Help › Installing Standby
Before you install
What has to be true in your AWS account and Amazon Connect instance first.
Standby runs from a CloudFormation stack you install in your own AWS account. It takes about ten minutes, and you need a few things ready first.
What you need
- An Amazon Connect instance in US East (N. Virginia) us-east-1 or US West (Oregon) us-west-2. You install Standby in the same region as the instance. Standby watches one instance per workspace. Have its instance ID to hand: the 36-character ID at the end of the instance ARN, not the whole ARN.
- Standby works with Amazon Connect Customer, the contact center part of Amazon Connect, which is where your instances are. If your console shows other Amazon Connect services, Standby doesn't need them.
- Someone who can deploy it in the AWS account that holds the instance. The stack creates IAM roles, so this is usually your AWS or cloud team rather than the person who runs the contact center. See Who can run the install.
- The email address of your first Standby admin. They're emailed a temporary password when the stack finishes, and can then invite everyone else.
- A phone number for paging calls (optional, but recommended). Standby rings your on-call people through your own Amazon Connect instance, so it needs a number claimed on that instance with outbound calling allowed. You'll enter it in E.164 form, such as
+14155551234. Leave it blank and Standby pages by notification only.
Who can run the install
Whoever opens the launch link needs rights to create the following in the AWS account and region that hold your Connect instance. The AWS-managed AdministratorAccess policy covers all of it. If your team grants narrower rights, this is everything the stack creates:
| Service | What the stack creates |
|---|---|
| CloudFormation | The stack itself, named standby. |
| IAM | Five roles: standby-<workspace ID>, the only one Standby can use, and one for each of the stack's four functions. Because one role has a fixed name, CloudFormation asks you to acknowledge it before it starts. |
| Lambda | Four small functions (Node.js 22 and Python 3.12), and permission for Amazon Connect and EventBridge to call them. |
| Amazon Connect | In your instance: the standby-paging contact flow, the standby-emergency-closed hours of operation, and two Lambda integrations. |
| DynamoDB | One small table, standby-overrides. |
| Secrets Manager | One secret, holding the credential the stack uses to send queue figures to Standby. |
| EventBridge | One rule that runs the figures forwarder every minute. |
| CloudWatch Logs | Four log groups, kept 30 days. |
The person installing needs these rights only while the stack is created, updated or deleted. Afterward Standby uses its own role, which is limited to what's listed in What Standby can and can't do in your account.
What can stop an install
- An organization policy (SCP). If your AWS organization denies creating IAM roles, or using the region, the stack fails with an error that mentions an explicit deny in a service control policy. Your AWS administrator can allow it for this account, or run the install from a role the policy exempts.
- A required permissions boundary. Some companies require a boundary on every new IAM role. The stack's roles don't set one, so a rule like that refuses them. Tell us before you install if your account has one.
- The wrong account or region. The stack must go in the same account and region as the Connect instance. It can't watch an instance in another account.
- Standby already in that account and region. The stack's resources have fixed names, so a second copy in the same account and region fails. To move to another instance, remove the old stack first.
- An expired launch link. The link works once, for 48 hours. Ask us for a fresh one.
Two things to check in your contact flows
Standby can cap a queue or close it for a while. It never edits your contact flows; your flows decide what callers hear. Before you install, read Check two branches in your contact flows. It takes five minutes, and one answer is a setting on the stack.
What you'll be given
When your workspace is set up, Contact-IQ gives you a launch link. It opens CloudFormation in your own AWS console with Standby's values already filled in, including a one-time registration token. The link works once and expires after 48 hours unless we agreed a different window with you. If it expires, ask for a fresh one.