Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Connect Customer Profiles with CMK

0

I received an email from AWS telling me to click the "Update KMS permission” button in the Amazon Connect Customer Profiles page. After this, I am to "create a support case for the Amazon Connect Customer Profiles team via AWS Support [5] to request CMK permission updates for your account."

We do not currently have a paid support plan, so this is kind of inconsiderate to force a change that requires input from a paid plan. Is this something that has to be done or will there be any issues with the Customer Profiles?

  • Adeleke Adebowale .J. EXPERT
    a year ago

    I think you should contact AWS support team to request for this

  • tfl-aws
    a year ago

    I started with basic support and they couldn't help me without paid tier. They sent me here to re:Post. That was one of my gripes about this change is that it required a higher level of support.

Tags
Amazon Connect Customer Profiles
Language
English
asked a year ago258 views
2 Answers
4

Just a family sharing, some reports that they are success by manually adjusting IAM permissions instead of creating a support case.

EXPERT
answered a year ago
EXPERT
reviewed a year ago
0
Accepted Answer

Thanks for your responses and sorry it took me so long to respond.

I think I have a slightly better understanding of this now. Having a "Customer managed" KMS key is important when allowing external applications (like Salesforce or 3rd party API's) to work with customer profiles. Since we aren't doing that, the default AWS owned key should suffice, which should also have the needed permissions. I won't be worrying about this anymore at the present time.

If I were going to set this up, I would create a customer managed key under AWS -> KMS (charges may apply). Then I would create and attach a key policy to it that can perform at least the following:

  • kms:Decrypt
  • kms:GenerateDataKey
  • kms:CreateGrant (Optional, if you have a different Administrator)

Finally, I'd go into AWS Connect -> Customer Profiles -> Domain details and edit the Encryption settings to use the new key.

Reference:

https://docs.aws.amazon.com/connect/latest/adminguide/enable-customer-profiles.html https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying.html

answered a year ago
EXPERT
reviewed a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content