Help › Installing Standby
What Standby can and can't do in your account
Every permission the stack grants, and what is deliberately left out.
Everything Standby can do in your account is in one IAM policy, standby-baseline, on the role the stack creates. You can read it in your own IAM console after installing. Every Amazon Connect permission is limited to the one instance you named. From stack 1.4.6 that includes placing paging calls; earlier stacks granted that one permission on any instance. Queue figures are read by a separate function in the stack, under its own role, not by Standby's role.
What it can do
| Permissions | |
|---|---|
| Read your configuration | Instance details, queues and users, and a check that the stack's always-closed hours exist. |
| Change a queue, for a while | Two settings only: a queue's maximum contacts (to cap it), and which hours of operation it uses (to close it). Each change records the value before, is limited in time, and is put back on its own. |
| Place a paging call | Ring the on-call person through your instance, from the number you gave. |
What it can't do
- Read or change your contact flows.
- Listen to, record or read calls, chats, recordings, transcripts or contact records.
- Monitor or barge into a contact.
- Touch IAM or S3 in your account, or any other Connect instance.
Seeing what it did
Every call Standby makes in your account appears in your CloudTrail, tagged with the Standby workspace and the person who asked for it. If someone changes a queue in the Connect console while Standby's change is in force, Standby doesn't overwrite it when the time is up; it raises a conflict instead.
For the full list, and the reasoning behind each line, see our security page.