// CONNECTIVITY VALIDATOR v3.0 — 2026 EDITION
Is your workstation Connect-ready?
Run a complete pre-flight check for Amazon Connect softphone agents. Validates new 2026 sign-in endpoints, WebRTC & ICE candidate types, Audio Enhancement eligibility, VDI detection, IPv6/dualstack S3, GovCloud FIPS, microphone, network performance, browser compatibility, and all AWS CCP endpoints — nothing uploaded, 100% client-side.
VALIDATION PARAMETERS
Connect Instance URL
AWS Region
Expected Mic Input
Agent ID (optional)
// DIAGNOSTIC REPORT
Amazon Connect Agent Workstation Validator — 2026 Edition
Amazon Connect's softphone uses WebRTC to deliver voice, chat, and omnichannel contacts directly through the browser. A correctly configured agent workstation is critical for call quality, agent availability, and customer satisfaction. This free tool validates every technical requirement — browser version, WebRTC ICE candidate types, NAT type detection, microphone access, STUN/TURN reachability, new 2026 sign-in endpoints (*.signin.aws), IPv6/dualstack S3 reachability, VDI environment detection, Audio Enhancement eligibility (noise suppression and voice isolation), omnichannel readiness, codec support, and network throughput — in a single click, with nothing uploaded. Updated for the mandatory October 2026 sign-in migration.
What is the Amazon Connect new sign-in experience and when is the migration deadline?
Amazon Connect is rolling out a new sign-in experience that uses
*.signin.aws and *.apps.signin.aws domains. All newly created instances use it by default from April 7 2026. Existing instances are automatically migrated on July 7 2026 if the new endpoints are reachable. All remaining instances are forcibly migrated by October 7 2026. Firewall teams must allowlist the new sign-in domains before these dates to prevent agent login failures. Password reset emails will now arrive from no-reply@signin.aws — ensure this is not blocked by your email security gateway.
What browsers does Amazon Connect softphone support in 2025/2026?
Amazon Connect officially supports the latest three versions of Google Chrome and Mozilla Firefox on Windows and macOS. Microsoft Edge (Chromium-based) is also fully supported. Safari has limited WebRTC functionality and is not recommended for softphone use. Internet Explorer is not supported. Chrome is strongly recommended for best softphone performance, lowest latency, and full Audio Enhancement support (noise suppression and voice isolation modes launched February 2026).
What network ports and domains does Amazon Connect require in 2026?
Amazon Connect requires TCP 443 for HTTPS/WSS signaling to
*.my.connect.aws, *.awsapps.com, *.transport.connect.{region}.amazonaws.com, and the new sign-in domains *.signin.aws and *.apps.signin.aws. UDP 3478 is required outbound to TurnNlb-*.elb.{region}.amazonaws.com for STUN/TURN media. Stateless firewalls also need ephemeral UDP ports 32768–65535 open for RTP return traffic. For IPv6/dualstack S3 (required for new sign-in), allow *.s3.dualstack.{region}.amazonaws.com. Always use domain-based allowlisting — never IP ranges, as AWS IP ranges rotate without notice.
What is Amazon Connect Audio Enhancement and what are the system requirements?
Amazon Connect Audio Enhancement (launched February 2026) reduces background noise and isolates the agent's voice during calls in real time. It offers two modes: Noise Suppression (works with any headset — wired or Bluetooth) and Voice Isolation (reduces background noise AND separates the agent's voice from other nearby speakers, but requires a wired headset). Both modes require a minimum 4-core CPU or 4 vCPU for virtual machines. Audio Enhancement is configured by administrators in Connect Admin Console under User Management, and agents can adjust their own mode if their security profile allows it.
How do I fix one-way audio in Amazon Connect?
One-way audio in Amazon Connect is almost always caused by a STUN/TURN connectivity problem. The most common causes are: a corporate firewall blocking UDP 3478 outbound to
TurnNlb-*.elb.{region}.amazonaws.com, symmetric NAT forcing relay-only ICE candidates (detectable by this tool under the WebRTC check), a VPN in full-tunnel mode routing media through the VPN server and adding 100–200ms latency, or stateless firewall rules missing the ephemeral UDP port range for RTP return traffic. Run this validator and check the WebRTC ICE Candidate Types row — if you see relay-only candidates with no srflx, your NAT is symmetric and all media must traverse the TURN relay on UDP 3478.
How do I use Amazon Connect in a Citrix, WorkSpaces, or Omnissa VDI environment?
Amazon Connect supports audio optimization for Citrix, Amazon WorkSpaces (PCoIP and DCV), and Omnissa cloud desktops by offloading audio processing from the VDI server to the agent's local endpoint. To enable this, append the
VDIPlatform query parameter to the agent workspace URL: use ?VDIPlatform=CITRIX, ?VDIPlatform=AWS_WORKSPACE, or ?VDIPlatform=OMNISSA. This signals the CCP to perform WebRTC audio redirection. Citrix requires Workspace App 2305 or later on the local client. Without audio optimization, all RTP media processes on the VDI server, adding 50–200ms extra latency and degrading call quality significantly.
What are the minimum hardware requirements for Amazon Connect agents?
AWS recommends a dual-core 2GHz processor or better (4+ cores for Audio Enhancement), 4GB RAM minimum (8GB for CRM integrations), a USB wired headset with echo cancellation for best call quality, 10 Mbps dedicated broadband, less than 150ms round-trip latency to the AWS region, and under 1% packet loss. Wired Ethernet is strongly preferred over Wi-Fi. For Audio Enhancement Voice Isolation mode specifically, a 4-core CPU and a wired (non-Bluetooth) headset are mandatory requirements. Screen: 1280×720 minimum.
What audio codecs does Amazon Connect use?
Amazon Connect uses Opus as its primary codec — wideband, adaptive bitrate, and excellent for voice over variable-quality networks. PCMU (G.711 μ-law, 64kbps) and PCMA (G.711 A-law) are used as PSTN fallback codecs for phone network interoperability. The CCP negotiates the best available codec via SDP offer/answer. All modern browsers support Opus. If Opus negotiation fails, the session automatically falls back to PCMU or PCMA. Third-party speech providers Deepgram (STT) and ElevenLabs (TTS) are now also supported for self-service voice flows (November 2025).
Does Amazon Connect work over VPN?
Yes, but VPN configuration is critical. Full-tunnel VPNs route all traffic — including real-time RTP media — through the corporate VPN server, adding 50–200ms extra latency and often blocking UDP 3478. The recommended approach is split-tunnel VPN that routes AWS Connect media and signaling endpoints directly to the internet, bypassing the VPN tunnel. Configure your VPN to exclude
*.my.connect.aws, *.amazonaws.com, *.signin.aws, and the TurnNlb TURN server IP ranges. AWS publishes current IP ranges in ip-ranges.json under the AMAZON_CONNECT service tag.
What omnichannel features does Amazon Connect support in 2025/2026?
Amazon Connect is a fully omnichannel platform supporting voice (softphone and desk phone), chat (WebSocket-based), email with automated routing and keyword conditions, tasks (with file attachments up to 5 files per task as of January 2026), and WhatsApp outbound campaigns (launched December 2025). Per-channel auto-accept and After Contact Work (ACW) timeouts are now configurable for chat, tasks, email, and callbacks separately (February 2026). Real-time agent AI assistance and automated performance evaluations now support Portuguese, French, Italian, German, and Spanish.
What is the ice_collection_timeout error in Amazon Connect CCP?
The
ice_collection_timeout error means the Connect CCP could not gather ICE candidates within the timeout window — most commonly because UDP 3478 outbound traffic is blocked by a corporate firewall or NAT device. To diagnose: run this tool and check the WebRTC ICE check section. If you see zero srflx (server-reflexive) candidates, your firewall is blocking the STUN server on UDP 3478. Fix: allow outbound UDP 3478 to TurnNlb-*.elb.{region}.amazonaws.com and stun.l.google.com:19302. If using a stateless firewall, also open the ephemeral UDP port range (32768–65535) for RTP return traffic.
How do I prepare for the Amazon Connect GovCloud FIPS sign-in migration?
GovCloud (us-gov-west-1) instances must also allow the FIPS-compliant sign-in endpoints:
*.signin-fips.amazonaws-us-gov.com and *.apps.signin-fips.aws-us-gov.com. Select the us-gov-west-1 region in this tool's region dropdown and run the New Sign-in Migration check — it will specifically probe the GovCloud FIPS endpoints. All GovCloud instances must complete migration by October 7 2026. To test the new experience manually, append ?use-new-experience=true to your GovCloud Connect login URL.
More Free Online Tools
Simple tools. Surgical fixes. Zero friction.
Amazon Connect CCP Log Parser
Parse Amazon Connect CCP logs into structured, searchable diagnostics.
OpenAmazon Connect Agent Workstation Validator
Pre-flight check for Amazon Connect softphone agents.
OpenAmazon Connect Pricing Calculator
Instantly estimate monthly AWS Connect costs — voice, chat, email, campaigns, telephony & more.
OpenConnect CloudWatch Log Analyzer
Drop any Amazon Connect CloudWatch log and get a rich visual breakdown.
Open