# Find Amazon Connect flows that still use Voice ID

Companion to [Amazon Connect Voice ID end of support: what to migrate to](/blog/amazon-connect-voice-id-end-of-support-migration-2026/).

`find-voice-id-flows.mjs` takes an injected Connect client (`listFlows`, `describeFlow`), parses each flow's JSON `Content`, and reports every Voice ID action. Node 24, no dependencies for the library; the CLI needs `@aws-sdk/client-connect`.

## What it matches

Names are from the Connect flow-language reference, checked October 28, 2026:

| Block in the designer | Action `Type` | How it is matched |
| --- | --- | --- |
| Check Voice ID | `CheckVoiceId` | by type |
| Set Voice ID | `UpdateContactData` | only if `Parameters` contains a Voice ID key: `IsVoiceIdStreamingEnabled`, `IsVoiceAuthenticationEnabled`, `IsFraudDetectionEnabled`, `VoiceAuthenticationThreshold`, `VoiceAuthenticationResponseTime`, `FraudDetectionThreshold`, `WatchlistId` |

`UpdateContactData` also carries ordinary settings (name, description, language), so the key check avoids false positives. The matcher object is exported and overridable (`findVoiceIdFlows(client, id, { matchers })`) in case AWS renames a key. A block that sets `IsVoiceIdStreamingEnabled` to `"FALSE"` is still reported, because it is still a Voice ID reference.

## Run it

```sh
node --test                                   # mocked flows only; no AWS calls
npm i @aws-sdk/client-connect                 # CLI only
node find-voice-id-flows.mjs <instanceId> us-east-1 > voice-id-inventory.json
```

Exit code 1 means at least one flow could not be described or parsed (listed under `errors`). Treat the inventory as incomplete until `errors` is empty.

**What was and was not tested.** The three tests use hand-written flows that follow the documented action shapes. The CLI path was not run against a live instance. It does not scan flow modules, and it does not see Lambda code, Contact Lens rules or agent-side CCP configuration that depend on Voice ID results.

## Migration checklist

1. Run the inventory in every Region and instance. Record flow, block id, and which Voice ID option each `CheckVoiceId` reads (`enrollmentStatus`, `voiceAuthentication`, `fraudDetection`).
2. Tier each journey by what a wrong "yes" costs: information only, account change, money movement.
3. Pick the replacement per tier. Do not put one factor on every tier.
4. Build the replacement as a subflow with the same output attributes your downstream flows already read, so callers of the subflow do not change.
5. Define the failure path first: lockout count, agent handoff, and what the agent sees.
6. Run old and new side by side on a subset of numbers or queues. Compare completion, handoff and false-reject rates from your own data.
7. Remove the Voice ID blocks, publish, and re-run the inventory until it returns zero flows.
8. Confirm voiceprint data is deleted: list every Voice ID domain per Region per account, export what you must keep, delete the domains, and keep the evidence. If the console or API no longer responds, open an AWS Support case rather than assuming deletion.
9. Update your privacy notice and retention records for biometric data. Ask counsel; this is not legal advice.