Setting up Contact Center on a customer-managed AWS account

<body>
<p id="docs-hc-snippet" style="display: none;">Use this guide when setting up Zendesk Contact Center on an AWS account that you provide and manage (Bring Your Own Account - BYOA). In this deployment model, you purchase AWS services directly from AWS and are responsible for your AWS account and Amazon Connect environment. Use these steps to provision your AWS environment, configure Amazon Connect and SAML single sign-on (SSO), connect your Zendesk account, and validate the deployment before handoff.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="addon_contact-center">
<table>
<tbody>
<tr>
<td>
<strong>Add-on</strong>
</td>
<td>Contact Center</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Set up Contact Center on your own AWS account by provisioning the AWS environment, configuring SAML SSO, connecting your account, and validating access before handoff. You’ll also test inbound and outbound calling, recordings, and transcription, then clean up test resources. This setup is for admins managing a BYOA deployment with Amazon Connect, API tokens, Lambda triggers, and telephony validation.</p>
</div>

<div class="body">

<p class="p">Use this guide when setting up Zendesk Contact Center on an AWS account that you provide and
manage (Bring Your Own Account - BYOA). In this deployment model, you purchase AWS services
directly from AWS and are responsible for your AWS account and Amazon Connect environment.
Use these steps to provision your AWS environment, configure Amazon Connect and SAML single
sign-on (SSO), connect your Zendesk account, and validate the deployment before handoff.</p>
<p class="p">Before you begin, make sure you have:</p>
<ul class="ul">
<li class="li">Administrator access to the AWS account</li>
<li class="li">Administrator access to the Zendesk account and its valid subdomain, such as
<code class="ph codeph">example.zendesk.com</code>
</li>
<li class="li">An active Contact Center license</li>
</ul>
<p class="p">This article contains the following topics:</p>
<ul class="ul" id="zcc_byoa_setup_guide_partners__ul_mmx_zsz_gkc">
<li class="li"><a class="xref" href="#step1-deploy-connect-infra">Step 1: Deploy Connect infrastructure stack</a></li>
<li class="li"><a class="xref" href="#step2-deploy-zcc-infra">Step 2: Deploy Contact Center infrastructure stack</a></li>
<li class="li"><a class="xref" href="#step3-configure-sso-connect">Step 3: Configure SSO for Amazon Connect</a></li>
<li class="li"><a class="xref" href="#step4-configure-connect-access">Step 4: Configure Connect Access and Validate Settings</a></li>
<li class="li"><a class="xref" href="#step5-configure-zd-access">Step 5: Configure Zendesk Access and Validate Settings</a></li>
<li class="li"><a class="xref" href="#step6-turnon_recordings-aws">Step 6: Activate recordings on AWS</a></li>
<li class="li"><a class="xref" href="#step7-test-telephony">Step 7: Test telephony capabilities</a></li>
<li class="li"><a class="xref" href="#step8-cleanup">Step 8: Clean up (Optional)</a></li>
</ul>
<p class="p">Related articles:</p>
<ul class="ul" id="zcc_byoa_setup_guide_partners__ul_zcc_setup_related_articles">
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/10342463822746" target="_blank">About AWS services in Contact Center</a></li>
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/10954975160858" target="_blank">Accessing Amazon Connect and AWS Console from Contact
Center</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="step1-deploy-connect-infra">
<h2 class="title topictitle2" id="ariaid-title2">Step 1: Deploy Connect infrastructure stack</h2>
<div class="body">
<p class="p">First, create the Amazon Connect foundation in your AWS account by deploying
the Connect infrastructure stack.</p>
<p class="p"><strong class="ph b">To deploy the Connect infrastructure stack</strong></p>
<ol class="ol">
<li class="li">
<p class="p">Sign into your AWS account.</p>
</li>
<li class="li">
<p class="p">Navigate the CloudFormation console and select <strong class="ph b">Create stack</strong> &gt; <strong class="ph b">With new resources
(standard)</strong>.</p>
<p class="p"><img class="image img-screenshot" id="step1-deploy-connect-infra__image_xjl_btz_gkc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_cloudformation_stacks.png" width="600"></p>
</li>
<li class="li">
<p class="p">On the next screen:</p>
<ul class="ul">
<li class="li">
<p class="p">Select <strong class="ph b">Choose an existing template</strong>
</p>
</li>
<li class="li">
<p class="p">Select <strong class="ph b">Amazon S3 URL</strong></p>
</li>
<li class="li">
<p class="p">Enter:
<code class="ph codeph">https://zendesk-contact-center-us-east-1.s3.amazonaws.com/connect/cfn.yaml</code></p>
</li>
<li class="li">
<p class="p">Click <strong class="ph b">Next</strong></p>
<p class="p"><img class="image img-screenshot" id="step1-deploy-connect-infra__image_cc_setup_cloudformation_template" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_cloudformation_template.png" width="600"></p>
</li>
</ul>
</li>
<li class="li">
<p class="p">On the next screen:</p>
<ul class="ul">
<li class="li">
<p class="p">Enter a <strong class="ph b">Stack name</strong></p>
</li>
<li class="li">
<p class="p">Enter an <strong class="ph b">InstanceAlias</strong></p>
</li>
<li class="li">
<p class="p">Enter your <strong class="ph b">ZendeskDomain</strong>: For example, <code class="ph codeph">foo.zendesk.com</code>.</p>
</li>
<li class="li">
<p class="p">Click <strong class="ph b">Next</strong></p>
<div class="note tip" id="step1-deploy-connect-infra__note_leave_samlxmldocument_blank">
<span class="tiptitle">Tip:</span> Leave SamlXmlDocument
blank.</div>
<p class="p"><img class="image img-screenshot" id="step1-deploy-connect-infra__image_cc_setup_cloudformation_parameters" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_cloudformation_parameters.png" width="600"></p>
</li>
</ul>
</li>
<li class="li">
<p class="p">On the next screen check the three required acknowledgements, then click <strong class="ph b">Next</strong>.</p>
<p class="p"><img class="image img-screenshot" id="step1-deploy-connect-infra__image_cc_setup_cloudformation_acknowledgements" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_cloudformation_acknowledgements.png" width="600"></p>
</li>
<li class="li">
<p class="p">Review the stack configuration and click <strong class="ph b">Submit</strong> to create the
stack.</p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="step2-deploy-zcc-infra">
<h2 class="title topictitle2" id="ariaid-title3">Step 2: Deploy Contact Center infrastructure stack</h2>
<div class="body">
<p class="p">Next, deploy the Contact Center components that connect your Amazon Connect
instance to Zendesk.</p>
<p class="p"><strong class="ph b">To deploy the core Contact Center infrastructure stack</strong></p>
<ol class="ol">
<li class="li">
<p class="p">Request the CloudFormation template to deploy the Contact Center core solution from Zendesk
partner support along with Amazon Connect Customer <strong class="ph b">instance ARN</strong>.</p>
</li>
<li class="li">
<p class="p">Zendesk will generate a new CloudFormation template based on the Connect instance ARN
and provide a link for it. Assuming you are already logged into your AWS account, simply
click on the link.</p>
</li>
</ol>
<div class="note note" id="step2-deploy-zcc-infra__note_zendesk_will_also_provide_the_metadata_x">
<span class="notetitle">Note:</span> Zendesk will also provide
the metadata.xml file required to configure SAML/SSO in Step 3.</div>
<ol class="ol">
<li class="li">
<p class="p">You should be taken directly to the CloudFormation console where you can review the
stack parameters.</p>
</li>
<li class="li">
<p class="p">Acknowledge the access capability disclaimers and click <strong class="ph b">Next</strong>.</p>
</li>
<li class="li">
<p class="p">Review the stack configuration and click <strong class="ph b">Submit</strong> to create the
stack.</p>
</li>
<li class="li">
<p class="p">Once the Contact Center core infrastructure stack has been deployed, inform Zendesk partner
support so they can activate it.</p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="step3-configure-sso-connect">
<h2 class="title topictitle2" id="ariaid-title4">Step 3: Configure SSO for Amazon Connect</h2>
<div class="body">
<p class="p">Contact Center users access Amazon Connect services through Zendesk. In this guide, you can
use any identity provider (IdP) supported by Zendesk for users to sign in to Zendesk, and
Zendesk then brokers their access to your Amazon Connect environment. For an overview of the
Zendesk-mediated federation flow, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/10879182740506-Understanding-single-sign-on-for-Contact-Center" target="_blank">Understanding single sign-on for Contact Center</a>. For
Zendesk sign-in options, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5380943678106-Giving-users-different-ways-to-sign-into-Zendesk" target="_blank">Giving users different ways to sign into Zendesk</a> and
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887505690-Enabling-SAML-single-sign-on" target="_blank">Enabling SAML single sign-on</a>. The AWS steps in this
step configure the Zendesk-mediated federation from Zendesk to Amazon Connect. For more
information about accessing Amazon Connect and the AWS Management Console from Contact
Center, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/10954975160858" target="_blank">Accessing Amazon Connect and AWS Console from Contact
Center</a>.</p>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested2" id="step_3_1_create_identity_provider_for_amazon_connect">
<h3 class="title topictitle3" id="ariaid-title5">3.1 Create identity provider for Connect</h3>
<div class="body">
<p class="p">Create the AWS IAM identity provider that trusts the SAML metadata supplied by Zendesk.
This is separate from your corporate IdP, which is configured for Zendesk
sign-in.</p>
<p class="p"><strong class="ph b">To create the identity provider for Connect</strong></p>
<ol class="ol">
<li class="li">
<p class="p">From the AWS Console navigate to <strong class="ph b">IAM</strong>.</p>
</li>
<li class="li">
<p class="p">Select <strong class="ph b">Identity Providers</strong> on the left (under <strong class="ph b">Access
Management</strong>) and then click <strong class="ph b">Add Provider</strong>.</p>
</li>
<li class="li">
<p class="p">Ensure that the <strong class="ph b">Provider type</strong> is set to <strong class="ph b">SAML</strong> and then enter a name for the
provider. It is recommended to use a name such as
<code class="ph codeph">${connect-alias}-idp</code>. </p>
</li>
<li class="li">
<p class="p">Then, under <strong class="ph b">Metatadata document</strong> click the <strong class="ph b">Choose file</strong> button
and upload the XML metadata file provided by Zendesk.</p>
</li>
<li class="li">
<p class="p">Click <strong class="ph b">Add Provider</strong></p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested2" id="step_3_2_create_the_sso_federation_iam_policy_for_amazon_connect">
<h3 class="title topictitle3" id="ariaid-title6">3.2 Create the SSO federation IAM policy for Connect</h3>
<div class="body">
<p class="p">Define the permissions that Zendesk-federated users need when they access the Amazon
Connect instance.</p>
<p class="p"><strong class="ph b">To create the SSO federation IAM policy for Connect</strong></p>
<ol class="ol">
<li class="li">
<p class="p">Select <strong class="ph b">Policies</strong> under IAM <strong class="ph b">Access Management</strong>, then click <strong class="ph b">Create
Policy</strong>.</p>
</li>
<li class="li">
<p class="p">Switch to the <strong class="ph b">JSON</strong> view and enter the JSON content below.</p>
<p class="p">Be sure to replace the <strong class="ph b">[AMAZONCONNECTARN]</strong> placeholder (including the square
brackets) with your Connect instance’s ARN before saving the policy</p>
<pre class="pre codeblock"><code>{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Action": "connect:GetFederationToken",
"Resource": [
"[AMAZONCONNECTARN]/user/${aws:userid}"
]
}
]
}</code></pre>
</li>
<li class="li">
<p class="p">Click <strong class="ph b">Next</strong>.</p>
</li>
<li class="li">
<p class="p">Enter a policy name such as
<code class="ph codeph">${connect-alias}-sso-federation-policy</code>.</p>
</li>
<li class="li">
<p class="p">Click <strong class="ph b">Create policy</strong>.</p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title7" class="topic nested2" id="step_3_3_create_sso_federation_iam_role_for_amazon_connect">
<h3 class="title topictitle3" id="ariaid-title7">3.3 Create SSO federation IAM role for Connect</h3>
<div class="body">
<p class="p">Create the IAM role that Amazon Connect uses to authorize access from Zendesk's
federation flow.</p>
<p class="p"><strong class="ph b">To create SSO federation IAM role for Connect</strong></p>
<ol class="ol">
<li class="li">
<p class="p">Select <strong class="ph b">Roles</strong> under IAM <strong class="ph b">Access Management</strong>, then click <strong class="ph b">Create Role</strong>.</p>
</li>
<li class="li">
<p class="p">Select <strong class="ph b">SAML 2.0 federation</strong> for the role type.</p>
</li>
<li class="li">
<p class="p">Select the Identity Provider created in Step 3.1 as the <strong class="ph b">SAML 2.0-base
provider</strong>.</p>
</li>
<li class="li">
<p class="p">Ensure <strong class="ph b">Allow programmatic and AWS Management Console access</strong> is
selected with a non-regional endpoint, then click <strong class="ph b">Next</strong>.</p>
<p class="p"><img class="image img-screenshot" id="step_3_3_create_sso_federation_iam_role_for_amazon_connect__image_cc_setup_connect_role_permissions" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_connect_role_permissions.png" width="600"></p>
</li>
<li class="li">
<p class="p">On the next page, add the policy created in step 3.2.</p>
</li>
<li class="li">
<p class="p">Enter a name for the role. For example, <code class="ph codeph">${connect-alias}-sso-connect.</code></p>
<p class="p"><img class="image img-screenshot" id="step_3_3_create_sso_federation_iam_role_for_amazon_connect__image_cc_setup_connect_sso_role" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_connect_sso_role.png" width="600"></p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title8" class="topic nested2" id="step_3_4_information_required_by_zendesk">
<h3 class="title topictitle3" id="ariaid-title8">3.4 Information required by Zendesk</h3>
<div class="body">
<p class="p">Send the federation values to Zendesk so Zendesk can finish connecting your Amazon
Connect instance to Contact Center.</p>
<p class="p">Provide the following information to Zendesk to complete the SSO setup:</p>
<ul class="ul">
<li class="li">
<p class="p">The <strong class="ph b">SAML Aud</strong> from the role created in 3.3 , which can found in the role’s
trust policy</p>
</li>
<li class="li">
<p class="p">The ARN of the role created in 3.3</p>
</li>
<li class="li">
<p class="p">The ARN of the identity provider created in 3.1</p>
</li>
<li class="li">
<p class="p">The Connect Instance Relay State URL based on the following format:</p>
</li>
</ul>
<p class="p"><code class="ph codeph">https://[REGION].console.aws.amazon.com/connect/federate/[CONNECT_INSTANCE_ID]</code></p>
<div class="note note" id="step_3_4_information_required_by_zendesk__note_replace_the_region_and_connect_instan">
<span class="notetitle">Note:</span> Replace the [REGION] and
[CONNECT_INSTANCE_ID] with the appropriate values.</div>
<ul class="ul">
<li class="li">
<p class="p">The SAML Login URL as
<strong class="ph b"><code class="ph codeph">[ZENDESK_INSTANCE_URL]</code></strong><code class="ph codeph">/access/saml/idp/connect</code>
</p>
</li>
</ul>
<div class="note note" id="step_3_4_information_required_by_zendesk__note_replace_the_zendesk_instance_url_place">
<span class="notetitle">Note:</span> Replace the
[ZENDESK_INSTANCE_URL] placeholder with your Zendesk subdomain. For example:
<code class="ph codeph">https://mydomain.zendesk.com/access/saml/idp/connect</code>.</div>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title9" class="topic nested1" id="step4-configure-connect-access">
<h2 class="title topictitle2" id="ariaid-title9">Step 4: Configure Connect Access and Validate Settings</h2>
<div class="body">
<p class="p">In this step, you'll validate approved origins, configure a test user, claim a test
phone number, and optionally enable outbound dialing in your Amazon Connect instance.</p>
</div>
<div aria-labelledby="ariaid-title10" class="topic nested2" id="step_4_1_validate_approved_origins">
<h3 class="title topictitle3" id="ariaid-title10">4.1 Validate Approved Origins</h3>
<div class="body">
<p class="p">Confirm that the Zendesk and Contact Center domains are allowed to communicate with the
Amazon Connect instance.</p>
<p class="p"><strong class="ph b">To validate approved origins</strong></p>
<div class="p">
<ol class="ol" id="step_4_1_validate_approved_origins__ol_cdh_421_hkc">
<li class="li">Navigate to AWS Management Console &gt; <strong class="ph b">Amazon Connect</strong>, then select your
instance alias.</li>
<li class="li">Click <strong class="ph b">Approved Origins</strong>, then validate that the following 3 domains are
present. If any are missing, add them manually:<ul class="ul" id="step_4_1_validate_approved_origins__ul_ncn_pc1_hkc">
<li class="li"><code class="ph codeph">example.zendesk.com</code></li>
<li class="li"><code class="ph codeph">https://1162892.apps.zdusercontent.com</code></li>
<li class="li"><code class="ph codeph">https://1162894.apps.zdusercontent.com</code></li>
</ul>
</li>
</ol>
</div>
<p class="p"><img class="image img-screenshot" id="step_4_1_validate_approved_origins__image_cc_setup_approved_origins" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_approved_origins.png" width="600"></p>
</div>
</div>
<div aria-labelledby="ariaid-title11" class="topic nested2" id="step_4_2_configure_test_user">
<h3 class="title topictitle3" id="ariaid-title11">4.2 Configure test user</h3>
<div class="body">
<p class="p">Create a test Amazon Connect user whose login matches the corresponding Zendesk user.
This lets you verify the federated access flow before testing calls.</p>
<p class="p"><strong class="ph b">To configure a test user</strong></p>
<ol class="ol">
<li class="li">
<p class="p">Navigate to the <strong class="ph b">Overview</strong> page and click the <strong class="ph b">Log in for
emergency access</strong> link:</p>
<p class="p"><img class="image img-screenshot" id="step_4_2_configure_test_user__image_cc_setup_emergency_access" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_emergency_access.png" width="600"></p>
</li>
<li class="li">
<p class="p">From the Connect Dashboard, navigate to the <strong class="ph b">User Management</strong> and click
<strong class="ph b">Add new users</strong>.</p>
<p class="p"><img class="image img-screenshot" id="step_4_2_configure_test_user__image_cc_setup_add_connect_users" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_add_connect_users.png" width="600"></p>
</li>
<li class="li">
<p class="p">From the <strong class="ph b">Add user</strong> page:</p>
<ul class="ul">
<li class="li">
<p class="p">Enter the <strong class="ph b">First name</strong></p>
</li>
<li class="li">
<p class="p">Enter the <strong class="ph b">Last name</strong></p>
</li>
<li class="li">
<p class="p">Enter the <strong class="ph b">Login</strong> (this must match the corresponding Zendesk user’s
primary email address exactly, which is case-sensitive)</p>
</li>
<li class="li">
<p class="p">Select the <strong class="ph b">Security profile</strong> permissions (Admin, Agent,
etc.)</p>
</li>
<li class="li">
<p class="p">Select a <strong class="ph b">Routing profile</strong> (Basic Routing Profile)</p>
</li>
<li class="li">
<p class="p">Click <strong class="ph b">Save</strong></p>
</li>
</ul>
</li>
</ol>
<p class="p"><img class="image img-screenshot" id="step_4_2_configure_test_user__image_cc_setup_connect_test_user" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_connect_test_user.png" width="600"></p>
</div>
</div>
<div aria-labelledby="ariaid-title12" class="topic nested2" id="step_4_3_claim_test_phone_number">
<h3 class="title topictitle3" id="ariaid-title12">4.3 Claim Test Phone Number</h3>
<div class="body">
<p class="p">Claim a temporary number and route it to the sample inbound flow so you can test
telephony.</p>
<p class="p"><strong class="ph b">To claim a test phone number</strong></p>
<ol class="ol">
<li class="li">
<p class="p">Navigate to the Phone numbers page and click on Claim a number as shown
here:</p>
<p class="p"><img class="image img-screenshot" id="step_4_3_claim_test_phone_number__image_cc_setup_claim_phone_number" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_claim_phone_number.png" width="600"></p>
</li>
<li class="li">
<p class="p">On the Claim Phone number page:</p>
<ul class="ul">
<li class="li">
<p class="p">Select <strong class="ph b">Voice</strong> as the channel if it isn’t already selected by
default</p>
</li>
<li class="li">
<p class="p">Click on the DID tab (Toll free is fine, but DIDs are cheaper for testing
purposes)</p>
</li>
<li class="li">
<p class="p">Select the country</p>
</li>
<li class="li">
<p class="p">Select an available phone number from the list</p>
</li>
<li class="li">
<p class="p">Select the <strong class="ph b">“Sample inbound flow (first contact experience)</strong><strong class="ph b">”</strong>
contact flow supplied by Amazon Connect</p>
</li>
<li class="li">
<p class="p">Click on <strong class="ph b">Save</strong></p>
</li>
</ul>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title13" class="topic nested2" id="step_4_4_enable_outbound_dialing_optional">
<h3 class="title topictitle3" id="ariaid-title13">4.4 Enable Outbound Dialing (Optional)</h3>
<div class="body">
<p class="p">If outbound calling is part of your validation plan, assign the test number as the
caller ID for the basic queue.</p>
<p class="p"><strong class="ph b">To enable outbound dialing</strong></p>
<ol class="ol">
<li class="li">
<p class="p">To test outbound calling capabilities, navigate to the Queues page and click on
BasicQueue.</p>
<p class="p"><img class="image img-screenshot" id="step_4_4_enable_outbound_dialing_optional__image_cc_setup_basicqueue" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_basicqueue.png" width="600"></p>
</li>
<li class="li">
<p class="p">On the <strong class="ph b">Edit BasicQueue</strong> page, scroll down to the <strong class="ph b">Settings -
optional</strong>.</p>
</li>
<li class="li">
<p class="p">Search for and select the phone number you claimed in the 4.3 and click <strong class="ph b">Save</strong>.</p>
<p class="p"><img class="image img-screenshot" id="step_4_4_enable_outbound_dialing_optional__image_cc_setup_outbound_caller_id" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_outbound_caller_id.png" width="600"></p>
</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title14" class="topic nested1" id="step5-configure-zd-access">
<h2 class="title topictitle2" id="ariaid-title14">Step 5: Configure Zendesk Access and Validate Settings</h2>
<div class="body">
<p class="p">In this step, you'll test SSO, generate and apply a Zendesk API token, and configure
call recordings.</p>
</div>
<div aria-labelledby="ariaid-title15" class="topic nested2" id="step_5_1_test_sso_login">
<h3 class="title topictitle3" id="ariaid-title15">5.1 Test SSO Login</h3>
<div class="body">
<p class="p">Verify that a Zendesk user can sign in with your chosen Zendesk authentication
method and then open Contact Center. The authentication method is configured in Zendesk;
Contact Center uses Zendesk's federation flow to provide access to the connected AWS
services.</p>
<p class="p">For more information, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/10879182740506-Understanding-single-sign-on-for-Contact-Center" target="_blank">Understanding single sign-on for Contact Center</a>.</p>
<p class="p"><strong class="ph b">To test SSO login</strong></p>
<ol class="ol">
<li class="li">
<p class="p">Log into the target Zendesk account.</p>
</li>
<li class="li">
<p class="p">Once logged in, allow access to camera, microphone and sound if/when
prompted.</p>
</li>
</ol>
<div class="note note" id="step_5_1_test_sso_login__note_also_ensure_that_the_browser_s_pop_up_b">
<span class="notetitle">Note:</span> Also, ensure that the
browser’s pop-up blocker is disabled for the Zendesk subdomain.</div>
<ol class="ol">
<li class="li">
<p class="p">Click on the phone icon on the top-right</p>
<p class="p"><img class="image" id="step_5_1_test_sso_login__image_p5z_gly_jkc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_zug_callconsole_alt.png" width="500"></p>
</li>
</ol>
<div class="note note" id="step_5_1_test_sso_login__note_zendesk_should_automatically_log_you_int">
<span class="notetitle">Note:</span> Zendesk should
automatically log you into Amazon Connect. Otherwise, clicking on the phone icon should
initiate the SSO login.</div>
</div>
</div>
<div aria-labelledby="ariaid-title16" class="topic nested2" id="step_5_2_generate_api_token">
<h3 class="title topictitle3" id="ariaid-title16">5.2 Generate API Token</h3>
<div class="body">
<p class="p">Create a Zendesk API token for the Contact Center integration to use when connecting your
Amazon Connect environment to Zendesk.</p>
<p class="p"><strong class="ph b">To generate an API token</strong></p>
<ol class="ol">
<li class="li">
<p class="p">From the Zendesk Support page, click on the <strong class="ph b">Support</strong> dropdown menu on
the top-left and select <strong class="ph b">Admin center</strong>.</p>
<p class="p"><img class="image img-screenshot" id="step_5_2_generate_api_token__image_cc_setup_admin_center" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_admin_center.png" width="600"></p>
</li>
<li class="li">
<p class="p">Form Admin center, click on the Apps and Integrations icon, select API tokens and
click on Add API token.</p>
<p class="p"><img class="image img-screenshot" id="step_5_2_generate_api_token__image_cc_setup_api_tokens" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_api_tokens.png" width="600"></p>
</li>
<li class="li">
<p class="p">Copy the newly generated token and save it for the next procedure:</p>
<p class="p"><img class="image img-screenshot" id="step_5_2_generate_api_token__image_cc_setup_generated_api_token" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_generated_api_token.png" width="600"></p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title17" class="topic nested2" id="step_5_3_apply_api_token_and_configure_recordings">
<h3 class="title topictitle3" id="ariaid-title17">5.3 Apply API token and configure recordings</h3>
<div class="body">
<p class="p">Apply the token in Contact Center and choose the recording and transcription settings
needed for testing.</p>
<p class="p"><strong class="ph b">To apply API tokens and configure recordings</strong></p>
<ol class="ol">
<li class="li">
<p class="p">From the Zendesk Support page, click on the <strong class="ph b">Support</strong> dropdown menu on the top-left and
select <strong class="ph b">Contact center</strong>.</p>
<p class="p"><img class="image img-screenshot" id="step_5_3_apply_api_token_and_configure_recordings__image_cc_setup_open_contact_center" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_open_contact_center.png" width="600"></p>
</li>
<li class="li">
<p class="p">From the Overview page, scroll down to the Zendesk Connection area, select your user from the
dropdown and paste the API token created in Step 5.2 under API key.</p>
<p class="p"><img class="image img-screenshot" id="step_5_3_apply_api_token_and_configure_recordings__image_cc_setup_zendesk_connection_api_key" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_zendesk_connection_api_key.png" width="600"></p>
</li>
<li class="li">
<p class="p">Click <strong class="ph b">Save</strong>.</p>
</li>
<li class="li">
<p class="p">From the Contact center page, click on <strong class="ph b">Tickets</strong>, select <strong class="ph b">Unredacted call recording</strong>
and <strong class="ph b">Unredacted call transcript</strong>.</p>
<p class="p"><img class="image img-screenshot" id="step_5_3_apply_api_token_and_configure_recordings__image_cc_setup_cognito_login_identity_provider" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_cognito_login_identity_provider.png" width="600"></p>
<div class="note note" id="step_5_3_apply_api_token_and_configure_recordings__note_these_settings_can_be_changed_later_by_t">
<span class="notetitle">Note:</span> These settings can be
changed later by you or your partner as needed. We choose unredacted recordings and
transcripts here strictly for testing purposes.</div>
<div class="note important" id="step_5_3_apply_api_token_and_configure_recordings__important_you_may_need_to_edit_the_sample_inbound">
<span class="importanttitle">Important:</span> You may need
to edit the Sample inbound flow (first contact experience) contact flow to ensure the Set
recording, analytics, and processing behavior block is configured accordingly as shown
below. Note that you’ll need to configure the appropriate redaction parameters on this
block and ensure Contact Lens is enabled on your Connect instance to test
redaction.</div>
<p class="p"><img class="image img-screenshot" id="step_5_3_apply_api_token_and_configure_recordings__image_cc_setup_inbound_flow_recording" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_inbound_flow_recording.png" width="600"></p>
</li>
<li class="li">
<p class="p">Click <strong class="ph b">Save</strong>.</p>
</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title18" class="topic nested1" id="step6-turnon_recordings-aws">
<h2 class="title topictitle2" id="ariaid-title18">Step 6: Activate recordings on AWS</h2>
<div class="body">
<p class="p">In this step, you'll validate the recording settings and enable the AWS Lambda triggers
that process recordings and transcripts.</p>
</div>
<div aria-labelledby="ariaid-title19" class="topic nested2" id="step_6_1_validate_recording_settings">
<h3 class="title topictitle3" id="ariaid-title19">6.1 Validate Recording Settings</h3>
<div class="body">
<p class="p">Check the AWS configuration created for Contact Center and confirm that it matches the
recording settings selected in Step 5.3.</p>
<p class="p"><strong class="ph b">To validate the recording settings</strong></p>
<ol class="ol">
<li class="li">
<p class="p">From the AWS Console, navigate to the <strong class="ph b">Secrets Manager</strong>, locate the secret created by the
Contact Center deployment in Step 2 and click on it.</p>
<p class="p"><img class="image img-screenshot" id="step_6_1_validate_recording_settings__image_cc_setup_secrets_manager" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_secrets_manager.png" width="600"></p>
</li>
<li class="li">
<p class="p">From the Secret details page, scroll down to the <strong class="ph b">Secret value</strong> area
and click on the <strong class="ph b">Retrieve secret value</strong> button to display the Secret’s
value.</p>
</li>
<li class="li">
<p class="p">If the API token was applied correctly in Step 5.3, you should see a token value similar to this
one:</p>
<p class="p"><img class="image img-screenshot" id="step_6_1_validate_recording_settings__image_cc_setup_secret_token_value" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_secret_token_value.png" width="600"></p>
</li>
<li class="li">
<p class="p">Click <strong class="ph b">Close</strong>.</p>
</li>
<li class="li">
<p class="p">Navigate to <strong class="ph b">Systems Manager Parameter Store </strong>and locate the following parameters.</p>
<ol class="ol" type="a">
<li class="li">
<p class="p">zendesk-voice-save-recording</p>
</li>
<li class="li">
<p class="p">zendesk-voice-save-transcript</p>
</li>
</ol>
<p class="p"><img class="image img-screenshot" id="step_6_1_validate_recording_settings__image_cc_setup_recording_parameters" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_recording_parameters.png" width="600"></p>
</li>
<li class="li">
<p class="p">Click on each of the parameters and verify that the value is “<strong class="ph b">unredacted</strong>” as configured in
Step 5.3.</p>
<p class="p"><img class="image img-screenshot" id="step_6_1_validate_recording_settings__image_cc_setup_recording_parameter_value" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_recording_parameter_value.png" width="600"></p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title20" class="topic nested2" id="step_6_2_enable_lambda_triggers">
<h3 class="title topictitle3" id="ariaid-title20">6.2 Enable Lambda Triggers</h3>
<div class="body">
<p class="p">Enable the event triggers that move recording and transcription data through the Contact
Center processing flow.</p>
<p class="p"><strong class="ph b">To enable the Lambda triggers</strong></p>
<ol class="ol">
<li class="li">
<p class="p">Navigate to the <strong class="ph b">Lambda</strong> console in AWS and locate the following
Functions:</p>
<ul class="ul">
<li class="li">
<p class="p">RecordingIngestLambda</p>
</li>
<li class="li">
<p class="p">ContactLensEventsLambda</p>
</li>
<li class="li">
<p class="p">CTRIngestLambda</p>
</li>
<li class="li">
<p class="p">ZendeskVoicePostCall</p>
</li>
<li class="li">
<p class="p">TranscriptIngestLambda</p>
</li>
</ul>
<p class="p"><img class="image img-screenshot" id="step_6_2_enable_lambda_triggers__image_cc_setup_lambda_functions" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_lambda_functions.png" width="600"></p>
</li>
<li class="li">
<p class="p">Click on each of the functions listed above and enable its Kinesis and/or
EventBridge triggers:</p>
<ol class="ol" type="a">
<li class="li">
<p class="p">For <strong class="ph b">EventBridge triggers</strong>:</p>
<ol class="ol" type="i">
<li class="li">
<p class="p">Click on the <strong class="ph b">Configuration</strong> tab</p>
</li>
<li class="li">
<p class="p">Click on <strong class="ph b">Triggers</strong> from the menu on the left</p>
</li>
<li class="li">
<p class="p">Click on the EventBridge trigger link</p>
<p class="p"><img class="image img-screenshot" id="step_6_2_enable_lambda_triggers__image_cc_setup_eventbridge_trigger_link" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_eventbridge_trigger_link.png" width="600"></p>
</li>
<li class="li">
<p class="p">From the EventBridge Rule details page click on the <strong class="ph b">Enable</strong>
button at the top.</p>
<p class="p"><img class="image img-screenshot" id="step_6_2_enable_lambda_triggers__image_cc_setup_eventbridge_enable_button" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_eventbridge_enable_button.png" width="600"></p>
</li>
<li class="li">
<p class="p">Navigate back to the function details page and refresh the trigger panel to
verify the EventBridge trigger has been enabled.</p>
<p class="p"><img class="image img-screenshot" id="step_6_2_enable_lambda_triggers__image_cc_setup_eventbridge_trigger_enabled" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_eventbridge_trigger_enabled.png" width="600"></p>
</li>
</ol>
</li>
<li class="li">
<p class="p">For <strong class="ph b">Kinesis triggers</strong>:</p>
<ol class="ol" type="i">
<li class="li">
<p class="p">Click on the checkbox next to the Kinesis trigger</p>
</li>
<li class="li">
<p class="p">Click on the <strong class="ph b">Edit</strong> button</p>
<p class="p"><img class="image img-screenshot" id="step_6_2_enable_lambda_triggers__image_cc_setup_kinesis_trigger_edit" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_kinesis_trigger_edit.png" width="600"></p>
</li>
<li class="li">
<p class="p">From the <strong class="ph b">Edit trigger</strong> page, click on the <strong class="ph b">Activate
trigger</strong> checkbox to enable the trigger and then click
<strong class="ph b">Save</strong>.</p>
<p class="p"><img class="image img-screenshot" id="step_6_2_enable_lambda_triggers__image_cc_setup_kinesis_activate_trigger" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_kinesis_activate_trigger.png" width="600"></p>
</li>
<li class="li">
<p class="p">Verify that the trigger was enabled.</p>
<p class="p"><img class="image img-screenshot" id="step_6_2_enable_lambda_triggers__image_cc_setup_kinesis_trigger_enabled" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_kinesis_trigger_enabled.png" width="600"></p>
</li>
</ol>
</li>
</ol>
</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title21" class="topic nested1" id="step7-test-telephony">
<h2 class="title topictitle2" id="ariaid-title21">Step 7: Test telephony capabilities</h2>
<div class="body">
<p class="p">In this step, you'll verify federated access, then test inbound and outbound calling.</p>
</div>
<div aria-labelledby="ariaid-title22" class="topic nested2" id="step_7_1_test_federated_access_to_amazon_connect_and_aws">
<h3 class="title topictitle3" id="ariaid-title22">7.1 Test federated access to Amazon Connect &amp; AWS</h3>
<div class="body">
<p class="p">Confirm that the Zendesk login services provide the required access to the Amazon Connect
Dashboard and AWS Management Console when using the Zendesk-mediated federation configured
in Step 3. If you also configured direct federation from your corporate IdP to AWS, test
that additional access path according to your AWS identity configuration.</p>
<p class="p"><strong class="ph b">To test federated access to Amazon Connect and AWS</strong></p>
<ol class="ol">
<li class="li">
<p class="p">Log out of the AWS Console unless logged into it from an incognito browser
tab.</p>
</li>
<li class="li">
<p class="p">Log out of and back into your Zendesk account.</p>
</li>
<li class="li">
<p class="p">Navigate to the <strong class="ph b">Contact center</strong> configuration console.</p>
</li>
<li class="li">
<p class="p">From the <strong class="ph b">Overview</strong> page:</p>
<ol class="ol" type="a">
<li class="li">
<p class="p">Click on the <strong class="ph b">Amazon Connect Dashboard</strong> link to further validate
federated access to the Connect Dashboard.</p>
</li>
<li class="li">
<p class="p">Click on the <strong class="ph b">AWS Console</strong> link to verify access to the AWS
Console.</p>
</li>
</ol>
</li>
</ol>
<p class="p">For example:</p>
<p class="p"><img class="image img-screenshot" id="step_7_1_test_federated_access_to_amazon_connect_and_aws__image_cc_setup_federated_access_links" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_federated_access_links.png" width="600"></p>
</div>
</div>
<div aria-labelledby="ariaid-title23" class="topic nested2" id="step_7_2_test_inbound_call">
<h3 class="title topictitle3" id="ariaid-title23">7.2 Test inbound calling</h3>
<div class="body">
<p class="p">Test the complete inbound path from the temporary phone number through Amazon Connect,
the agent workspace, and the Zendesk ticket.</p>
<p class="p"><strong class="ph b">To test inbound calling</strong></p>
<ol class="ol">
<li class="li">
<p class="p">From the <strong class="ph b">Support</strong> page in Zendesk, click on the user icon on the
top-right corner and select <strong class="ph b">Online</strong> to change the agent status to
available.</p>
<p class="p"><img class="image img-screenshot" id="step_7_2_test_inbound_call__image_cc_setup_agent_online" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_agent_online.png" width="600"></p>
</li>
<li class="li">
<p class="p">Place a call to the phone number claimed in Step 4.3. Follow the menu options
offered by Amazon Connect to be placed in queue and transferred to an agent.</p>
</li>
<li class="li">
<p class="p">Accept the incoming call, and close the notification presented as shown
here:</p>
<p class="p"><img class="image img-screenshot" id="step_7_2_test_inbound_call__image_cc_setup_incoming_call" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_incoming_call.png" width="600"></p>
</li>
<li class="li">
<p class="p">Speak a few words to validate the recording and call transcription once, then end
the call.</p>
</li>
<li class="li">
<p class="p">Click the <strong class="ph b">Finish wrap-up</strong> button to close the Amazon Connect contact
.</p>
<p class="p"><img class="image img-screenshot" id="step_7_2_test_inbound_call__image_cc_setup_finish_wrap_up" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_finish_wrap_up.png" width="600"></p>
</li>
<li class="li">
<p class="p">Wait a few minutes to verify that the call recording and transcription are appended
to the ticket as shown below (this may take up to 4-5 minutes):</p>
<p class="p"><img class="image img-screenshot" id="step_7_2_test_inbound_call__image_cc_setup_call_recording_transcript" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_call_recording_transcript.png" width="600"></p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title24" class="topic nested2" id="step_7_3_test_outbound_call">
<h3 class="title topictitle3" id="ariaid-title24">7.3 Test outbound calling</h3>
<div class="body">
<p class="p">Test the outbound calling workflow from the Contact Center agent workspace and confirm
that the call can be completed successfully.</p>
<p class="p"><strong class="ph b">To test outbound calling</strong></p>
<ol class="ol">
<li class="li">
<p class="p">From the <strong class="ph b">Support</strong> page in Zendesk, click on the phone icon. Enter a
phone number and click <strong class="ph b">Call</strong> to dial an outbound call as shown
here:</p>
<p class="p"><img class="image img-screenshot" id="step_7_3_test_outbound_call__image_cc_setup_outbound_call" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_outbound_call.png" width="600"></p>
</li>
<li class="li">
<p class="p">Once the call is connected and your phone rings, click on the <strong class="ph b">End</strong>
button to hang up.</p>
<p class="p"><img class="image img-screenshot" id="step_7_3_test_outbound_call__image_cc_setup_end_outbound_call" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_setup_end_outbound_call.png" width="600"></p>
</li>
<li class="li">
<p class="p">Click on <strong class="ph b">Finish wrap-up</strong> in the pop-up window to close out the
contact.</p>
</li>
</ol>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title25" class="topic nested1" id="step8-cleanup">
<h2 class="title topictitle2" id="ariaid-title25">Step 8: Clean up (Optional)</h2>
<div class="body">
<p class="p">When testing is complete, remove the temporary resources and test data that are no longer
needed.</p>
<p class="p"><strong class="ph b">To clean up the test resources</strong></p>
<ol class="ol">
<li class="li">
<p class="p">Clear the <strong class="ph b">Outbound caller ID number</strong> from the BasicProfile routing
profile in Amazon Connect.</p>
</li>
<li class="li">
<p class="p">Release the phone number claimed in Step 4.3 since it was only intended for testing
purposes.</p>
</li>
<li class="li">
<p class="p">Delete any tickets created in Zendesk as part of testing and validation.</p>
</li>
</ol>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/11141761467802",
"url": "https://support.zendesk.com/hc/en-us/articles/11141761467802",
"headline": "Setting up Contact Center on a customer-managed AWS account",
"description": "You set up Contact Center on a customer-managed AWS account by provisioning the AWS stacks, configuring SSO and access, validating recordings, and testing inbound and outbound telephony.",
"articleSection": "Setting up Contact Center",
"datePublished": "2026-08-18T02:00:21+00:00",
"dateModified": "2026-08-28T16:38:28.196671+00:00",
"inLanguage": "en",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/11141761467802"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"@id": "https://support.zendesk.com/hc/"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk",
"@id": "https://www.zendesk.com",
"softwareAddOn": {
"@type": "SoftwareApplication",
"name": "Contact Center",
"@id": "https://support.zendesk.com/hc/en-us/sections/9248688983706"
}
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>