Freeze one number, one call and both routing layers
Record the dialed E.164 number, timestamp and timezone, number assignment, group identifier and membership, connector priorities and Regions, selected connector, origination routes, host priorities and weights, protocol, AWS call identifier and attempt, customer-edge receipt, PBX call identifier and match, answer, media and caller outcome. Redact credentials, personal numbers and packet payloads.
Classify the first disputed boundary: number assignment, group selection, connector availability, origination selection, AWS attempt, network delivery, TLS, PBX match, answer or media. Do not change all layers at once.
Prove the phone number points to the intended connector or group
Export or capture the phone-number assignment and the effective Voice Connector or group. For a group, record each member connector, Region and priority; AWS documents 1 as the highest priority. A connector can exist, be healthy for another call direction or appear in a group without the disputed number being assigned to that object.
Do not infer product or number availability from an AWS API endpoint list. Preserve the account, Region, connector network type and number inventory evidence used for the call.
Trace connector selection before origination-host selection
Preserve which connector AWS attempted and the evidence for any later connector selection. Then inspect that connector’s enabled origination settings and ordered hosts. AWS evaluates origination priority before relative weight among equal-priority hosts. Weight is distribution within a priority tier, not a lower-priority fallback rule.
The reviewed AWS pages do not publish one universal SIP-response matrix, timeout schedule or restoration timer for every group and origination outcome. Escalate unexplained advancement or non-advancement with exact call identifiers and timestamps rather than importing another provider’s trigger table.
Prove transport and encryption at the customer boundary
For the selected host, verify public reachability, DNS resolution and TTL behavior, current AWS signaling and media ranges, firewall decision, transport and port. If encryption is enabled, retain the TLS handshake, certificate chain, negotiated TLS version and cipher, SIP exchange on TCP 5061, SDP crypto attributes and SRTP flow.
A dual-stack connector can use IPv6 when the hostname supports it; an IPv4-only connector does not attempt IPv6. Do not broaden every firewall rule, disable encryption or replace a hostname with a long-lived address merely to make a test pass.
Correlate CloudWatch, packet and PBX evidence
If authorized, enable SIP and media metric logging for the smallest useful interval because Voice Connector logging is disabled by default. Match the AWS record to a customer-edge capture and PBX log using timestamps, identifiers, source, Request-URI, called-number form, first matching route, response, answer and release.
An AWS attempt does not prove customer-edge receipt; edge receipt does not prove the intended extension, queue, menu or voicemail handled the call. After answer, retain SDP offer and answer, selected endpoints, packet flow in both directions and an authorized caller/listener result.
Correct the earliest mismatch and retest failure plus recovery
Change only the demonstrated owner: number assignment, group membership or priority, connector state, origination host priority or weight, DNS, firewall, TLS profile, PBX normalization or destination. Preserve the prior state and repeat authorized new-call tests for the normal path, the approved failed component, the expected later connector or host and return to primary. Record AWS attempt, customer receipt, PBX match, answer, two-way media, clean release and caller treatment separately.
Remove temporary routes, broad firewall rules, captures and elevated logging. Check live account quotas independently: group and connector limits, calls per second and active calls are not interchangeable. One successful new call does not establish established-call survival, universal availability, emergency behavior or future compatibility. No AWS account, connector, group, route, PBX, network path or live call was inspected or tested for this diagnostic.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- AWS: Managing Amazon Chime SDK Voice Connectors ↗
- AWS: Editing Voice Connector settings ↗
- AWS: Creating a Voice Connector and encryption scope ↗
- AWS: Managing Voice Connector groups ↗
- AWS: Amazon Chime SDK endpoints and quotas ↗
- AWS: Voice Connector network and bandwidth requirements ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.