AWS Connect Role-to-Role Access for Conversation Ingestion

Overview

Clients can now integrate their AWS connect instance with LevelAI through role to role access method for authentication to ingest in Call and Chat conversations.

Prerequisites

• An AWS account with permission to create IAM roles.

• An Amazon Connect instance that already exports data to S3. Under Amazon Connect → Data storage, that means:

  • Call recordings

  • Chat transcripts (needed only if you use chat channels)

  • Contact Trace Record files

• The S3 bucket name(s), region(s) and folder prefixes where this data is stored.

Expected Folder Structure

Level AI finds recordings and chat transcripts through the recording.location value inside each CTR record. The role must be able to read whatever bucket and path Amazon Connect writes there.

CTR, Recording or transcript files can be partitioned by date, and recommended to be ctr/2026/10/23/

Step 1: IAM Role for Level AI Access

Create an IAM role in your AWS account for Level AI to assume.

1.1 Create the role

1. In the AWS Console, go to IAM → Roles → Create role.

2. Trusted entity type: choose Custom trust policy. You'll define the trust in Step 2.

3. Role name: for example LevelAI-AWSConnect-ReadOnly-Role, or a name that fits your own naming standards.

4. Description: for example "Allows Level AI read-only access to Amazon Connect recordings, transcripts and CTR files."

1.2 Attach a permissions policy to the role

The role needs only these permissions:

• List the bucket (s3:ListBucket, s3:GetBucketLocation)

• Read objects (s3:GetObject)

Example policy. Replace YOUR-BUCKET-NAME, and add the transcript bucket only if it's a different bucket:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ListBucket",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET-NAME",
                "arn:aws:s3:::YOUR-TRANSCRIPT-BUCKET-NAME"
            ]
        },
        {
            "Sid": "ReadConnectData",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET-NAME/*",
                "arn:aws:s3:::YOUR-TRANSCRIPT-BUCKET-NAME/*"
            ]
        }
    ]
}

You can limit Resource to specific prefixes, for example arn:aws:s3:::YOUR-BUCKET-NAME/connect/your-instance/*. Make sure the CTR, recording and transcript paths are all included.

Once the role is created, note its ARN, for example arn:aws:iam::123456789012:role/LevelAI-AWSConnect-ReadOnly-Role.

Step 2: Configure Role-to-Role Trust

Level AI uses role-to-role (cross-account) assumption: our AWS role assumes your role. You need to allow Level AI's role as a trusted principal.

2.1 Get Level AI's role ARN

Level AI's role ARN: arn:aws:iam::826093755571:role/levelai-<levelaiinstancename>-role

2.2 Set the trust policy on your role

Edit the trust policy of the role from Step 1. The principal must be Level AI's role ARN and the action must be sts:AssumeRole.

Example trust policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::826093755571:role/levelai-<levelaitenantname>-role"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

Optional: require an External ID. For extra protection, add a condition so the role can be assumed only when the External ID you choose is supplied:

"Condition": {
    "StringEquals": {
        "sts:ExternalId": "YOUR-EXTERNAL-ID"
    }
}

The External ID can be 2–1224 characters long, using letters, digits and +=,.@:/-. If you set one, share it with Level AI. Only this principal can assume your role, and no access keys or secrets are needed.

Information to Share with Level AI

Please send the following through a secure channel:

Level AI gives you our Level AI Role ARN to use in your trust policy (Step 2). No access keys or secrets are required.