Rules to restrict outside IP addresses from using AWS Connect

Question

Is it possible to prevent users from logging in if they are trying to log in from outside the office, e.g. from their home? We are looking to just allow our agents to use AWS Connect from some IP Addresses for security measures.

Answer

Yes you can do this IF you are using SAML.

See here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.html

Answer

I've not seen any documentation around having your Connect instance inside a VPC, the only thing I can think of for the CCP itself is to deploy a custom CCP via CloudFront and put IP registrations on that. However, if the agents already know the Connect URL there would be nothing stopping them from going directly.

david

Answer

You can create custom CCP [1] and host it with for example, CloudFront which is restricted using AWS WAF [2].

[1]. Custom CCP: https://github.com/aws-samples/amazon-connect-custom-ccp

[2]. CloudFront distribution with AWS WAF: https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/distribution-web-awswaf.html

Rules to restrict outside IP addresses from using AWS Connect

Relevant content