How to transcribe a call with AWS transcribe API ?

Question

I got this error when I'm trying to transcribe a call:

> Account isn't authorized to call this operation. Check your account perm

I think the bad property is DataAccessRoleArn, I tried to create new role on IAM console, but it does not work.

Here's the full PHP code:

```
 'eu-west-3',
    'version' => 'latest',
    'credentials' => [
        'key' => $awsKey,
        'secret' => $awsSecretKey
    ],
]);

$result = $clientAWS->startCallAnalyticsJob([
    'CallAnalyticsJobName' => 'Transcript1', // REQUIRED
    'ChannelDefinitions' => [
        [
            'ChannelId' => 0,
            'ParticipantRole' => 'AGENT',
        ],
        [
            'ChannelId' => 1,
            'ParticipantRole' => 'CUSTOMER',
        ]
    ],
    'DataAccessRoleArn' => 'arn:aws:iam::{id}:role/AWSRole', // REQUIRED
    'Media' => [ // REQUIRED
        'MediaFileUri' => 's3://{bucketName}/2022/02/23/file.wav',
        'RedactedMediaFileUri' => 's3://{bucketName}/2022/02/23/',
    ],
    'Settings' => [
        'ContentRedaction' => [
            'RedactionOutput' => 'redacted', // REQUIRED
            'RedactionType' => 'PII', // REQUIRED
        ],
    ],
]);

print_r($result);
```

Do you know how to fix role issue?

Thank you in advance,

J.

Accepted Answer

For fixing this issue, you have to:
- Select a region compatible (in my case eu-central-1)
- Create a new role with AmazonS3FullAccess policy (just for testing, adjust for security) and this trust entity:

`{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "transcribe.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}`
- Attach AmazonTranscribeFullAccess and AmazonS3FullAccess policiy to your IAM user (just for testing, adjust for security)

Answer

There are two pieces of permissions that you have to consider here.
1. Your access key and secret key must have permissions to run the command `startCallAnalyticsJob` 
2. The analytics job must be able to access the data it needs using the role `DataAccessRoleArn`.

From the error message, it appears that (1) is the issue. Do the keys that are running this command have the permissions to run `startCallAnalyticsJob` on that specific job `Transcript1`? This would either be a role that your user has assumed, or your actual IAM user itself.

If that doesn't solve the problem, then you would want to make sure that the `DataAccessRole` has a trust relationship with Transcribe, such that transcribe is allowed to assume that role with access to the right objects in your S3 Bucket. Take a look at how to update the trust relationship for a role [here](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/edit_trust.html) . [This guide](https://docs.aws.amazon.com/transcribe/latest/dg/call-analytics-start.html) also walks you through creating it if needed.

The role would look something like:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "transcribe.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
```

How to transcribe a call with AWS transcribe API ?

Relevant content