AWS S3 Storage

Before You Begin

There are two supported authentication methods. Before starting, obtain the values listed in the What Capacity Provides to You section at the end of this guide.

Option A: IAM Role with AssumeRole (Recommended)

Step 1 — Create the IAM Role

In the AWS Management Console, navigate to IAM > Roles and select Create role

• For Trusted entity type, select AWS account
• Select Another AWS account and enter the Capacity AWS Account ID provided to you
• Select Next. Skip the permissions attachment — you will add the policy in Step 2
• Name the role exactly: Capacity-connect-ingestor. This name is required
• Select Create role

Step 2 — Attach the Permission Policy

Attach a new inline or managed policy to the role. Assemble it from the blocks below, including only the optional blocks that apply to your setup. All placeholder values (shown in uppercase) must be replaced before saving — see the Placeholder Reference table at the end of this guide.

Required — S3 Read Access (always include)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListBucketContents",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketLocation"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR-RECORDINGS-BUCKET",
        "arn:aws:s3:::YOUR-CTR-BUCKET"
      ]
    },
    {
      "Sid": "DownloadFiles",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::YOUR-RECORDINGS-BUCKET/*",
        "arn:aws:s3:::YOUR-CTR-BUCKET/*"
      ]
    }
  ]
}

Optional — File Deletion (include only if enabling automated file cleanup in CI)

If CI has been configured to delete files from S3 after a set number of days, add the following as an additional statement. Do not include this block unless the deletion feature has been explicitly agreed with Capacity.

{
    "Sid": "DeleteProcessedFiles",
    "Effect": "Allow",
    "Action": [
        "s3:DeleteObject"
    ],
    "Resource": [
        "arn:aws:s3:::YOUR-RECORDINGS-BUCKET/*",
        "arn:aws:s3:::YOUR-CTR-BUCKET/*"
    ]
}

Optional — KMS Decryption (include if your bucket uses SSE-KMS encryption)

AWS Connect enables KMS encryption by default. If you followed the Data Storage steps in this guide, your bucket is KMS-encrypted and this block is required. To verify: navigate to your S3 bucket → Properties → Default encryption. If it shows SSE-KMS, include this block. If it shows SSE-S3 (AES-256), it is not needed.

Add the following as an additional statement inside the Statement array of the policy created above:

{
    "Sid": "DecryptKMSObjects",
    "Effect": "Allow",
    "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
    ],
    "Resource": "arn:aws:kms:YOUR-REGION:YOUR-ACCOUNT-ID:key/YOUR-KMS-KEY-ID",
    "Condition": {
        "StringEquals": {
            "kms:ViaService": "s3.YOUR-REGION.amazonaws.com"
        }
    }
}

Step 3 — Verify the Trust Policy

Select the newly created role from the IAM Roles list and navigate to the Trust relationships tab. Verify the trust policy matches the following. All values shown in uppercase are provided by Capacity.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowCapacityAssumeRole",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::973339273290:user/[Customer Name]-service-account-user"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Option B: IAM User with Access Keys

Use this option only if your organisation cannot support cross-account IAM role federation. Confirm with your Capacity representative before proceeding.

Step 1 — Create the IAM User

In the AWS Management Console, navigate to IAM > Users and select Create user. Enter a recognisable user name (e.g. Capacity-ingestor). Do not enable AWS Management Console access — this user requires programmatic access only. Select Next.

Step 2 — Attach the Permission Policy

Attach the same permission policy as described in Option A Step 2, using the Required block and any applicable Optional blocks (KMS, Delete). All placeholder values must be replaced before attaching.

Step 3 — Create Access Keys

• Select the newly created user and navigate to the Security credentials tab
• Under Access keys, select Create access key
• Select Third-party service as the use case and acknowledge the recommendation
• Select Create access key
• Copy or download the Access Key ID and Secret Access Key immediately — the Secret Access Key cannot be retrieved after this screen is closed

Securely share both values with your Capacity representative. Do not transmit via unencrypted email. Your Capacity contact will advise on an appropriate secure transfer method.

What Capacity Provides to You

Capacity will supply the following values during onboarding. These are required before you can complete the IAM role setup.

Contact Capacity to request the IAM Role ARN

What to Share with Capacity

Once your IAM role or user is configured, provide the following details to your Capacity onboarding contact. The required fields depend on whether you are using Contact Lens only, or Contact Lens together with AWS Transcribe.