fsi-channel-contact-center

Files (185)

• SKILL.md
• SKILL_ja.md
• cdk-nag-test.template.ts · assets/
• agent-workspace.png · assets/images/
• anybank.png · assets/images/
• diagram.PNG · assets/images/
• dr.png · assets/images/
• .gitignore · assets/sample-cdk/
• SECURITY_NOTICE.md · assets/sample-cdk/
• bleafsi-guest-customer-channel-sample.ts · assets/sample-cdk/bin/
• parameter.ts · assets/sample-cdk/bin/
• cdk.json · assets/sample-cdk/
• jest.config.js · assets/sample-cdk/
• config.ts · assets/sample-cdk/lib/
• application.ts · assets/sample-cdk/lib/constructs-l2/appintegrations/
• data-integration.ts · assets/sample-cdk/lib/constructs-l2/appintegrations/
• index.ts · assets/sample-cdk/lib/constructs-l2/appintegrations/
• domain.onEvent.ts · assets/sample-cdk/lib/constructs-l2/connect-cases/
• domain.ts · assets/sample-cdk/lib/constructs-l2/connect-cases/
• index.ts · assets/sample-cdk/lib/constructs-l2/connect-cases/
• contact-flow.ts · assets/sample-cdk/lib/constructs-l2/connect/
• hours-of-operation.ts · assets/sample-cdk/lib/constructs-l2/connect/
• index.ts · assets/sample-cdk/lib/constructs-l2/connect/
• instance-storage-config.ts · assets/sample-cdk/lib/constructs-l2/connect/
• instance.ts · assets/sample-cdk/lib/constructs-l2/connect/
• integration-association.ts · assets/sample-cdk/lib/constructs-l2/connect/
• l1-instance-storage-config.onEvent.ts · assets/sample-cdk/lib/constructs-l2/connect/
• l1-instance-storage-config.ts · assets/sample-cdk/lib/constructs-l2/connect/
• l1-integration-association.onEvent.ts · assets/sample-cdk/lib/constructs-l2/connect/
• l1-integration-association.ts · assets/sample-cdk/lib/constructs-l2/connect/
• prompt.fromPromptName.onEvent.ts · assets/sample-cdk/lib/constructs-l2/connect/
• prompt.ts · assets/sample-cdk/lib/constructs-l2/connect/
• queue.fromQueueName.onEvent.ts · assets/sample-cdk/lib/constructs-l2/connect/
• queue.ts · assets/sample-cdk/lib/constructs-l2/connect/
• routing-profile.ts · assets/sample-cdk/lib/constructs-l2/connect/
• security-profile.ts · assets/sample-cdk/lib/constructs-l2/connect/
• template-contact-flow.ts · assets/sample-cdk/lib/constructs-l2/connect/
• user.ts · assets/sample-cdk/lib/constructs-l2/connect/
• domain.ts · assets/sample-cdk/lib/constructs-l2/customer-profiles/
• index.ts · assets/sample-cdk/lib/constructs-l2/customer-profiles/
• integration.ts · assets/sample-cdk/lib/constructs-l2/customer-profiles/
• object-type.ts · assets/sample-cdk/lib/constructs-l2/customer-profiles/
• index.ts · assets/sample-cdk/lib/constructs-l2/
• ai-agent-version.ts · assets/sample-cdk/lib/constructs-l2/qconnect/
• ai-agent.ts · assets/sample-cdk/lib/constructs-l2/qconnect/
• ai-prompt-version.ts · assets/sample-cdk/lib/constructs-l2/qconnect/
• ai-prompt.ts · assets/sample-cdk/lib/constructs-l2/qconnect/
• assistant-ai-agent-configuration.onEvent.ts · assets/sample-cdk/lib/constructs-l2/qconnect/
• assistant-ai-agent-configuration.ts · assets/sample-cdk/lib/constructs-l2/qconnect/
• assistant-association.ts · assets/sample-cdk/lib/constructs-l2/qconnect/
• assistant.ts · assets/sample-cdk/lib/constructs-l2/qconnect/
• index.ts · assets/sample-cdk/lib/constructs-l2/qconnect/
• knowledge-base.ts · assets/sample-cdk/lib/constructs-l2/qconnect/
• cloudfront.ts · assets/sample-cdk/lib/constructs/
• glob-patterns.ts · assets/sample-cdk/lib/constructs/
• index.ts · assets/sample-cdk/lib/constructs/
• s3-private-bucket.ts · assets/sample-cdk/lib/constructs/
• s3-replication.ts · assets/sample-cdk/lib/constructs/
• nag-suppressions.ts · assets/sample-cdk/lib/
• call-monitoring-sample.ts · assets/sample-cdk/lib/samples/call-monitoring-sample/
• …and 125 more

SKILL.md (first lines)

# FSI Customer Channel (顧客チャネル)

## Workload Overview

The Customer Channel workload is a reference architecture for an **omnichannel contact
center** built for Japanese financial institutions, centered on **Amazon Connect**.
Financial institutions increasingly invest in contact centers that improve both customer
experience and employee experience across multiple channels: text chat on a web portal,
voice calls with a call-center agent, and chatbots. This workload shows how to combine
Amazon Connect with other AWS services and machine-learning technology to build a contact
center that meets the security, compliance, and reliability requirements demanded of
financial institutions.

**Business scenarios covered:**

- **Channels**: public-switched-telephone-network voice, or chat from a web portal.
- **Inbound**: customer desks, agency desks, automated reception (telephone banking,
  provisional card-loan screening), and call concentration.
- **Outbound**: call-backs, telemarketing, and collection/dunning operations.
- **Compliance**: detecting words that violate internal compliance rules from the
  transcription of voice-channel conversations.

**Significance in financial services:** Contact centers handle sensitive customer data
(phone numbers, contract details, identity information) and are subject to the FISC
安全対策基準 (Security Guidelines on Computer Systems for Financial Institutions). This
workload provides an implementation baseline that addresses encryption, access control,
audit logging, disaster recovery, and identity verification, deployed on top of the BLEA
for FSI governance base.

## Best Practices and Key Components

### Best Practices

- MUST: Manage users in the primary region via SAML federation with AWS IAM Identity
  Center so password policy and MFA are enforced.
- MUST: Encrypt data stored in Amazon S3 (call recordings, chat transcripts, contact
  trace records) with AWS KMS keys and protect access via IAM policies and S3 bucket
  policies.
- MUST: Use TLS for all communication with and between AWS services (Amazon Connect,
  Amazon S3, etc.) for both confidentiality and tamper detection.
- MUST: Control access to sensitive contact history (phone numbers, recordings, contact
  flows) using Amazon Connect security profiles.
- MUST: Grant IAM policies, resource policies, and SCPs with the least privilege possible,
  including the roles attached to Lambda functions.
- SHOULD: Enable KMS key rotation and manage key policies; consider separation of duties
  between the encryption-key administrator and the data owner.
- SHOULD: Back up important settings such as contact flows periodically using Amazon
  EventBridge and AWS Lambda so they can be restored after unauthorized changes.
- SHOULD: Monitor key Amazon Connect metrics with Amazon CloudWatch (e.g.
  LongestQueueWaitTime, MissedCalls, CallsBreachingConcurrencyQuota,
  ContactFlowErrors, ThrottledCalls) to detect quota breaches and errors.
- SHOULD: Export the Amazon Connect login/logout report to S3 because it is limited to
  10,000 rows.
- SHOULD: Record Lambda function execution logs, since most other services are managed.
- MAY: Use Amazon Connect Voice ID for voice-based identity verification (voiceprint),
  with operator confirmation available as an alternative.
- MAY: Adopt a secondary region for wide-area disaster recovery; it is optional and can be
  omitted when multi-AZ redundancy is sufficient or data-residency is a concern.
- WILL: In the secondary (DR) region, AWS IAM Identity Center is not used, so password
  policy, MFA, and login-failure logging are not enforced there — account for this.
- WILL: The sample template uses the Amazon Connect Preview API, which is subject to
  change, and implements only part of the full architecture (e.g. periodic configuration
  backup is not yet implemented).
- MUST: Apply cdk-nag's AwsSolutionsChecks (via Aspects) to every CDK stack built from this skill, and gate CI (jest etc.) on zero unsuppressed AwsSolutions-* findings; suppress exceptions only with an explicit reason via NagSuppressions (see references/cdk-nag.md).

### Key Components

#### Contact Center Platform

- **Component Overview**: The core engine that receives inbound/outbound voice, web chat,
  and web calls, routes contacts to agents, records interactions, and hosts contact flows
  and the agent workspace. It runs across multiple Availability Zones for high
  availability.
- **Assumed AWS Services**: Amazon Connect.

#### Identity and Authentication

- **Component Overview**: Enforces password policy and MFA for agents/administrators and
  centralizes identity, verifying end-customer identity where required.
- **Assumed AWS Services**: AWS IAM Identity Center (SAML federation), Amazon Connect user
  management (secondary region), Amazon Connect Voice ID; optionally an external IdP.

#### Inbound Contact Handling

- **Component Overview**: Receives incoming voice/chat contacts, performs automated
  reception and identity prompts, and connects customers to agents. Supports both
  agent-connected flows and immediate-acceptance flows used by the communication widget.
- **Assumed AWS Services**: Amazon Connect (contact flows, queues), Amazon Lex (identity
  bot), Amazon Polly.

#### Outbound Contact Automation

- **Component Overview**: Automates outbound dialing via an API and manages the state of
  each dial (initiated, disconnected) for call-backs, telemarketing, and dunning.
- **Assumed AWS Services**: Amazon API Gateway (IAM auth), AWS Step Functions, Amazon
  DynamoDB, Amazon EventBridge, Amazon Connect.

#### AI Assistance and Compliance Monitoring

- **Component Overview**: Provides agent assist / self-service answers from a knowledge
  base, real-time call monitoring, conversation summarization, and compliance checks that
  detect rule-violating statements in transcripts.
- **Assumed AWS Services**: Amazon Q in Connect, Amazon Bedrock (Anthropic Claude, Amazon
  Nova models), Amazon Kinesis Data Streams, AWS Lambda, AWS AppSync, Amazon DynamoDB.

#### Customer Data and Case Management

- **Component Overview**: Unifies customer profiles across contacts and manages
  customer-issue cases integrated with the contact center.
- **Assumed AWS Services**: Amazon Connect Customer Profiles, Amazon Connect Cases, Amazon
  AppIntegrations.

#### Recording Storage, Backup, and DR

- **Component Overview**: Stores encrypted call recordings, chat transcripts, and contact
  trace records, and replicates them cross-region for remote backup and disaster recovery.
- **Assumed AWS Services**: Amazon S3 (KMS-encrypted, versioned, cross-region
  replication), AWS KMS, Amazon Data Firehose.

From aws-samples/sample-fsi-reference-architecture-jp, MIT-0.

More from aws-samples/sample-fsi-reference-architecture-jp