how to check which supervisor has forcefully changed the user status in amazon connect

Hi Aj,

I know you said the agent was logged in, but just in case, be aware of Amazon Connect Now automatically changes Agent Status to Offline on Logout.

As explained in Logging Amazon Connect API calls with AWS CloudTrail, Amazon Connect is integrated with AWS CloudTrail, a service that provides a record of the Amazon Connect API calls that a user, role, or AWS service makes.

However, as the doc shows, "When you create or update hours of operation, flow, phone number, user hierarchy, agent status, and prompt resources, CloudTrail only logs those events if you use the CLI or public APIs to make the changes.", meaning that if someone made the change to offline in the Connect Real-time Metrics console, the event will not be logged AFAIK.

If the change was made using the CLI or public API, then you can query CloudTrail to see who and when the agent status was updated. The api call to change the agent status is PutUserStatus.

Querying AWS CloudTrail logs covers the basics of how to query CloudTrail logs. If you haven't queried them before, you'll first need to create an Athena table as the linked doc describes. The doc also talks about using CloudTrail Lake as a better alternative.

Here is an example I ran. I have an agent named JoeAgent who is logged in and "Available". Changing his status in the Connect console does not result in any event being logged in CloudTrail.

If I execute the following using the CLI:

# Get Connect Instance ID
export INSTANCE_ID=$(
  aws connect list-instances \
    --output text \
    --query 'InstanceSummaryList[*].Id'
)

# Get Joe Agent's user ID
export AGENT_ID=$(
  aws connect search-users \
    --instance-id $INSTANCE_ID \
    --search-criteria '{"StringCondition":{"FieldName":"username", "Value": "joeAgent","ComparisonType":"EXACT"}}' \
    --output text \
    --query 'Users[*].Id'
)

# Get ID of 'Available' agent status
export AVAILABLE_ID=$(
  aws connect list-agent-statuses \
    --instance-id $INSTANCE_ID \
    --output text \
    --query 'AgentStatusSummaryList[?Name==`Available`].Id'
)

# Get ID of 'Offline' agent status
export OFFLINE_ID=$(
  aws connect list-agent-statuses \
    --instance-id $INSTANCE_ID \
    --output text \
    --query 'AgentStatusSummaryList[?Name==`Offline`].Id'
)

# Change Joe Agent's status to Offline
aws connect put-user-status \
  --instance-id $INSTANCE_ID \
  --user-id $AGENT_ID \
  --agent-status-id $OFFLINE_ID

When I run the following Athena query:

I then see the following in Athena results (top) or if I search in CloudTrail Event History directly (bottom)

Thank you very much Scott for the details and insights .