn't fully meet your needs, you may need to reconsider your access control strategy or reach out to AWS support for more specific guidance tailored to your use case.
Sources
Apply tag-based access control in Amazon Connect - Amazon Connect
View historical changes to user records - Amazon Connect