Amazon Chime SDK Voice Connector: groups, origination routes and evidence

Model termination and origination as different call directions

Amazon Chime SDK Voice Connector uses termination settings for calls sent from customer SIP infrastructure toward AWS and origination settings for inbound PSTN calls AWS sends to customer SIP hosts. For termination, inventory the outbound hostname, public source CIDR allowlist, SIP credentials, calls-per-second setting, calling plan, caller-ID override and last OPTIONS ping separately. AWS account credentials are not SIP credentials.

For origination, inventory the assigned phone number, Voice Connector or group, connector Region, public SIP host, port, protocol, priority and weight. AWS expects PSTN numbers in E.164 form. A successful outbound call, API endpoint or saved route does not prove that the number is assigned to the intended inbound object.

Trace both inbound selection layers in order

A Voice Connector group provides provider-side inbound PSTN routing across connectors, including connectors in different AWS Regions. AWS documents connector priority with 1 as highest and says higher-priority connectors are attempted first. Phone numbers must be assigned to the group for that layer to apply.

After a connector is selected, origination routes send the call to customer SIP hosts. AWS evaluates route priority first, then distributes calls by relative weight among equal-priority hosts. Record group membership and priority separately from origination host priority and weight. A secondary connector or route does not prove customer-network independence or survival of an established dialog.

Keep Region availability, IP family and DNS boundaries precise

AWS documents multiple service endpoints and Voice Connector network ranges, but an API endpoint in a Region is not proof of phone-number inventory, PSTN calling availability or account eligibility there. Verify the chosen connector Region, number assignment, network ranges and product availability as separate acceptance items.

DUAL_STACK is selectable only when creating a connector; existing connectors remain IPv4-only. A dual-stack connector uses IPv6 when the customer hostname supports it, while an IPv4-only connector does not fall back to IPv6. AWS also warns not to cache the outbound hostname beyond its DNS TTL because addresses can change.

Treat encryption as an end-to-end acceptance boundary

Enabling Voice Connector encryption uses TLS on port 5061 for SIP signaling and SRTP for media. AWS documents TLS 1.2 and 1.3, no mutual TLS, Amazon Trust Services server certificates and required SRTP cryptographic profiles. When encryption is enabled, inbound calls use TLS and unencrypted outbound calls are blocked.

AWS currently labels several TLS cipher suites deprecated with support ending August 1, 2026. Preserve the configured suite list, certificate trust result, negotiated TLS version, SDP crypto attributes and two-way media. The documentation deadline is not proof of a particular account or PBX runtime; verify the actual handshake rather than claiming compatibility.

Enable evidence before diagnosing routing

AWS disables Voice Connector logging by default. When enabled, SIP metric and media metric logs are sent to an Amazon CloudWatch log group. Preserve the connector and group identifiers, timestamp and timezone, provider call identifier, chosen connector, origination host, SIP result, PBX call identifier, answer and media outcome. Apply appropriate access, retention and redaction controls.

CloudWatch evidence shows the AWS-side observation; it does not by itself prove packet arrival at the customer interface or a match in the PBX. Pair it with an authorized packet capture, firewall decision and PBX signaling log for the same call.

Separate quotas, media, emergency and commercial acceptance

The current AWS quota reference lists separate adjustable defaults, including Voice Connectors per Region, Voice Connector groups per account, connectors per group, calls per second and active calls per account per Region. Read the live Service Quotas values in the selected account and Region. Calls per second and concurrency are different controls, and a group does not turn regional limits into one global capacity promise.

The network guide lists SIP and media ranges plus approximate audio and T.38 bandwidth. Emergency routing requires termination and origination plus third-party U.S. routing and test numbers. Pricing is pay-per-use with number and optional streaming charges. Verify current account limits, SDP, media, number inventory, emergency workflow and dated charges separately; no AWS service or live call was tested for this guide.

Trace a disputed inbound call through both AWS routing layers

Use the Amazon Chime Voice Connector diagnostic to prove number assignment, group selection, origination host, customer-edge receipt, PBX handling and media.