Amazon Connect Service

2026/09/18 - Amazon Connect Service - 1 new 2 updated api methods

Changes  This release adds the ListSecurityProfileAIAgents API and updates the CreateSecurityProfile and UpdateSecurityProfile APIs to support the AllowedAIAgents field on security profiles, allowing customers to manage the 3P AI agents associated with a security profile for Agent-to-Agent interactions.

ListSecurityProfileAIAgents (new) Link ¶

Returns a list of the allowed AI agents in a specific security profile.

See also: AWS API Documentation

Request Syntax

client.list_security_profile_ai_agents(
    SecurityProfileId='string',
    InstanceId='string',
    NextToken='string',
    MaxResults=123
)
type SecurityProfileId:

string

param SecurityProfileId:

[REQUIRED]

The identifier for the security profle.

type InstanceId:

string

param InstanceId:

[REQUIRED]

The identifier of the Connect Customer instance. You can find the instance ID in the Amazon Resource Name (ARN) of the instance.

type NextToken:

string

param NextToken:

The token for the next set of results. Use the value returned in the previous response in the next request to retrieve the next set of results.

type MaxResults:

integer

param MaxResults:

The maximum number of results to return per page.

rtype:

dict

returns:

Response Syntax

{
    'AllowedAIAgents': [
        {
            'Arn': 'string',
            'Type': 'THIRD_PARTY'
        },
    ],
    'NextToken': 'string',
    'LastModifiedTime': datetime(2015, 1, 1),
    'LastModifiedRegion': 'string'
}

Response Structure

  • (dict) --

    • AllowedAIAgents (list) --

      A list of the allowed AI agents and their types.

      • (dict) --

        Information about an AI agent that a security profile allows access to for Agent-to-Agent authorization.

        • Arn (string) --

          The Amazon Resource Name (ARN) of the AI agent.

        • Type (string) --

          The type of the AI agent. The valid value is THIRD_PARTY.

    • NextToken (string) --

      If there are additional results, this is the token for the next set of results.

    • LastModifiedTime (datetime) --

      The timestamp when this resource was last modified.

    • LastModifiedRegion (string) --

      The Amazon Web Services Region where this resource was last modified.

CreateSecurityProfile (updated) Link ¶
Changes (request) 
{'AllowedAIAgents': [{'Arn': 'string', 'Type': 'THIRD_PARTY'}]}

Creates a security profile.

For information about security profiles, see Security Profiles in the Connect Customer Administrator Guide. For a mapping of the API name and user interface name of the security profile permissions, see List of security profile permissions.

See also: AWS API Documentation

Request Syntax

client.create_security_profile(
    SecurityProfileName='string',
    Description='string',
    Permissions=[
        'string',
    ],
    InstanceId='string',
    Tags={
        'string': 'string'
    },
    AllowedAccessControlTags={
        'string': 'string'
    },
    TagRestrictedResources=[
        'string',
    ],
    Applications=[
        {
            'Namespace': 'string',
            'ApplicationPermissions': [
                'string',
            ],
            'Type': 'MCP'|'THIRD_PARTY_APPLICATION'
        },
    ],
    HierarchyRestrictedResources=[
        'string',
    ],
    AllowedAccessControlHierarchyGroupId='string',
    AllowedFlowModules=[
        {
            'Type': 'MCP',
            'FlowModuleId': 'string'
        },
    ],
    AllowedAIAgents=[
        {
            'Arn': 'string',
            'Type': 'THIRD_PARTY'
        },
    ],
    GranularAccessControlConfiguration={
        'DataTableAccessControlConfiguration': {
            'PrimaryAttributeAccessControlConfiguration': {
                'PrimaryAttributeValues': [
                    {
                        'AccessType': 'ALLOW',
                        'AttributeName': 'string',
                        'Values': [
                            'string',
                        ]
                    },
                ]
            }
        }
    }
)
type SecurityProfileName:

string

param SecurityProfileName:

[REQUIRED]

The name of the security profile.

type Description:

string

param Description:

The description of the security profile.

type Permissions:

list

param Permissions:

Permissions assigned to the security profile. For a list of valid permissions, see List of security profile permissions.

  • (string) --

type InstanceId:

string

param InstanceId:

[REQUIRED]

The identifier of the Connect Customer instance. You can find the instance ID in the Amazon Resource Name (ARN) of the instance.

type Tags:

dict

param Tags:

The tags used to organize, track, or control access for this resource. For example, { "Tags": {"key1":"value1", "key2":"value2"} }.

  • (string) --

    • (string) --

type AllowedAccessControlTags:

dict

param AllowedAccessControlTags:

The list of tags that a security profile uses to restrict access to resources in Connect Customer.

  • (string) --

    • (string) --

type TagRestrictedResources:

list

param TagRestrictedResources:

The list of resources that a security profile applies tag restrictions to in Connect Customer. For a list of Connect Customer resources that you can tag, see Add tags to resources in Connect Customer in the Connect Customer Administrator Guide.

  • (string) --

type Applications:

list

param Applications:

A list of third-party applications or MCP Servers that the security profile will give access to.

  • (dict) --

    This API is in preview release for Connect Customer and is subject to change.

    A third-party application's metadata.

    • Namespace (string) --

      Namespace of the application that you want to give access to.

    • ApplicationPermissions (list) --

      The permissions that the agent is granted on the application. For third-party applications, only the ACCESS permission is supported. For MCP Servers, the permissions are tool Identifiers accepted by MCP Server.

      • (string) --

    • Type (string) --

      Type of Application.

type HierarchyRestrictedResources:

list

param HierarchyRestrictedResources:

The list of resources that a security profile applies hierarchy restrictions to in Connect Customer. Following are acceptable ResourceNames: User.

  • (string) --

type AllowedAccessControlHierarchyGroupId:

string

param AllowedAccessControlHierarchyGroupId:

The identifier of the hierarchy group that a security profile uses to restrict access to resources in Connect Customer.

type AllowedFlowModules:

list

param AllowedFlowModules:

A list of Flow Modules an AI Agent can invoke as a tool.

  • (dict) --

    A list of Flow Modules an AI Agent can invoke as a tool

    • Type (string) --

      Only Type we support is MCP.

    • FlowModuleId (string) --

      If of Flow Modules invocable as tool

type AllowedAIAgents:

list

param AllowedAIAgents:

A list of AI agents that the security profile will give access to.

  • (dict) --

    Information about an AI agent that a security profile allows access to for Agent-to-Agent authorization.

    • Arn (string) --

      The Amazon Resource Name (ARN) of the AI agent.

    • Type (string) --

      The type of the AI agent. The valid value is THIRD_PARTY.

type GranularAccessControlConfiguration:

dict

param GranularAccessControlConfiguration:

The granular access control configuration for the security profile, including data table permissions.

  • DataTableAccessControlConfiguration (dict) --

    The access control configuration for data tables.

    • PrimaryAttributeAccessControlConfiguration (dict) --

      The configuration's primary attribute access control configuration.

      • PrimaryAttributeValues (list) --

        The item's primary attribute values.

        • (dict) --

          A primary attribute value.

          • AccessType (string) --

            The value's access type.

          • AttributeName (string) --

            The value's attribute name.

          • Values (list) --

            The value's values.

            • (string) --

rtype:

dict

returns:

Response Syntax

{
    'SecurityProfileId': 'string',
    'SecurityProfileArn': 'string'
}

Response Structure

  • (dict) --

    • SecurityProfileId (string) --

      The identifier for the security profle.

    • SecurityProfileArn (string) --

      The Amazon Resource Name (ARN) for the security profile.

UpdateSecurityProfile (updated) Link ¶
Changes (request) 
{'AllowedAIAgents': [{'Arn': 'string', 'Type': 'THIRD_PARTY'}]}

Updates a security profile.

For information about security profiles, see Security Profiles in the Connect Customer Administrator Guide. For a mapping of the API name and user interface name of the security profile permissions, see List of security profile permissions.

See also: AWS API Documentation

Request Syntax

client.update_security_profile(
    Description='string',
    Permissions=[
        'string',
    ],
    SecurityProfileId='string',
    InstanceId='string',
    AllowedAccessControlTags={
        'string': 'string'
    },
    TagRestrictedResources=[
        'string',
    ],
    Applications=[
        {
            'Namespace': 'string',
            'ApplicationPermissions': [
                'string',
            ],
            'Type': 'MCP'|'THIRD_PARTY_APPLICATION'
        },
    ],
    HierarchyRestrictedResources=[
        'string',
    ],
    AllowedAccessControlHierarchyGroupId='string',
    AllowedFlowModules=[
        {
            'Type': 'MCP',
            'FlowModuleId': 'string'
        },
    ],
    AllowedAIAgents=[
        {
            'Arn': 'string',
            'Type': 'THIRD_PARTY'
        },
    ],
    GranularAccessControlConfiguration={
        'DataTableAccessControlConfiguration': {
            'PrimaryAttributeAccessControlConfiguration': {
                'PrimaryAttributeValues': [
                    {
                        'AccessType': 'ALLOW',
                        'AttributeName': 'string',
                        'Values': [
                            'string',
                        ]
                    },
                ]
            }
        }
    }
)
type Description:

string

param Description:

The description of the security profile.

type Permissions:

list

param Permissions:

The permissions granted to a security profile. For a list of valid permissions, see List of security profile permissions.

  • (string) --

type SecurityProfileId:

string

param SecurityProfileId:

[REQUIRED]

The identifier for the security profle.

type InstanceId:

string

param InstanceId:

[REQUIRED]

The identifier of the Connect Customer instance. You can find the instance ID in the Amazon Resource Name (ARN) of the instance.

type AllowedAccessControlTags:

dict

param AllowedAccessControlTags:

The list of tags that a security profile uses to restrict access to resources in Connect Customer.

  • (string) --

    • (string) --

type TagRestrictedResources:

list

param TagRestrictedResources:

The list of resources that a security profile applies tag restrictions to in Connect Customer.

  • (string) --

type Applications:

list

param Applications:

A list of the third-party application's metadata.

  • (dict) --

    This API is in preview release for Connect Customer and is subject to change.

    A third-party application's metadata.

    • Namespace (string) --

      Namespace of the application that you want to give access to.

    • ApplicationPermissions (list) --

      The permissions that the agent is granted on the application. For third-party applications, only the ACCESS permission is supported. For MCP Servers, the permissions are tool Identifiers accepted by MCP Server.

      • (string) --

    • Type (string) --

      Type of Application.

type HierarchyRestrictedResources:

list

param HierarchyRestrictedResources:

The list of resources that a security profile applies hierarchy restrictions to in Connect Customer. Following are acceptable ResourceNames: User.

  • (string) --

type AllowedAccessControlHierarchyGroupId:

string

param AllowedAccessControlHierarchyGroupId:

The identifier of the hierarchy group that a security profile uses to restrict access to resources in Connect Customer.

type AllowedFlowModules:

list

param AllowedFlowModules:

A list of Flow Modules an AI Agent can invoke as a tool

  • (dict) --

    A list of Flow Modules an AI Agent can invoke as a tool

    • Type (string) --

      Only Type we support is MCP.

    • FlowModuleId (string) --

      If of Flow Modules invocable as tool

type AllowedAIAgents:

list

param AllowedAIAgents:

A list of AI agents that the security profile will give access to.

  • (dict) --

    Information about an AI agent that a security profile allows access to for Agent-to-Agent authorization.

    • Arn (string) --

      The Amazon Resource Name (ARN) of the AI agent.

    • Type (string) --

      The type of the AI agent. The valid value is THIRD_PARTY.

type GranularAccessControlConfiguration:

dict

param GranularAccessControlConfiguration:

The granular access control configuration for the security profile, including data table permissions.

  • DataTableAccessControlConfiguration (dict) --

    The access control configuration for data tables.

    • PrimaryAttributeAccessControlConfiguration (dict) --

      The configuration's primary attribute access control configuration.

      • PrimaryAttributeValues (list) --

        The item's primary attribute values.

        • (dict) --

          A primary attribute value.

          • AccessType (string) --

            The value's access type.

          • AttributeName (string) --

            The value's attribute name.

          • Values (list) --

            The value's values.

            • (string) --

returns:

None