Using agent workspace guides to handle sensitive information

Introduction

Contact center agents assist customers with topics that involve complex workflows. Within the Amazon Connect agent workspace, step-by-step guides support agents with clear instructions on how to handle a particular use case. Step-by-step guides are agent facing workflows that can branch based on decisions and send & receive data from external systems. Guides increase agent productivity, reduce training time, and help deliver a consistent customer experience. While interacting with step-by-step guides, agents often collect and enter sensitive or confidential data. Such data should not be logged, including in the contact media and screen recordings.

In this blog post, we detail a solution to automatically pause recording when a specific step-by-step guide is invoked and to resume recording on completing the workflow. The solution also details how to automatically stop logging during this workflow segment.

Solution Overview

This solution is deployed using an AWS CloudFormation template. It creates the requisite Amazon Connect contact flows and AWS Lambda functions. The Set logging behavior block in Amazon Connect contact flow disables the contact flow logging before invoking the step-by-step guide view that collects sensitive information. Once the view is completed, the Set logging behavior in the contact flow restarts the contact flow logging.

SuspendContactRecording API suspends recording of the contact media and agent screen. In the contact flow, a Lambda function invokes the SuspendContactRecording API before the Show view block. Once completed, another Lambda function invokes the ResumeContactRecording API in the contact flow to resume contact recording.

Once the required assets are deployed, the user has to point their Amazon Connect phone number to the Contact Flow created in the following steps. The test caller can press 1 to open a new bank account and connect to an agent with the step-by-step guides.

Below is an architecture diagram of the solution.

It should be noted that any data entered as input in the views within step-by-step guides is logged in the chat transcript. Take the necessary steps to secure or purge this data to prevent any unintended data exposure by deleting the Guides transcripts.

Deployment Walkthrough

Prerequisites

For this blog post, it is assumed that you understand the use of the services below and you have the following prerequisites:

– An AWS Account with both management console and programmatic administrator access
– Access to AWS IAM to create roles and policies
– An existing Amazon Connect instance with a phone number claimed and call & screen recording enabled.
– AWS CloudFormation to run the stack

Step 1: Get Amazon Connect instance details

1. Sign in to the AWS Management Console and select the same Region as your Amazon Connect instance.

2. Identify and note the Amazon Connect instance ARN where this stack is to be deployed. Refer Find Amazon Connect instance ARN.

3. Navigate to Queues section in Amazon Connect Dashboard.

4. Search for BasicQueue. Click on the Queue name from the search result.

5. Expand the section named Show Additional Queue Information. Make a note of the ARN.

6. Click on  to launch the AWS CloudFormation template.

7. Enter a unique Stack name. For this example, we have used SBS-pause-recording.

8. Enter the Amazon Connect Instance ARN where this stack is to be deployed and the Amazon Connect Queue ARN that the Contact Flow will be associated with.

9. Acknowledge the IAM resource creation.

10. Choose Create stack to provision the required assets. This will take 10 minutes.

11. Wait untill you see the CREATE_COMPLETE status for this stack.

12. Navigate to your Amazon Connect Instance and associate the SBS-pause-recording-SBSPauseResumeDemoHandler contact flow with your claimed phone number.

Testing the solution

1. Log in to the Agent Workspace using the URL https://YOUR CONNECT ALIAS.my.connect.aws/agent-app-v2. You can find your Connect Instance name by following this link.

2. Call the phone number associated with the SBS-pause-recording-SBSPauseResumeDemoHandler Contact Flow.

3. Once the call is connected to the Contact Flow, press 1 to open a new bank account.

4. Accept the call at in the Agent Workspace and the step-by step-guides will be loaded automatically for the incoming contact.

5. Click on “Open a new account” button.

6. Click on start a new request.

7. Populate the new account form with customer information

8. Choose Submit

9. The form validates the information entered is complete

10. At this point, you can disconnect the call and close the contact.
(It is important to disconnect the call and close the contact in the Agent Workspace before proceeding. This initiates completion of recording and generation of all requisite logs.)

11. In the AWS Management Console, navigate to CloudWatch

12. On the left side, expand “Logs”. Under Logs, click on Log Groups.

13. Within the Log Groups, click on the log group for your Amazon Connect Instance. Here you will be able to search the logs generated for the test call that was made.

14. Here you will see the details of the call. Search for LoggingBehavior on this page and you will see in the log where it is enabled initially when the call is connected. A subsequent instance of LoggingBehavior shows in the log where the logging is re-enabled. Notice the time difference between the log message when LoggingBehavior is enabled the second time and the log message before it. You will see a time difference where logging was paused.

15. In case Contact Lens with call and screen recording is enabled, you can view the recording and see that the recording is paused for the time that the sensitive information was recorded by the agent.

Clean up
In order to avoid any future charges, remove all the assets that were created. This can be done by deleting the stack in CloudFormation.

Conclusion
In this blog post, we demonstrate how to use step-by-step guides to help agents handle sensitive information and maintain security compliance. Using the code provided, you can pause contact recording during the collection of sensitive data. For additional information, you can access Amazon Connect documentation or contact to your AWS representative.