AWS Connect

Unwrap supports transcribing call recordings from AWS Connect as feedback entries. Call recordings are automatically transcribed with speaker diarization, creating conversation-style entries in Unwrap.

Note: For customers using AWS Transcribe (or any other transcription service) to transcribe call recordings, we can ingest transcribed calls directly via our S3 integration.

Prerequisites

AWS Connect must be configured to store call recordings in an S3 bucket. By default, AWS Connect stores recordings at the following path:

s3://<your-bucket>/connect/<instance-alias>/CallRecordings/YYYY/MM/DD/<contact-id>_<timestamp>_UTC.wav

IAM Role Setup

You must create an IAM role in your AWS account that grants Unwrap read access to your call recordings bucket. This role will be assumed by Unwrap's infrastructure to fetch recordings.

Important: The role must be named unwrap-s3-access and placed under the /external/ path, resulting in the following ARN format:

arn:aws:iam::<your-account-id>:role/external/unwrap-s3-access

1. Create a new IAM role named unwrap-s3-access with the path /external/. Apply the following trust policy to it, which allows Unwrap's AWS account to assume it:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::967773983593:root"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<your-external-id>"
        }
      }
    }
  ]
}

Replace <your-external-id> with a unique secret string of your choice. This will be shared with Unwrap during setup. The External ID condition is optional but recommended for additional security.

2. Attach the following inline policy to the role, granting read access to your recordings bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::<your-bucket-name>",
        "arn:aws:s3:::<your-bucket-name>/*"
      ]
    }
  ]
}

3. If your S3 bucket uses AWS KMS encryption (SSE-KMS), also attach the following permission to the role:

{
  "Effect": "Allow",
  "Action": "kms:Decrypt",
  "Resource": "arn:aws:kms:<region>:<your-account-id>:key/<your-key-id>"
}

Steps to integrate

To set up your AWS Connect integration, go to the Integrations page and find the "AWS Connect" integration.

1. Name your Integration: Enter a descriptive name for your AWS Connect integration.

2. Enter your S3 Bucket Name: The name of the S3 bucket where AWS Connect stores call recordings.

3. Enter your S3 Path Prefix: The path prefix to the CallRecordings folder, typically connect/<instance-alias>/CallRecordings.

4. Enter your IAM Role ARN: The ARN of the role created above, in the format arn:aws:iam::<your-account-id>:role/external/unwrap-s3-access.

The following steps are optional:

1. External ID: The External ID configured in the role's trust policy. Recommended for additional security.

1. AWS Region: The AWS region of the S3 bucket. Defaults to us-east-2 if not specified.