Configure Amazon S3 Cross-Account Storage for VideoEngager Call Recordings (Genesys Cloud)

Applies to: AWS admins (S3 bucket owner account) and Genesys Cloud admins configuring SmartVideo recording storage.

What you need from VideoEngager Support

These values are deployment-dependent and must be provided by VideoEngager Support:

• Publish role ARN (Role 1) – used to upload recording files to your bucket.
• Playback role ARN (Role 2) – used only if VideoEngager playback needs to read files from your bucket.
• (Optional) Recommended S3 prefix to scope access (e.g., recordings/<tenant>/).

Role 1 vs Role 2 — what they do (and what you control)

Security controls you have:

• You can keep VideoEngager write-only by granting Role 1 upload permissions and not granting read.
• You can enable playback by granting Role 2 read-only.
• You can restrict access to a prefix (recommended), and optionally add an explicit Deny to ensure Role 1 can never read.

Step 1 — Prepare your S3 bucket (AWS)

1. Create or choose an S3 bucket in your AWS account (the bucket owner account).
2. Keep Block Public Access enabled.
3. (Recommended) Decide a prefix/folder for recordings, e.g. recordings/ or recordings/<tenant>/.

Step 2 — Add the S3 Bucket Policy (Cross-Account Access)

In AWS: S3 → your bucket → Permissions → Bucket policy. Use the patterns below and replace placeholders with values from Support.

Option A (recommended): Prefix-scoped policy (best practice)

Replace:

• <BUCKET> → your bucket name
• <PREFIX> → e.g. recordings (no leading/trailing slash in placeholders below)
• <PUBLISH_ROLE_ARN> → from VideoEngager Support
• <PLAYBACK_ROLE_ARN> → from VideoEngager Support (optional if you need playback)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Role1PublishWriteOnly",
      "Effect": "Allow",
      "Principal": { "AWS": "<PUBLISH_ROLE_ARN>" },
      "Action": [
        "s3:PutObject",
        "s3:AbortMultipartUpload"
      ],
      "Resource": [
         "arn:aws:s3:::<BUCKET>",
         "arn:aws:s3:::<BUCKET>/<PREFIX>/*"
      ]
    },
    {
      "Sid": "DenyRole1PublishReadBack",
      "Effect": "Deny",
      "Principal": { "AWS": "<PUBLISH_ROLE_ARN>" },
      "Action": [ "s3:GetObject" ],
      "Resource": "arn:aws:s3:::<BUCKET>/<PREFIX>/*"
    },
    {
      "Sid": "Role2PlaybackReadOnly",
      "Effect": "Allow",
      "Principal": { "AWS": "<PLAYBACK_ROLE_ARN>" },
      "Action": [ "s3:GetObject" ],
      "Resource": "arn:aws:s3:::<BUCKET>/<PREFIX>/*"
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Role1PublishWriteOnly",
      "Effect": "Allow",
      "Principal": { "AWS": "<PUBLISH_ROLE_ARN>" },
      "Action": [
        "s3:PutObject",
        "s3:AbortMultipartUpload"
      ],
      "Resource": "arn:aws:s3:::<BUCKET>/*"
    },
    {
      "Sid": "Role2PlaybackReadOnly",
      "Effect": "Allow",
      "Principal": { "AWS": "<PLAYBACK_ROLE_ARN>" },
      "Action": [ "s3:GetObject" ],
      "Resource": "arn:aws:s3:::<BUCKET>/*"
    }
  ]
}

Step 3 — Configure S3 Storage in Genesys Cloud (SmartVideo)

1. Log in to Genesys Cloud.
2. Go to Apps → SmartVideo Settings.
3. Select the Recording tab.

Final Storage (where recordings are saved)

1. Scroll to Final Storage and enable Override the default storage configuration.
2. Set Storage Type → S3.
3. Relative path:
   • Leave empty if your bucket policy is bucket-wide.
   • If you used a prefix policy, set it to your prefix (example: recordings).
4. Under AWS S3 Configuration:
   • Region → your bucket region
   • Bucket → your bucket name

Playback Storage (used for playback)

1. Scroll to Playback Storage and enable Override the default storage configuration.
2. Set Storage Type → S3.
3. Use the same bucket/region (and prefix if used) as Final Storage.
4. If you want playback via VideoEngager/SmartVideo, ensure your bucket policy includes Role 2 (Playback) read access.

Save: Scroll to the bottom, click Save settings, then wait at least 5 minutes for changes to apply.

Step 4 — Validate

1. Place a test call and end it.
2. Check your S3 bucket for new recording objects (in your configured prefix if used).
3. If you enabled playback, confirm playback works in your agent experience.

Troubleshooting (fast checks)