From 58004ada2ea68ed5085d29e73f1da7fee2f08723 Mon Sep 17 00:00:00 2001
From: awstools Disables the specified user. Calling this action requires developer credentials. Deactivates a user and revokes all access tokens for the user. A deactivated user can't sign in,
+ * but still appears in the responses to You must make this API request with Amazon Web Services credentials that have This method takes a user pool ID, and returns the signing certificate. This method takes a user pool ID, and returns the signing certificate. The issued certificate is valid for 10 years from the date of issue. Amazon Cognito issues and assigns a new signing certificate annually. This process returns a new value in the response to Signs out users from all devices. It also invalidates all refresh tokens that Amazon Cognito
- * has issued to a user. The user's current access and ID tokens remain valid until their
- * expiry. By default, access and ID tokens expire one hour after Amazon Cognito issues them. A user
- * can still use a hosted UI cookie to retrieve new tokens for the duration of the cookie
- * validity period of 1 hour.GetUser
and ListUsers
API requests.cognito-idp:AdminDisableUser
permissions.GetSigningCertificate
,
+ * but doesn't invalidate the original certificate.
Revokes all of the access tokens generated by the specified refresh token. After the - * token is revoked, you can't use the revoked token to access Amazon Cognito authenticated - * APIs.
+ *Revokes all of the access tokens generated by, and at the same time as, the specified + * refresh token. After a token is revoked, you can't use the revoked token to access + * Amazon Cognito user APIs, or to authorize access to your resource server.
*/ public revokeToken(args: RevokeTokenCommandInput, options?: __HttpHandlerOptions): PromiseDisables the specified user.
- *Calling this action requires developer credentials.
+ *Deactivates a user and revokes all access tokens for the user. A deactivated user can't sign in,
+ * but still appears in the responses to GetUser
and ListUsers
API requests.
You must make this API request with Amazon Web Services credentials that have cognito-idp:AdminDisableUser
permissions.
This method takes a user pool ID, and returns the signing certificate.
+ *This method takes a user pool ID, and returns the signing certificate. The issued certificate is valid for 10 years from the date of issue.
+ *Amazon Cognito issues and assigns a new signing certificate annually. This process returns a new value in the response to GetSigningCertificate
,
+ * but doesn't invalidate the original certificate.
Signs out users from all devices. It also invalidates all refresh tokens that Amazon Cognito - * has issued to a user. The user's current access and ID tokens remain valid until their - * expiry. By default, access and ID tokens expire one hour after Amazon Cognito issues them. A user - * can still use a hosted UI cookie to retrieve new tokens for the duration of the cookie - * validity period of 1 hour.
+ * has issued to a user. A user can still use a hosted UI cookie to retrieve new tokens + * for the duration of the 1-hour cookie validity period. * @example * Use a bare-bones client and the command you need to make an API call. * ```javascript @@ -61,6 +60,15 @@ export class GlobalSignOutCommand extends $Command< // Start section: command_properties // End section: command_properties + public static getEndpointParameterInstructions(): EndpointParameterInstructions { + return { + UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" }, + Endpoint: { type: "builtInParams", name: "endpoint" }, + Region: { type: "builtInParams", name: "region" }, + UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }, + }; + } + constructor(readonly input: GlobalSignOutCommandInput) { // Start section: command_constructor super(); @@ -76,6 +84,7 @@ export class GlobalSignOutCommand extends $Command< options?: __HttpHandlerOptions ): HandlerRevokes all of the access tokens generated by the specified refresh token. After the - * token is revoked, you can't use the revoked token to access Amazon Cognito authenticated - * APIs.
+ *Revokes all of the access tokens generated by, and at the same time as, the specified + * refresh token. After a token is revoked, you can't use the revoked token to access + * Amazon Cognito user APIs, or to authorize access to your resource server.
* @example * Use a bare-bones client and the command you need to make an API call. * ```javascript @@ -59,6 +60,15 @@ export class RevokeTokenCommand extends $Command< // Start section: command_properties // End section: command_properties + public static getEndpointParameterInstructions(): EndpointParameterInstructions { + return { + UseFIPS: { type: "builtInParams", name: "useFipsEndpoint" }, + Endpoint: { type: "builtInParams", name: "endpoint" }, + Region: { type: "builtInParams", name: "region" }, + UseDualStack: { type: "builtInParams", name: "useDualstackEndpoint" }, + }; + } + constructor(readonly input: RevokeTokenCommandInput) { // Start section: command_constructor super(); @@ -74,6 +84,7 @@ export class RevokeTokenCommand extends $Command< options?: __HttpHandlerOptions ): HandlerThe maximum number of authentication events to return.
+ *The maximum number of authentication events to return. Returns 60 events if you set
+ * MaxResults
to 0, or if you don't include a MaxResults
+ * parameter.
The device-remembering configuration for a user pool. A * DescribeUserPool request returns a null value for this object when the user @@ -4082,7 +4089,7 @@ export interface EmailConfigurationType { * default email limit is less than the required delivery volume. To achieve a * higher delivery volume, specify DEVELOPER to use your Amazon SES email * configuration.
- *To look up the email delivery limit for the default option, see Limits in in the Developer Guide.
+ *To look up the email delivery limit for the default option, see Limits in the Amazon Cognito Developer Guide.
*The default FROM address is no-reply@verificationemail.com
.
* To customize the FROM address, provide the Amazon Resource Name (ARN) of an
* Amazon SES verified email address for the SourceArn
@@ -4100,8 +4107,8 @@ export interface EmailConfigurationType {
*
Before Amazon Cognito can email your users, it requires additional permissions to * call Amazon SES on your behalf. When you update your user pool with this option, * Amazon Cognito creates a service-linked role, which is a type of - * role, in your Amazon Web Services account. This role contains the permissions - * that allow to access Amazon SES and send email messages with your address. For + * role in your Amazon Web Services account. This role contains the permissions + * that allow you to access Amazon SES and send email messages from your email address. For * more information about the service-linked role that Amazon Cognito creates, see * Using Service-Linked Roles for Amazon Cognito in the * Amazon Cognito Developer Guide.
@@ -4491,6 +4498,17 @@ export interface CreateUserPoolRequest { */ Policies?: UserPoolPolicyType; + /** + *When active, DeletionProtection
prevents accidental deletion of your user
+ * pool. Before you can delete a user pool that you have protected against deletion, you
+ * must deactivate this feature.
When you try to delete a protected user pool in a DeleteUserPool
API request,
+ * Amazon Cognito returns an InvalidParameterException
error. To delete a protected user pool,
+ * send a new DeleteUserPool
request after you deactivate deletion protection in an
+ * UpdateUserPool
API request.
The Lambda trigger configuration information for the new user pool.
*When active, DeletionProtection
prevents accidental deletion of your user
+ * pool. Before you can delete a user pool that you have protected against deletion, you
+ * must deactivate this feature.
When you try to delete a protected user pool in a DeleteUserPool
API request,
+ * Amazon Cognito returns an InvalidParameterException
error. To delete a protected user pool,
+ * send a new DeleteUserPool
request after you deactivate deletion protection in an
+ * UpdateUserPool
API request.
The Lambda triggers associated with the user pool.
*/ @@ -4978,6 +5007,8 @@ export interface CreateUserPoolClientRequest { * You can't setRefreshTokenValidity
to 0. If you do, Amazon Cognito overrides the
* value with the default value of 30 days. Valid range is displayed below
* in seconds.
+ * If you don't specify otherwise in the configuration of your app client, your refresh + * tokens are valid for 30 days.
*/ RefreshTokenValidity?: number; @@ -4991,6 +5022,8 @@ export interface CreateUserPoolClientRequest { * their access token for 10 hours. *The default time unit for AccessTokenValidity
in an API request is hours.
* Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your access + * tokens are valid for one hour.
*/ AccessTokenValidity?: number; @@ -5004,6 +5037,8 @@ export interface CreateUserPoolClientRequest { * session with their ID token for 10 hours. *The default time unit for AccessTokenValidity
in an API request is hours.
* Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your ID + * tokens are valid for one hour.
*/ IdTokenValidity?: number; @@ -5030,44 +5065,46 @@ export interface CreateUserPoolClientRequest { WriteAttributes?: string[]; /** - *The authentication flows that are supported by the user pool clients. Flow names
- * without the ALLOW_
prefix are no longer supported, in favor of new names
- * with the ALLOW_
prefix.
Values with ALLOW_
prefix must be used only along with the
- * ALLOW_
prefix.
Valid values include:
- *Enable admin based user password
- * authentication flow ADMIN_USER_PASSWORD_AUTH
. This setting replaces
- * the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, Amazon Cognito
- * receives the password in the request instead of using the Secure Remote Password
- * (SRP) protocol to verify passwords.
Enable Lambda trigger based authentication.
- *Enable user password-based - * authentication. In this flow, Amazon Cognito receives the password in the request instead - * of using the SRP protocol to verify passwords.
- *Enable SRP-based authentication.
- *Enable the authflow that refreshes tokens.
- *If you don't specify a value for ExplicitAuthFlows
, your user client
- * supports ALLOW_USER_SRP_AUTH
and ALLOW_CUSTOM_AUTH
.
The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in + * your users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and + * password, or a custom authentication process that you define with Lambda functions.
+ *If you don't specify a value for ExplicitAuthFlows
, your user client supports ALLOW_REFRESH_TOKEN_AUTH
, ALLOW_USER_SRP_AUTH
, and ALLOW_CUSTOM_AUTH
.
Valid values include:
+ *
+ * ALLOW_ADMIN_USER_PASSWORD_AUTH
: Enable admin based user password
+ * authentication flow ADMIN_USER_PASSWORD_AUTH
. This setting replaces
+ * the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, your app
+ * passes a user name and password to Amazon Cognito in the request, instead of using the Secure
+ * Remote Password (SRP) protocol to securely transmit the password.
+ * ALLOW_CUSTOM_AUTH
: Enable Lambda trigger based
+ * authentication.
+ * ALLOW_USER_PASSWORD_AUTH
: Enable user password-based
+ * authentication. In this flow, Amazon Cognito receives the password in the request instead
+ * of using the SRP protocol to verify passwords.
+ * ALLOW_USER_SRP_AUTH
: Enable SRP-based authentication.
+ * ALLOW_REFRESH_TOKEN_AUTH
: Enable authflow to refresh
+ * tokens.
In some environments, you will see the values ADMIN_NO_SRP_AUTH
, CUSTOM_AUTH_FLOW_ONLY
, or USER_PASSWORD_AUTH
.
+ * You can't assign these legacy ExplicitAuthFlows
values to user pool clients at the same time as values that begin with ALLOW_
,
+ * like ALLOW_USER_SRP_AUTH
.
RefreshTokenValidity
to 0. If you do, Amazon Cognito overrides the
* value with the default value of 30 days. Valid range is displayed below
* in seconds.
+ * If you don't specify otherwise in the configuration of your app client, your refresh + * tokens are valid for 30 days.
*/ RefreshTokenValidity?: number; @@ -5287,6 +5326,8 @@ export interface UserPoolClientType { * their access token for 10 hours. *The default time unit for AccessTokenValidity
in an API request is hours.
* Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your access + * tokens are valid for one hour.
*/ AccessTokenValidity?: number; @@ -5300,6 +5341,8 @@ export interface UserPoolClientType { * session with their ID token for 10 hours. *The default time unit for AccessTokenValidity
in an API request is hours.
* Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your ID + * tokens are valid for one hour.
*/ IdTokenValidity?: number; @@ -5320,41 +5363,46 @@ export interface UserPoolClientType { WriteAttributes?: string[]; /** - *The authentication flows that are supported by the user pool clients. Flow names
- * without the ALLOW_
prefix are no longer supported in favor of new names
- * with the ALLOW_
prefix. Note that values with ALLOW_
prefix
- * must be used only along with values including the ALLOW_
prefix.
Valid values include:
- *The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in + * your users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and + * password, or a custom authentication process that you define with Lambda functions.
+ *If you don't specify a value for ExplicitAuthFlows
, your user client supports ALLOW_REFRESH_TOKEN_AUTH
, ALLOW_USER_SRP_AUTH
, and ALLOW_CUSTOM_AUTH
.
Valid values include:
+ *+ *
* ALLOW_ADMIN_USER_PASSWORD_AUTH
: Enable admin based user password
- * authentication flow ADMIN_USER_PASSWORD_AUTH
. This setting replaces
- * the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, Amazon Cognito
- * receives the password in the request instead of using the Secure Remote Password
- * (SRP) protocol to verify passwords.
ADMIN_USER_PASSWORD_AUTH
. This setting replaces
+ * the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, your app
+ * passes a user name and password to Amazon Cognito in the request, instead of using the Secure
+ * Remote Password (SRP) protocol to securely transmit the password.
* + *
* ALLOW_CUSTOM_AUTH
: Enable Lambda trigger based
- * authentication.
+ *
* ALLOW_USER_PASSWORD_AUTH
: Enable user password-based
- * authentication. In this flow, Amazon Cognito receives the password in the request instead
- * of using the SRP protocol to verify passwords.
+ *
* ALLOW_USER_SRP_AUTH
: Enable SRP-based authentication.
+ *
* ALLOW_REFRESH_TOKEN_AUTH
: Enable authflow to refresh
- * tokens.
In some environments, you will see the values ADMIN_NO_SRP_AUTH
, CUSTOM_AUTH_FLOW_ONLY
, or USER_PASSWORD_AUTH
.
+ * You can't assign these legacy ExplicitAuthFlows
values to user pool clients at the same time as values that begin with ALLOW_
,
+ * like ALLOW_USER_SRP_AUTH
.
The IdP that was deleted.
+ *The identity provider details.
*/ IdentityProvider: IdentityProviderType | undefined; } @@ -6244,7 +6292,7 @@ export interface GetIdentityProviderByIdentifierRequest { export interface GetIdentityProviderByIdentifierResponse { /** - *The IdP object.
+ *The identity provider details.
*/ IdentityProvider: IdentityProviderType | undefined; } @@ -7755,7 +7803,7 @@ export interface SetUserPoolMfaConfigRequest { /** *The MFA configuration. If you set the MfaConfiguration value to ‘ON’, only users who - * have set up an MFA factor can sign in. To learn more, see Adding Multi-Factor + * have set up an MFA factor can sign in. To learn more, see Adding Multi-Factor * Authentication (MFA) to a user pool. Valid values include:
*Represents the request to register a user.
- */ -export interface SignUpRequest { - /** - *The ID of the client associated with the user pool.
- */ - ClientId: string | undefined; - - /** - *A keyed-hash message authentication code (HMAC) calculated using the secret key of a - * user pool client and username plus the client ID in the message.
- */ - SecretHash?: string; - - /** - *The user name of the user you want to register.
- */ - Username: string | undefined; - - /** - *The password of the user you want to register.
- */ - Password: string | undefined; - - /** - *An array of name-value pairs representing user attributes.
- *For custom attributes, you must prepend the custom:
prefix to the
- * attribute name.
The validation data in the request to register a user.
- */ - ValidationData?: AttributeType[]; - - /** - *The Amazon Pinpoint analytics metadata that contributes to your metrics for
- * SignUp
calls.
Contextual data about your user session, such as the device fingerprint, IP address, or location. Amazon Cognito advanced - * security evaluates the risk of an authentication event based on the context that your app generates and passes to Amazon Cognito - * when it makes API requests.
- */ - UserContextData?: UserContextDataType; - - /** - *A map of custom key-value pairs that you can provide as input for any custom workflows - * that this action triggers.
- *You create custom workflows by assigning Lambda functions to user pool triggers.
- * When you use the SignUp API action, Amazon Cognito invokes any functions that are assigned to the
- * following triggers: pre sign-up, custom
- * message, and post confirmation. When Amazon Cognito invokes
- * any of these functions, it passes a JSON payload, which the function receives as input.
- * This payload contains a clientMetadata
attribute, which provides the data
- * that you assigned to the ClientMetadata parameter in your SignUp request. In your
- * function code in Lambda, you can process the clientMetadata
value to enhance
- * your workflow for your specific needs.
For more information, see - * Customizing user pool Workflows with Lambda Triggers in the Amazon Cognito Developer Guide.
- * - *When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the - * following:
- *Store the ClientMetadata value. This data is available only to Lambda - * triggers that are assigned to a user pool to support custom workflows. If - * your user pool configuration doesn't include triggers, the ClientMetadata - * parameter serves no purpose.
- *Validate the ClientMetadata value.
- *Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive - * information.
- *Represents the request to register a user.
+ */ +export interface SignUpRequest { + /** + *The ID of the client associated with the user pool.
+ */ + ClientId: string | undefined; + + /** + *A keyed-hash message authentication code (HMAC) calculated using the secret key of a + * user pool client and username plus the client ID in the message.
+ */ + SecretHash?: string; + + /** + *The user name of the user you want to register.
+ */ + Username: string | undefined; + + /** + *The password of the user you want to register.
+ */ + Password: string | undefined; + + /** + *An array of name-value pairs representing user attributes.
+ *For custom attributes, you must prepend the custom:
prefix to the
+ * attribute name.
The validation data in the request to register a user.
+ */ + ValidationData?: AttributeType[]; + + /** + *The Amazon Pinpoint analytics metadata that contributes to your metrics for
+ * SignUp
calls.
Contextual data about your user session, such as the device fingerprint, IP address, or location. Amazon Cognito advanced + * security evaluates the risk of an authentication event based on the context that your app generates and passes to Amazon Cognito + * when it makes API requests.
+ */ + UserContextData?: UserContextDataType; + + /** + *A map of custom key-value pairs that you can provide as input for any custom workflows + * that this action triggers.
+ *You create custom workflows by assigning Lambda functions to user pool triggers.
+ * When you use the SignUp API action, Amazon Cognito invokes any functions that are assigned to the
+ * following triggers: pre sign-up, custom
+ * message, and post confirmation. When Amazon Cognito invokes
+ * any of these functions, it passes a JSON payload, which the function receives as input.
+ * This payload contains a clientMetadata
attribute, which provides the data
+ * that you assigned to the ClientMetadata parameter in your SignUp request. In your
+ * function code in Lambda, you can process the clientMetadata
value to enhance
+ * your workflow for your specific needs.
For more information, see + * Customizing user pool Workflows with Lambda Triggers in the Amazon Cognito Developer Guide.
+ * + *When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the + * following:
+ *Store the ClientMetadata value. This data is available only to Lambda + * triggers that are assigned to a user pool to support custom workflows. If + * your user pool configuration doesn't include triggers, the ClientMetadata + * parameter serves no purpose.
+ *Validate the ClientMetadata value.
+ *Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive + * information.
+ *The response from the server for a registration request.
*/ @@ -260,7 +352,7 @@ export interface UpdateIdentityProviderRequest { export interface UpdateIdentityProviderResponse { /** - *The IdP object.
+ *The identity provider details.
*/ IdentityProvider: IdentityProviderType | undefined; } @@ -380,6 +472,17 @@ export interface UpdateUserPoolRequest { */ Policies?: UserPoolPolicyType; + /** + *When active, DeletionProtection
prevents accidental deletion of your user
+ * pool. Before you can delete a user pool that you have protected against deletion, you
+ * must deactivate this feature.
When you try to delete a protected user pool in a DeleteUserPool
API request,
+ * Amazon Cognito returns an InvalidParameterException
error. To delete a protected user pool,
+ * send a new DeleteUserPool
request after you deactivate deletion protection in an
+ * UpdateUserPool
API request.
The Lambda configuration information from the request to update the user pool.
*/ @@ -538,6 +641,8 @@ export interface UpdateUserPoolClientRequest { * You can't setRefreshTokenValidity
to 0. If you do, Amazon Cognito overrides the
* value with the default value of 30 days. Valid range is displayed below
* in seconds.
+ * If you don't specify otherwise in the configuration of your app client, your refresh + * tokens are valid for 30 days.
*/ RefreshTokenValidity?: number; @@ -551,6 +656,8 @@ export interface UpdateUserPoolClientRequest { * their access token for 10 hours. *The default time unit for AccessTokenValidity
in an API request is hours.
* Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your access + * tokens are valid for one hour.
*/ AccessTokenValidity?: number; @@ -564,6 +671,8 @@ export interface UpdateUserPoolClientRequest { * session with their ID token for 10 hours. *The default time unit for AccessTokenValidity
in an API request is hours.
* Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your ID + * tokens are valid for one hour.
*/ IdTokenValidity?: number; @@ -584,41 +693,46 @@ export interface UpdateUserPoolClientRequest { WriteAttributes?: string[]; /** - *The authentication flows that are supported by the user pool clients. Flow names
- * without the ALLOW_
prefix are no longer supported in favor of new names
- * with the ALLOW_
prefix. Note that values with ALLOW_
prefix
- * must be used only along with values with the ALLOW_
prefix.
Valid values include:
- *The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in + * your users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and + * password, or a custom authentication process that you define with Lambda functions.
+ *If you don't specify a value for ExplicitAuthFlows
, your user client supports ALLOW_REFRESH_TOKEN_AUTH
, ALLOW_USER_SRP_AUTH
, and ALLOW_CUSTOM_AUTH
.
Valid values include:
+ *+ *
* ALLOW_ADMIN_USER_PASSWORD_AUTH
: Enable admin based user password
- * authentication flow ADMIN_USER_PASSWORD_AUTH
. This setting replaces
- * the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, Amazon Cognito
- * receives the password in the request instead of using the Secure Remote Password
- * (SRP) protocol to verify passwords.
ADMIN_USER_PASSWORD_AUTH
. This setting replaces
+ * the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, your app
+ * passes a user name and password to Amazon Cognito in the request, instead of using the Secure
+ * Remote Password (SRP) protocol to securely transmit the password.
* + *
* ALLOW_CUSTOM_AUTH
: Enable Lambda trigger based
- * authentication.
+ *
* ALLOW_USER_PASSWORD_AUTH
: Enable user password-based
- * authentication. In this flow, Amazon Cognito receives the password in the request instead
- * of using the SRP protocol to verify passwords.
+ *
* ALLOW_USER_SRP_AUTH
: Enable SRP-based authentication.
+ *
* ALLOW_REFRESH_TOKEN_AUTH
: Enable authflow to refresh
- * tokens.
In some environments, you will see the values ADMIN_NO_SRP_AUTH
, CUSTOM_AUTH_FLOW_ONLY
, or USER_PASSWORD_AUTH
.
+ * You can't assign these legacy ExplicitAuthFlows
values to user pool clients at the same time as values that begin with ALLOW_
,
+ * like ALLOW_USER_SRP_AUTH
.
Using the Amazon Cognito user pools API, you can create a user pool to manage directories and\n users. You can authenticate a user to obtain tokens related to user identity and access\n policies.
\nThis API reference provides information about user pools in Amazon Cognito user pools.
\nFor more information, see the Amazon Cognito\n Documentation.
", - "smithy.api#title": "Amazon Cognito Identity Provider", - "smithy.api#xmlNamespace": { - "uri": "http://cognito-idp.amazonaws.com/doc/2016-04-18/" - } - }, "version": "2016-04-18", "operations": [ { @@ -357,12 +339,1427 @@ { "target": "com.amazonaws.cognitoidentityprovider#VerifyUserAttribute" } - ] + ], + "traits": { + "aws.api#service": { + "sdkId": "Cognito Identity Provider", + "arnNamespace": "cognito-idp", + "cloudFormationName": "Cognito", + "cloudTrailEventSource": "cognitoidentityprovider.amazonaws.com", + "endpointPrefix": "cognito-idp" + }, + "aws.auth#sigv4": { + "name": "cognito-idp" + }, + "aws.protocols#awsJson1_1": {}, + "smithy.api#documentation": "Using the Amazon Cognito user pools API, you can create a user pool to manage directories and\n users. You can authenticate a user to obtain tokens related to user identity and access\n policies.
\nThis API reference provides information about user pools in Amazon Cognito user pools.
\nFor more information, see the Amazon Cognito\n Documentation.
", + "smithy.api#title": "Amazon Cognito Identity Provider", + "smithy.api#xmlNamespace": { + "uri": "http://cognito-idp.amazonaws.com/doc/2016-04-18/" + }, + "smithy.rules#endpointRuleSet": { + "version": "1.0", + "parameters": { + "Region": { + "builtIn": "AWS::Region", + "required": false, + "documentation": "The AWS region used to dispatch the request.", + "type": "String" + }, + "UseDualStack": { + "builtIn": "AWS::UseDualStack", + "required": true, + "default": false, + "documentation": "When true, use the dual-stack endpoint. If the configured endpoint does not support dual-stack, dispatching the request MAY return an error.", + "type": "Boolean" + }, + "UseFIPS": { + "builtIn": "AWS::UseFIPS", + "required": true, + "default": false, + "documentation": "When true, send this request to the FIPS-compliant regional endpoint. If the configured endpoint does not have a FIPS compliant endpoint, dispatching the request will return an error.", + "type": "Boolean" + }, + "Endpoint": { + "builtIn": "SDK::Endpoint", + "required": false, + "documentation": "Override the endpoint used to send this request", + "type": "String" + } + }, + "rules": [ + { + "conditions": [ + { + "fn": "aws.partition", + "argv": [ + { + "ref": "Region" + } + ], + "assign": "PartitionResult" + } + ], + "type": "tree", + "rules": [ + { + "conditions": [ + { + "fn": "isSet", + "argv": [ + { + "ref": "Endpoint" + } + ] + }, + { + "fn": "parseURL", + "argv": [ + { + "ref": "Endpoint" + } + ], + "assign": "url" + } + ], + "type": "tree", + "rules": [ + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + { + "ref": "UseFIPS" + }, + true + ] + } + ], + "error": "Invalid Configuration: FIPS and custom endpoint are not supported", + "type": "error" + }, + { + "conditions": [], + "type": "tree", + "rules": [ + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + { + "ref": "UseDualStack" + }, + true + ] + } + ], + "error": "Invalid Configuration: Dualstack and custom endpoint are not supported", + "type": "error" + }, + { + "conditions": [], + "endpoint": { + "url": { + "ref": "Endpoint" + }, + "properties": {}, + "headers": {} + }, + "type": "endpoint" + } + ] + } + ] + }, + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + { + "ref": "UseFIPS" + }, + true + ] + }, + { + "fn": "booleanEquals", + "argv": [ + { + "ref": "UseDualStack" + }, + true + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + true, + { + "fn": "getAttr", + "argv": [ + { + "ref": "PartitionResult" + }, + "supportsFIPS" + ] + } + ] + }, + { + "fn": "booleanEquals", + "argv": [ + true, + { + "fn": "getAttr", + "argv": [ + { + "ref": "PartitionResult" + }, + "supportsDualStack" + ] + } + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [], + "endpoint": { + "url": "https://cognito-idp-fips.{Region}.{PartitionResult#dualStackDnsSuffix}", + "properties": {}, + "headers": {} + }, + "type": "endpoint" + } + ] + }, + { + "conditions": [], + "error": "FIPS and DualStack are enabled, but this partition does not support one or both", + "type": "error" + } + ] + }, + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + { + "ref": "UseFIPS" + }, + true + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + true, + { + "fn": "getAttr", + "argv": [ + { + "ref": "PartitionResult" + }, + "supportsFIPS" + ] + } + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [], + "type": "tree", + "rules": [ + { + "conditions": [], + "endpoint": { + "url": "https://cognito-idp-fips.{Region}.{PartitionResult#dnsSuffix}", + "properties": {}, + "headers": {} + }, + "type": "endpoint" + } + ] + } + ] + }, + { + "conditions": [], + "error": "FIPS is enabled but this partition does not support FIPS", + "type": "error" + } + ] + }, + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + { + "ref": "UseDualStack" + }, + true + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [ + { + "fn": "booleanEquals", + "argv": [ + true, + { + "fn": "getAttr", + "argv": [ + { + "ref": "PartitionResult" + }, + "supportsDualStack" + ] + } + ] + } + ], + "type": "tree", + "rules": [ + { + "conditions": [], + "endpoint": { + "url": "https://cognito-idp.{Region}.{PartitionResult#dualStackDnsSuffix}", + "properties": {}, + "headers": {} + }, + "type": "endpoint" + } + ] + }, + { + "conditions": [], + "error": "DualStack is enabled but this partition does not support DualStack", + "type": "error" + } + ] + }, + { + "conditions": [], + "endpoint": { + "url": "https://cognito-idp.{Region}.{PartitionResult#dnsSuffix}", + "properties": {}, + "headers": {} + }, + "type": "endpoint" + } + ] + } + ] + }, + "smithy.rules#endpointTests": { + "testCases": [ + { + "documentation": "For region ap-south-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-south-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-south-1", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-south-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-south-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-south-1", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-south-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-south-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-south-1", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-south-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-south-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-south-1", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-south-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-south-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-south-1", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-south-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-south-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-south-1", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-south-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-south-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-south-1", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-south-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-south-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-south-1", + "UseDualStack": false + } + }, + { + "documentation": "For region ca-central-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ca-central-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "ca-central-1", + "UseDualStack": true + } + }, + { + "documentation": "For region ca-central-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ca-central-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "ca-central-1", + "UseDualStack": false + } + }, + { + "documentation": "For region ca-central-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ca-central-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "ca-central-1", + "UseDualStack": true + } + }, + { + "documentation": "For region ca-central-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ca-central-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "ca-central-1", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-central-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-central-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-central-1", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-central-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-central-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-central-1", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-central-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-central-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-central-1", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-central-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-central-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-central-1", + "UseDualStack": false + } + }, + { + "documentation": "For region us-west-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.us-west-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "us-west-1", + "UseDualStack": true + } + }, + { + "documentation": "For region us-west-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.us-west-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "us-west-1", + "UseDualStack": false + } + }, + { + "documentation": "For region us-west-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.us-west-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-west-1", + "UseDualStack": true + } + }, + { + "documentation": "For region us-west-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.us-west-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-west-1", + "UseDualStack": false + } + }, + { + "documentation": "For region us-west-2 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.us-west-2.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "us-west-2", + "UseDualStack": true + } + }, + { + "documentation": "For region us-west-2 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.us-west-2.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "us-west-2", + "UseDualStack": false + } + }, + { + "documentation": "For region us-west-2 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.us-west-2.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-west-2", + "UseDualStack": true + } + }, + { + "documentation": "For region us-west-2 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.us-west-2.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-west-2", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-north-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-north-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-north-1", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-north-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-north-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-north-1", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-north-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-north-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-north-1", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-north-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-north-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-north-1", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-west-3 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-west-3.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-west-3", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-west-3 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-west-3.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-west-3", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-west-3 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-west-3.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-west-3", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-west-3 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-west-3.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-west-3", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-west-2 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-west-2.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-west-2", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-west-2 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-west-2.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-west-2", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-west-2 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-west-2.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-west-2", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-west-2 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-west-2.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-west-2", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-west-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-west-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-west-1", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-west-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.eu-west-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "eu-west-1", + "UseDualStack": false + } + }, + { + "documentation": "For region eu-west-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-west-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-west-1", + "UseDualStack": true + } + }, + { + "documentation": "For region eu-west-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.eu-west-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "eu-west-1", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-northeast-2 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-northeast-2.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-northeast-2", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-northeast-2 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-northeast-2.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-northeast-2", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-northeast-2 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-northeast-2.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-northeast-2", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-northeast-2 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-northeast-2.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-northeast-2", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-northeast-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-northeast-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-northeast-1", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-northeast-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-northeast-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-northeast-1", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-northeast-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-northeast-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-northeast-1", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-northeast-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-northeast-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-northeast-1", + "UseDualStack": false + } + }, + { + "documentation": "For region me-south-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.me-south-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "me-south-1", + "UseDualStack": true + } + }, + { + "documentation": "For region me-south-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.me-south-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "me-south-1", + "UseDualStack": false + } + }, + { + "documentation": "For region me-south-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.me-south-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "me-south-1", + "UseDualStack": true + } + }, + { + "documentation": "For region me-south-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.me-south-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "me-south-1", + "UseDualStack": false + } + }, + { + "documentation": "For region sa-east-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.sa-east-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "sa-east-1", + "UseDualStack": true + } + }, + { + "documentation": "For region sa-east-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.sa-east-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "sa-east-1", + "UseDualStack": false + } + }, + { + "documentation": "For region sa-east-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.sa-east-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "sa-east-1", + "UseDualStack": true + } + }, + { + "documentation": "For region sa-east-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.sa-east-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "sa-east-1", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-east-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-east-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-east-1", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-east-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-east-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-east-1", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-east-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-east-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-east-1", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-east-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-east-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-east-1", + "UseDualStack": false + } + }, + { + "documentation": "For region us-gov-west-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.us-gov-west-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "us-gov-west-1", + "UseDualStack": true + } + }, + { + "documentation": "For region us-gov-west-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.us-gov-west-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "us-gov-west-1", + "UseDualStack": false + } + }, + { + "documentation": "For region us-gov-west-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.us-gov-west-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-gov-west-1", + "UseDualStack": true + } + }, + { + "documentation": "For region us-gov-west-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.us-gov-west-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-gov-west-1", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-southeast-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-southeast-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-southeast-1", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-southeast-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-southeast-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-southeast-1", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-southeast-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-southeast-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-southeast-1", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-southeast-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-southeast-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-southeast-1", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-southeast-2 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-southeast-2.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-southeast-2", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-southeast-2 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.ap-southeast-2.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "ap-southeast-2", + "UseDualStack": false + } + }, + { + "documentation": "For region ap-southeast-2 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-southeast-2.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-southeast-2", + "UseDualStack": true + } + }, + { + "documentation": "For region ap-southeast-2 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.ap-southeast-2.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "ap-southeast-2", + "UseDualStack": false + } + }, + { + "documentation": "For region us-east-1 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.us-east-1.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "us-east-1", + "UseDualStack": true + } + }, + { + "documentation": "For region us-east-1 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.us-east-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "us-east-1", + "UseDualStack": false + } + }, + { + "documentation": "For region us-east-1 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.us-east-1.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-east-1", + "UseDualStack": true + } + }, + { + "documentation": "For region us-east-1 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.us-east-1.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-east-1", + "UseDualStack": false + } + }, + { + "documentation": "For region us-east-2 with FIPS enabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.us-east-2.api.aws" + } + }, + "params": { + "UseFIPS": true, + "Region": "us-east-2", + "UseDualStack": true + } + }, + { + "documentation": "For region us-east-2 with FIPS enabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp-fips.us-east-2.amazonaws.com" + } + }, + "params": { + "UseFIPS": true, + "Region": "us-east-2", + "UseDualStack": false + } + }, + { + "documentation": "For region us-east-2 with FIPS disabled and DualStack enabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.us-east-2.api.aws" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-east-2", + "UseDualStack": true + } + }, + { + "documentation": "For region us-east-2 with FIPS disabled and DualStack disabled", + "expect": { + "endpoint": { + "url": "https://cognito-idp.us-east-2.amazonaws.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-east-2", + "UseDualStack": false + } + }, + { + "documentation": "For custom endpoint with fips disabled and dualstack disabled", + "expect": { + "endpoint": { + "url": "https://example.com" + } + }, + "params": { + "UseFIPS": false, + "Region": "us-east-1", + "UseDualStack": false, + "Endpoint": "https://example.com" + } + }, + { + "documentation": "For custom endpoint with fips enabled and dualstack disabled", + "expect": { + "error": "Invalid Configuration: FIPS and custom endpoint are not supported" + }, + "params": { + "UseFIPS": true, + "Region": "us-east-1", + "UseDualStack": false, + "Endpoint": "https://example.com" + } + }, + { + "documentation": "For custom endpoint with fips disabled and dualstack enabled", + "expect": { + "error": "Invalid Configuration: Dualstack and custom endpoint are not supported" + }, + "params": { + "UseFIPS": false, + "Region": "us-east-1", + "UseDualStack": true, + "Endpoint": "https://example.com" + } + } + ], + "version": "1.0" + } + } }, "com.amazonaws.cognitoidentityprovider#AccessTokenValidityType": { "type": "integer", "traits": { - "smithy.api#box": {}, "smithy.api#range": { "min": 1, "max": 86400 @@ -384,7 +1781,10 @@ } }, "com.amazonaws.cognitoidentityprovider#AccountTakeoverActionNotifyType": { - "type": "boolean" + "type": "boolean", + "traits": { + "smithy.api#default": false + } }, "com.amazonaws.cognitoidentityprovider#AccountTakeoverActionType": { "type": "structure", @@ -392,6 +1792,7 @@ "Notify": { "target": "com.amazonaws.cognitoidentityprovider#AccountTakeoverActionNotifyType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "Flag specifying whether to send a notification.
", "smithy.api#required": {} } @@ -435,26 +1836,32 @@ } }, "com.amazonaws.cognitoidentityprovider#AccountTakeoverEventActionType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "BLOCK", - "name": "BLOCK" - }, - { - "value": "MFA_IF_CONFIGURED", - "name": "MFA_IF_CONFIGURED" - }, - { - "value": "MFA_REQUIRED", - "name": "MFA_REQUIRED" - }, - { - "value": "NO_ACTION", - "name": "NO_ACTION" + "type": "enum", + "members": { + "BLOCK": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "BLOCK" + } + }, + "MFA_IF_CONFIGURED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "MFA_IF_CONFIGURED" + } + }, + "MFA_REQUIRED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "MFA_REQUIRED" + } + }, + "NO_ACTION": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "NO_ACTION" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#AccountTakeoverRiskConfigurationType": { @@ -747,12 +2154,14 @@ "AllowAdminCreateUserOnly": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "Set to True
if only the administrator is allowed to create user profiles.\n Set to False
if users can sign themselves up via an app.
The user account expiration limit, in days, after which a new account that hasn't\n signed in is no longer usable. To reset the account after that time limit, you must call\n AdminCreateUser
again, specifying \"RESEND\"
for the\n MessageAction
parameter. The default value for this parameter is 7.
If you set a value for TemporaryPasswordValidityDays
in\n PasswordPolicy
, that value will be used, and\n UnusedAccountValidityDays
will be no longer be an available\n parameter for that user pool.
This parameter is used only if the phone_number_verified
or\n email_verified
attribute is set to True
. Otherwise, it is\n ignored.
If this parameter is set to True
and the phone number or email address\n specified in the UserAttributes parameter already exists as an alias with a different\n user, the API call will migrate the alias from the previous user to the newly created\n user. The previous user will no longer be able to log in using that alias.
If this parameter is set to False
, the API throws an\n AliasExistsException
error if the alias already exists. The default\n value is False
.
Disables the specified user.
\nCalling this action requires developer credentials.
" + "smithy.api#documentation": "Deactivates a user and revokes all access tokens for the user. A deactivated user can't sign in, \n but still appears in the responses to GetUser
and ListUsers
API requests.
You must make this API request with Amazon Web Services credentials that have cognito-idp:AdminDisableUser
permissions.
Indicates that the status is enabled
.
The maximum number of authentication events to return.
" + "smithy.api#documentation": "The maximum number of authentication events to return. Returns 60 events if you set\n MaxResults
to 0, or if you don't include a MaxResults
\n parameter.
\n True
if the password is permanent, False
if it is\n temporary.
If UserDataShared
is true
, Amazon Cognito includes user data in the\n events that it publishes to Amazon Pinpoint analytics.
The expiration period of the authentication result in seconds.
" } }, @@ -3175,7 +4615,10 @@ } }, "com.amazonaws.cognitoidentityprovider#BooleanType": { - "type": "boolean" + "type": "boolean", + "traits": { + "smithy.api#default": false + } }, "com.amazonaws.cognitoidentityprovider#CSSType": { "type": "string" @@ -3196,65 +4639,85 @@ } }, "com.amazonaws.cognitoidentityprovider#ChallengeName": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "Password", - "name": "Password" - }, - { - "value": "Mfa", - "name": "Mfa" + "type": "enum", + "members": { + "Password": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Password" + } + }, + "Mfa": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Mfa" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#ChallengeNameType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "SMS_MFA", - "name": "SMS_MFA" - }, - { - "value": "SOFTWARE_TOKEN_MFA", - "name": "SOFTWARE_TOKEN_MFA" - }, - { - "value": "SELECT_MFA_TYPE", - "name": "SELECT_MFA_TYPE" - }, - { - "value": "MFA_SETUP", - "name": "MFA_SETUP" - }, - { - "value": "PASSWORD_VERIFIER", - "name": "PASSWORD_VERIFIER" - }, - { - "value": "CUSTOM_CHALLENGE", - "name": "CUSTOM_CHALLENGE" - }, - { - "value": "DEVICE_SRP_AUTH", - "name": "DEVICE_SRP_AUTH" - }, - { - "value": "DEVICE_PASSWORD_VERIFIER", - "name": "DEVICE_PASSWORD_VERIFIER" - }, - { - "value": "ADMIN_NO_SRP_AUTH", - "name": "ADMIN_NO_SRP_AUTH" - }, - { - "value": "NEW_PASSWORD_REQUIRED", - "name": "NEW_PASSWORD_REQUIRED" + "type": "enum", + "members": { + "SMS_MFA": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "SMS_MFA" + } + }, + "SOFTWARE_TOKEN_MFA": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "SOFTWARE_TOKEN_MFA" + } + }, + "SELECT_MFA_TYPE": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "SELECT_MFA_TYPE" + } + }, + "MFA_SETUP": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "MFA_SETUP" + } + }, + "PASSWORD_VERIFIER": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "PASSWORD_VERIFIER" + } + }, + "CUSTOM_CHALLENGE": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "CUSTOM_CHALLENGE" } - ] + }, + "DEVICE_SRP_AUTH": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "DEVICE_SRP_AUTH" + } + }, + "DEVICE_PASSWORD_VERIFIER": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "DEVICE_PASSWORD_VERIFIER" + } + }, + "ADMIN_NO_SRP_AUTH": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "ADMIN_NO_SRP_AUTH" + } + }, + "NEW_PASSWORD_REQUIRED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "NEW_PASSWORD_REQUIRED" + } + } } }, "com.amazonaws.cognitoidentityprovider#ChallengeParametersType": { @@ -3267,18 +4730,20 @@ } }, "com.amazonaws.cognitoidentityprovider#ChallengeResponse": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "Success", - "name": "Success" - }, - { - "value": "Failure", - "name": "Failure" + "type": "enum", + "members": { + "Success": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Success" + } + }, + "Failure": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Failure" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#ChallengeResponseListType": { @@ -3547,18 +5012,20 @@ } }, "com.amazonaws.cognitoidentityprovider#CompromisedCredentialsEventActionType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "BLOCK", - "name": "BLOCK" - }, - { - "value": "NO_ACTION", - "name": "NO_ACTION" + "type": "enum", + "members": { + "BLOCK": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "BLOCK" + } + }, + "NO_ACTION": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "NO_ACTION" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#CompromisedCredentialsRiskConfigurationType": { @@ -3691,6 +5158,7 @@ "UserConfirmationNecessary": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "Indicates whether the user confirmation must confirm the device response.
" } } @@ -3924,6 +5392,7 @@ "ForceAliasCreation": { "target": "com.amazonaws.cognitoidentityprovider#ForceAliasCreation", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "Boolean to be specified to force user confirmation irrespective of existing alias. By\n default set to False
. If this parameter is set to True
and the\n phone number/email used for sign up confirmation already exists as an alias with a\n different user, the API call will migrate the alias from the previous user to the newly\n created user being confirmed. If set to False
, the API will throw an\n AliasExistsException error.
Boolean to specify whether you want to generate a secret for the user pool client\n being created.
" } }, "RefreshTokenValidity": { "target": "com.amazonaws.cognitoidentityprovider#RefreshTokenValidityType", "traits": { - "smithy.api#documentation": "The refresh token time limit. After this limit expires, your user can't use \n their refresh token. To specify the time unit for RefreshTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set RefreshTokenValidity
as 10
and\n TokenValidityUnits
as days
, your user can refresh their session\n and retrieve new access and ID tokens for 10 days.
The default time unit for RefreshTokenValidity
in an API request is days. \n You can't set RefreshTokenValidity
to 0. If you do, Amazon Cognito overrides the \n value with the default value of 30 days. Valid range is displayed below \n in seconds.
The refresh token time limit. After this limit expires, your user can't use \n their refresh token. To specify the time unit for RefreshTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set RefreshTokenValidity
as 10
and\n TokenValidityUnits
as days
, your user can refresh their session\n and retrieve new access and ID tokens for 10 days.
The default time unit for RefreshTokenValidity
in an API request is days. \n You can't set RefreshTokenValidity
to 0. If you do, Amazon Cognito overrides the \n value with the default value of 30 days. Valid range is displayed below \n in seconds.
If you don't specify otherwise in the configuration of your app client, your refresh\n tokens are valid for 30 days.
" } }, "AccessTokenValidity": { "target": "com.amazonaws.cognitoidentityprovider#AccessTokenValidityType", "traits": { - "smithy.api#documentation": "The access token time limit. After this limit expires, your user can't use \n their access token. To specify the time unit for AccessTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set AccessTokenValidity
to 10
and\n TokenValidityUnits
to hours
, your user can authorize access with\n their access token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
The access token time limit. After this limit expires, your user can't use \n their access token. To specify the time unit for AccessTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set AccessTokenValidity
to 10
and\n TokenValidityUnits
to hours
, your user can authorize access with\n their access token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your access\n tokens are valid for one hour.
" } }, "IdTokenValidity": { "target": "com.amazonaws.cognitoidentityprovider#IdTokenValidityType", "traits": { - "smithy.api#documentation": "The ID token time limit. After this limit expires, your user can't use \n their ID token. To specify the time unit for IdTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set IdTokenValidity
as 10
and\n TokenValidityUnits
as hours
, your user can authenticate their \n session with their ID token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
The ID token time limit. After this limit expires, your user can't use \n their ID token. To specify the time unit for IdTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set IdTokenValidity
as 10
and\n TokenValidityUnits
as hours
, your user can authenticate their \n session with their ID token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your ID\n tokens are valid for one hour.
" } }, "TokenValidityUnits": { @@ -4479,7 +5950,7 @@ "ExplicitAuthFlows": { "target": "com.amazonaws.cognitoidentityprovider#ExplicitAuthFlowsListType", "traits": { - "smithy.api#documentation": "The authentication flows that are supported by the user pool clients. Flow names\n without the ALLOW_
prefix are no longer supported, in favor of new names\n with the ALLOW_
prefix.
Values with ALLOW_
prefix must be used only along with the\n ALLOW_
prefix.
Valid values include:
\nEnable admin based user password\n authentication flow ADMIN_USER_PASSWORD_AUTH
. This setting replaces\n the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, Amazon Cognito\n receives the password in the request instead of using the Secure Remote Password\n (SRP) protocol to verify passwords.
Enable Lambda trigger based authentication.
\nEnable user password-based\n authentication. In this flow, Amazon Cognito receives the password in the request instead\n of using the SRP protocol to verify passwords.
\nEnable SRP-based authentication.
\nEnable the authflow that refreshes tokens.
\nIf you don't specify a value for ExplicitAuthFlows
, your user client\n supports ALLOW_USER_SRP_AUTH
and ALLOW_CUSTOM_AUTH
.
The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in \nyour users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and \npassword, or a custom authentication process that you define with Lambda functions.
\nIf you don't specify a value for ExplicitAuthFlows
, your user client supports ALLOW_REFRESH_TOKEN_AUTH
, ALLOW_USER_SRP_AUTH
, and ALLOW_CUSTOM_AUTH
.
Valid values include:
\n\n ALLOW_ADMIN_USER_PASSWORD_AUTH
: Enable admin based user password\n authentication flow ADMIN_USER_PASSWORD_AUTH
. This setting replaces\n the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, your app\n passes a user name and password to Amazon Cognito in the request, instead of using the Secure \n Remote Password (SRP) protocol to securely transmit the password.
\n ALLOW_CUSTOM_AUTH
: Enable Lambda trigger based\n authentication.
\n ALLOW_USER_PASSWORD_AUTH
: Enable user password-based\n authentication. In this flow, Amazon Cognito receives the password in the request instead\n of using the SRP protocol to verify passwords.
\n ALLOW_USER_SRP_AUTH
: Enable SRP-based authentication.
\n ALLOW_REFRESH_TOKEN_AUTH
: Enable authflow to refresh\n tokens.
In some environments, you will see the values ADMIN_NO_SRP_AUTH
, CUSTOM_AUTH_FLOW_ONLY
, or USER_PASSWORD_AUTH
. \nYou can't assign these legacy ExplicitAuthFlows
values to user pool clients at the same time as values that begin with ALLOW_
,\nlike ALLOW_USER_SRP_AUTH
.
Set to true if the client is allowed to follow the OAuth protocol when interacting\n with Amazon Cognito user pools.
" } }, @@ -4654,6 +6126,12 @@ "smithy.api#documentation": "The policies associated with the new user pool.
" } }, + "DeletionProtection": { + "target": "com.amazonaws.cognitoidentityprovider#DeletionProtectionType", + "traits": { + "smithy.api#documentation": "When active, DeletionProtection
prevents accidental deletion of your user\n pool. Before you can delete a user pool that you have protected against deletion, you\n must deactivate this feature.
When you try to delete a protected user pool in a DeleteUserPool
API request, \n Amazon Cognito returns an InvalidParameterException
error. To delete a protected user pool, \n send a new DeleteUserPool
request after you deactivate deletion protection in an \n UpdateUserPool
API request.
Represents the request to delete a user.
" } }, + "com.amazonaws.cognitoidentityprovider#DeletionProtectionType": { + "type": "enum", + "members": { + "ACTIVE": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "ACTIVE" + } + }, + "INACTIVE": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "INACTIVE" + } + } + } + }, "com.amazonaws.cognitoidentityprovider#DeliveryMediumListType": { "type": "list", "member": { @@ -5345,18 +6848,20 @@ } }, "com.amazonaws.cognitoidentityprovider#DeliveryMediumType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "SMS", - "name": "SMS" - }, - { - "value": "EMAIL", - "name": "EMAIL" + "type": "enum", + "members": { + "SMS": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "SMS" + } + }, + "EMAIL": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "EMAIL" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#DescribeIdentityProvider": { @@ -5413,7 +6918,7 @@ "IdentityProvider": { "target": "com.amazonaws.cognitoidentityprovider#IdentityProviderType", "traits": { - "smithy.api#documentation": "The IdP that was deleted.
", + "smithy.api#documentation": "The identity provider details.
", "smithy.api#required": {} } } @@ -5796,12 +7301,14 @@ "ChallengeRequiredOnNewDevice": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "When true, a remembered device can sign in with device authentication instead of SMS\n and time-based one-time password (TOTP) factors for multi-factor authentication\n (MFA).
\nWhether or not ChallengeRequiredOnNewDevice
is true, users who sign in\n with devices that have not been confirmed or remembered must still provide a second\n factor in a user pool that requires MFA.
When true, Amazon Cognito doesn't automatically remember a user's device when your app sends a\n \n ConfirmDevice API request. In your app, create a prompt for\n your user to choose whether they want to remember their device. Return the user's choice\n in an \n UpdateDeviceStatus API request.
\nWhen DeviceOnlyRememberedOnUserPrompt
is false
, Amazon\n Cognito immediately remembers devices that you register in a ConfirmDevice
\n API request.
Specifies whether Amazon Cognito uses its built-in functionality to send your users email\n messages, or uses your Amazon Simple Email Service email configuration. Specify one of the following\n values:
\nWhen Amazon Cognito emails your users, it uses its built-in email functionality.\n When you use the default option, Amazon Cognito allows only a limited number of\n emails each day for your user pool. For typical production environments, the\n default email limit is less than the required delivery volume. To achieve a\n higher delivery volume, specify DEVELOPER to use your Amazon SES email\n configuration.
\nTo look up the email delivery limit for the default option, see Limits in in the Developer Guide.
\nThe default FROM address is no-reply@verificationemail.com
.\n To customize the FROM address, provide the Amazon Resource Name (ARN) of an\n Amazon SES verified email address for the SourceArn
\n parameter.
When Amazon Cognito emails your users, it uses your Amazon SES configuration. Amazon Cognito\n calls Amazon SES on your behalf to send email from your verified email address.\n When you use this option, the email delivery limits are the same limits that\n apply to your Amazon SES verified email address in your Amazon Web Services account.
\nIf you use this option, provide the ARN of an Amazon SES verified email address\n for the SourceArn
parameter.
Before Amazon Cognito can email your users, it requires additional permissions to\n call Amazon SES on your behalf. When you update your user pool with this option,\n Amazon Cognito creates a service-linked role, which is a type of\n role, in your Amazon Web Services account. This role contains the permissions\n that allow to access Amazon SES and send email messages with your address. For\n more information about the service-linked role that Amazon Cognito creates, see\n Using Service-Linked Roles for Amazon Cognito in the\n Amazon Cognito Developer Guide.
\nSpecifies whether Amazon Cognito uses its built-in functionality to send your users email\n messages, or uses your Amazon Simple Email Service email configuration. Specify one of the following\n values:
\nWhen Amazon Cognito emails your users, it uses its built-in email functionality.\n When you use the default option, Amazon Cognito allows only a limited number of\n emails each day for your user pool. For typical production environments, the\n default email limit is less than the required delivery volume. To achieve a\n higher delivery volume, specify DEVELOPER to use your Amazon SES email\n configuration.
\nTo look up the email delivery limit for the default option, see Limits in the Amazon Cognito Developer Guide.
\nThe default FROM address is no-reply@verificationemail.com
.\n To customize the FROM address, provide the Amazon Resource Name (ARN) of an\n Amazon SES verified email address for the SourceArn
\n parameter.
When Amazon Cognito emails your users, it uses your Amazon SES configuration. Amazon Cognito\n calls Amazon SES on your behalf to send email from your verified email address.\n When you use this option, the email delivery limits are the same limits that\n apply to your Amazon SES verified email address in your Amazon Web Services account.
\nIf you use this option, provide the ARN of an Amazon SES verified email address\n for the SourceArn
parameter.
Before Amazon Cognito can email your users, it requires additional permissions to\n call Amazon SES on your behalf. When you update your user pool with this option,\n Amazon Cognito creates a service-linked role, which is a type of\n role in your Amazon Web Services account. This role contains the permissions\n that allow you to access Amazon SES and send email messages from your email address. For\n more information about the service-linked role that Amazon Cognito creates, see\n Using Service-Linked Roles for Amazon Cognito in the\n Amazon Cognito Developer Guide.
\nThe IdP object.
", + "smithy.api#documentation": "The identity provider details.
", "smithy.api#required": {} } } @@ -6895,7 +8452,7 @@ } ], "traits": { - "smithy.api#documentation": "This method takes a user pool ID, and returns the signing certificate.
" + "smithy.api#documentation": "This method takes a user pool ID, and returns the signing certificate. The issued certificate is valid for 10 years from the date of issue.
\nAmazon Cognito issues and assigns a new signing certificate annually. This process returns a new value in the response to GetSigningCertificate
, \n but doesn't invalidate the original certificate.
Signs out users from all devices. It also invalidates all refresh tokens that Amazon Cognito\n has issued to a user. The user's current access and ID tokens remain valid until their\n expiry. By default, access and ID tokens expire one hour after Amazon Cognito issues them. A user\n can still use a hosted UI cookie to retrieve new tokens for the duration of the cookie\n validity period of 1 hour.
" + "smithy.api#documentation": "Signs out users from all devices. It also invalidates all refresh tokens that Amazon Cognito\n has issued to a user. A user can still use a hosted UI cookie to retrieve new tokens \n for the duration of the 1-hour cookie validity period.
" } }, "com.amazonaws.cognitoidentityprovider#GlobalSignOutRequest": { @@ -7431,7 +8988,6 @@ "com.amazonaws.cognitoidentityprovider#IdTokenValidityType": { "type": "integer", "traits": { - "smithy.api#box": {}, "smithy.api#range": { "min": 1, "max": 86400 @@ -7495,34 +9051,44 @@ } }, "com.amazonaws.cognitoidentityprovider#IdentityProviderTypeType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "SAML", - "name": "SAML" - }, - { - "value": "Facebook", - "name": "Facebook" - }, - { - "value": "Google", - "name": "Google" - }, - { - "value": "LoginWithAmazon", - "name": "LoginWithAmazon" - }, - { - "value": "SignInWithApple", - "name": "SignInWithApple" - }, - { - "value": "OIDC", - "name": "OIDC" + "type": "enum", + "members": { + "SAML": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "SAML" + } + }, + "Facebook": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Facebook" + } + }, + "Google": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Google" + } + }, + "LoginWithAmazon": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "LoginWithAmazon" } - ] + }, + "SignInWithApple": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "SignInWithApple" + } + }, + "OIDC": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "OIDC" + } + } } }, "com.amazonaws.cognitoidentityprovider#IdpIdentifierType": { @@ -7693,7 +9259,10 @@ } }, "com.amazonaws.cognitoidentityprovider#IntegerType": { - "type": "integer" + "type": "integer", + "traits": { + "smithy.api#default": 0 + } }, "com.amazonaws.cognitoidentityprovider#InternalErrorException": { "type": "structure", @@ -8190,7 +9759,6 @@ "com.amazonaws.cognitoidentityprovider#ListProvidersLimitType": { "type": "integer", "traits": { - "smithy.api#box": {}, "smithy.api#range": { "min": 0, "max": 60 @@ -8235,6 +9803,7 @@ "com.amazonaws.cognitoidentityprovider#ListResourceServersLimitType": { "type": "integer", "traits": { + "smithy.api#default": 0, "smithy.api#range": { "min": 1, "max": 50 @@ -8254,6 +9823,7 @@ "MaxResults": { "target": "com.amazonaws.cognitoidentityprovider#ListResourceServersLimitType", "traits": { + "smithy.api#default": 0, "smithy.api#documentation": "The maximum number of resource servers to return.
" } }, @@ -8377,6 +9947,7 @@ "MaxResults": { "target": "com.amazonaws.cognitoidentityprovider#PoolQueryLimitType", "traits": { + "smithy.api#default": 0, "smithy.api#documentation": "The maximum number of import jobs you want the request to return.
", "smithy.api#required": {} } @@ -8460,6 +10031,7 @@ "MaxResults": { "target": "com.amazonaws.cognitoidentityprovider#QueryLimit", "traits": { + "smithy.api#default": 0, "smithy.api#documentation": "The maximum number of results you want the request to return when listing the user\n pool clients.
" } }, @@ -8538,6 +10110,7 @@ "MaxResults": { "target": "com.amazonaws.cognitoidentityprovider#PoolQueryLimitType", "traits": { + "smithy.api#default": 0, "smithy.api#documentation": "The maximum number of results you want the request to return when listing the user\n pools.
", "smithy.api#required": {} } @@ -8757,7 +10330,10 @@ } }, "com.amazonaws.cognitoidentityprovider#LongType": { - "type": "long" + "type": "long", + "traits": { + "smithy.api#default": 0 + } }, "com.amazonaws.cognitoidentityprovider#MFAMethodNotFoundException": { "type": "structure", @@ -8802,18 +10378,20 @@ } }, "com.amazonaws.cognitoidentityprovider#MessageActionType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "RESEND", - "name": "RESEND" - }, - { - "value": "SUPPRESS", - "name": "SUPPRESS" + "type": "enum", + "members": { + "RESEND": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "RESEND" + } + }, + "SUPPRESS": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "SUPPRESS" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#MessageTemplateType": { @@ -8974,22 +10552,26 @@ } }, "com.amazonaws.cognitoidentityprovider#OAuthFlowType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "code", - "name": "code" - }, - { - "value": "implicit", - "name": "implicit" - }, - { - "value": "client_credentials", - "name": "client_credentials" + "type": "enum", + "members": { + "code": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "code" + } + }, + "implicit": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "implicit" + } + }, + "client_credentials": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "client_credentials" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#OAuthFlowsType": { @@ -9025,6 +10607,7 @@ "com.amazonaws.cognitoidentityprovider#PasswordPolicyMinLengthType": { "type": "integer", "traits": { + "smithy.api#default": 0, "smithy.api#range": { "min": 6, "max": 99 @@ -9037,36 +10620,42 @@ "MinimumLength": { "target": "com.amazonaws.cognitoidentityprovider#PasswordPolicyMinLengthType", "traits": { + "smithy.api#default": 0, "smithy.api#documentation": "The minimum length of the password in the policy that you have set. This value can't\n be less than 6.
" } }, "RequireUppercase": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "In the password policy that you have set, refers to whether you have required users to\n use at least one uppercase letter in their password.
" } }, "RequireLowercase": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "In the password policy that you have set, refers to whether you have required users to\n use at least one lowercase letter in their password.
" } }, "RequireNumbers": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "In the password policy that you have set, refers to whether you have required users to\n use at least one number in their password.
" } }, "RequireSymbols": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "In the password policy that you have set, refers to whether you have required users to\n use at least one symbol in their password.
" } }, "TemporaryPasswordValidityDays": { "target": "com.amazonaws.cognitoidentityprovider#TemporaryPasswordValidityDaysType", "traits": { + "smithy.api#default": 0, "smithy.api#documentation": "The number of days a temporary password is valid in the password policy. If the user\n doesn't sign in during this time, an administrator must reset their password.
\nWhen you set TemporaryPasswordValidityDays
for a user pool, you can\n no longer set a value for the legacy UnusedAccountValidityDays
\n parameter in that user pool.
A positive integer specifying priority of a method with 1 being the highest\n priority.
", "smithy.api#required": {} } @@ -9353,6 +10950,7 @@ "com.amazonaws.cognitoidentityprovider#RefreshTokenValidityType": { "type": "integer", "traits": { + "smithy.api#default": 0, "smithy.api#range": { "min": 0, "max": 315360000 @@ -9811,7 +11409,7 @@ } ], "traits": { - "smithy.api#documentation": "Revokes all of the access tokens generated by the specified refresh token. After the\n token is revoked, you can't use the revoked token to access Amazon Cognito authenticated\n APIs.
" + "smithy.api#documentation": "Revokes all of the access tokens generated by, and at the same time as, the specified \n refresh token. After a token is revoked, you can't use the revoked token to access \n Amazon Cognito user APIs, or to authorize access to your resource server.
" } }, "com.amazonaws.cognitoidentityprovider#RevokeTokenRequest": { @@ -9888,22 +11486,26 @@ } }, "com.amazonaws.cognitoidentityprovider#RiskDecisionType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "NoRisk", - "name": "NoRisk" - }, - { - "value": "AccountTakeover", - "name": "AccountTakeover" - }, - { - "value": "Block", - "name": "Block" + "type": "enum", + "members": { + "NoRisk": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "NoRisk" + } + }, + "AccountTakeover": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "AccountTakeover" + } + }, + "Block": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Block" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#RiskExceptionConfigurationType": { @@ -9927,22 +11529,26 @@ } }, "com.amazonaws.cognitoidentityprovider#RiskLevelType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "Low", - "name": "Low" - }, - { - "value": "Medium", - "name": "Medium" - }, - { - "value": "High", - "name": "High" + "type": "enum", + "members": { + "Low": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Low" + } + }, + "Medium": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Medium" + } + }, + "High": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "High" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#S3BucketType": { @@ -9971,12 +11577,14 @@ "Enabled": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "Specifies whether SMS text message MFA is activated. If an MFA type is activated for a\n user, the user will be prompted for MFA during all sign-in attempts, unless device\n tracking is turned on and the device has been trusted.
" } }, "PreferredMfa": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "Specifies whether SMS is the preferred MFA method.
" } } @@ -10003,21 +11611,21 @@ "DeveloperOnlyAttribute": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { - "smithy.api#box": {}, + "smithy.api#default": null, "smithy.api#documentation": "You should use WriteAttributes in the user pool client to control how attributes can\n be mutated for new use cases instead of using\n DeveloperOnlyAttribute
.
Specifies whether the attribute type is developer only. This attribute can only be\n modified by an administrator. Users won't be able to modify this attribute using their\n access token. For example, DeveloperOnlyAttribute
can be modified using\n AdminUpdateUserAttributes but can't be updated using UpdateUserAttributes.
Specifies whether the value of the attribute can be changed.
\nFor any user pool attribute that is mapped to an IdP attribute, you must set this\n parameter to true
. Amazon Cognito updates mapped attributes when users sign in to\n your application through an IdP. If an attribute is immutable, Amazon Cognito throws an error\n when it attempts to update the attribute. For more information, see Specifying Identity Provider Attribute Mappings for Your User\n Pool.
Specifies whether a user pool attribute is required. If the attribute is required and\n the user doesn't provide a value, registration or sign-in will fail.
" } }, @@ -10413,7 +12021,7 @@ "MfaConfiguration": { "target": "com.amazonaws.cognitoidentityprovider#UserPoolMfaType", "traits": { - "smithy.api#documentation": "The MFA configuration. If you set the MfaConfiguration value to ‘ON’, only users who\n have set up an MFA factor can sign in. To learn more, see Adding Multi-Factor\n Authentication (MFA) to a user pool. Valid values include:
\n\n OFF
MFA won't be used for any users.
\n ON
MFA is required for all users to sign in.
\n OPTIONAL
MFA will be required only for individual users who have\n an MFA factor activated.
The MFA configuration. If you set the MfaConfiguration value to ‘ON’, only users who\n have set up an MFA factor can sign in. To learn more, see Adding Multi-Factor\n Authentication (MFA) to a user pool. Valid values include:
\n\n OFF
MFA won't be used for any users.
\n ON
MFA is required for all users to sign in.
\n OPTIONAL
MFA will be required only for individual users who have\n an MFA factor activated.
A response from the server indicating that a user registration has been\n confirmed.
", "smithy.api#required": {} } @@ -10762,6 +12371,7 @@ "Enabled": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "Specifies whether software token MFA is activated.
" } } @@ -10776,12 +12386,14 @@ "Enabled": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "Specifies whether software token MFA is activated. If an MFA type is activated for a\n user, the user will be prompted for MFA during all sign-in attempts, unless device\n tracking is turned on and the device has been trusted.
" } }, "PreferredMfa": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "Specifies whether software token MFA is the preferred MFA method.
" } } @@ -10859,18 +12471,20 @@ } }, "com.amazonaws.cognitoidentityprovider#StatusType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "Enabled", - "name": "Enabled" - }, - { - "value": "Disabled", - "name": "Disabled" + "type": "enum", + "members": { + "Enabled": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Enabled" } - ] + }, + "Disabled": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "Disabled" + } + } } }, "com.amazonaws.cognitoidentityprovider#StopUserImportJob": { @@ -11043,6 +12657,7 @@ "com.amazonaws.cognitoidentityprovider#TemporaryPasswordValidityDaysType": { "type": "integer", "traits": { + "smithy.api#default": 0, "smithy.api#range": { "min": 0, "max": 365 @@ -11050,26 +12665,32 @@ } }, "com.amazonaws.cognitoidentityprovider#TimeUnitsType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "seconds", - "name": "SECONDS" - }, - { - "value": "minutes", - "name": "MINUTES" - }, - { - "value": "hours", - "name": "HOURS" - }, - { - "value": "days", - "name": "DAYS" + "type": "enum", + "members": { + "SECONDS": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "seconds" + } + }, + "MINUTES": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "minutes" + } + }, + "HOURS": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "hours" + } + }, + "DAYS": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "days" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#TokenModelType": { @@ -11567,6 +13188,9 @@ "target": "com.amazonaws.cognitoidentityprovider#UpdateIdentityProviderResponse" }, "errors": [ + { + "target": "com.amazonaws.cognitoidentityprovider#ConcurrentModificationException" + }, { "target": "com.amazonaws.cognitoidentityprovider#InternalErrorException" }, @@ -11633,7 +13257,7 @@ "IdentityProvider": { "target": "com.amazonaws.cognitoidentityprovider#IdentityProviderType", "traits": { - "smithy.api#documentation": "The IdP object.
", + "smithy.api#documentation": "The identity provider details.
", "smithy.api#required": {} } } @@ -11938,19 +13562,20 @@ "RefreshTokenValidity": { "target": "com.amazonaws.cognitoidentityprovider#RefreshTokenValidityType", "traits": { - "smithy.api#documentation": "The refresh token time limit. After this limit expires, your user can't use \n their refresh token. To specify the time unit for RefreshTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set RefreshTokenValidity
as 10
and\n TokenValidityUnits
as days
, your user can refresh their session\n and retrieve new access and ID tokens for 10 days.
The default time unit for RefreshTokenValidity
in an API request is days. \n You can't set RefreshTokenValidity
to 0. If you do, Amazon Cognito overrides the \n value with the default value of 30 days. Valid range is displayed below \n in seconds.
The refresh token time limit. After this limit expires, your user can't use \n their refresh token. To specify the time unit for RefreshTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set RefreshTokenValidity
as 10
and\n TokenValidityUnits
as days
, your user can refresh their session\n and retrieve new access and ID tokens for 10 days.
The default time unit for RefreshTokenValidity
in an API request is days. \n You can't set RefreshTokenValidity
to 0. If you do, Amazon Cognito overrides the \n value with the default value of 30 days. Valid range is displayed below \n in seconds.
If you don't specify otherwise in the configuration of your app client, your refresh\n tokens are valid for 30 days.
" } }, "AccessTokenValidity": { "target": "com.amazonaws.cognitoidentityprovider#AccessTokenValidityType", "traits": { - "smithy.api#documentation": "The access token time limit. After this limit expires, your user can't use \n their access token. To specify the time unit for AccessTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set AccessTokenValidity
to 10
and\n TokenValidityUnits
to hours
, your user can authorize access with\n their access token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
The access token time limit. After this limit expires, your user can't use \n their access token. To specify the time unit for AccessTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set AccessTokenValidity
to 10
and\n TokenValidityUnits
to hours
, your user can authorize access with\n their access token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your access\n tokens are valid for one hour.
" } }, "IdTokenValidity": { "target": "com.amazonaws.cognitoidentityprovider#IdTokenValidityType", "traits": { - "smithy.api#documentation": "The ID token time limit. After this limit expires, your user can't use \n their ID token. To specify the time unit for IdTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set IdTokenValidity
as 10
and\n TokenValidityUnits
as hours
, your user can authenticate their \n session with their ID token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
The ID token time limit. After this limit expires, your user can't use \n their ID token. To specify the time unit for IdTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set IdTokenValidity
as 10
and\n TokenValidityUnits
as hours
, your user can authenticate their \n session with their ID token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your ID\n tokens are valid for one hour.
" } }, "TokenValidityUnits": { @@ -11974,7 +13599,7 @@ "ExplicitAuthFlows": { "target": "com.amazonaws.cognitoidentityprovider#ExplicitAuthFlowsListType", "traits": { - "smithy.api#documentation": "The authentication flows that are supported by the user pool clients. Flow names\n without the ALLOW_
prefix are no longer supported in favor of new names\n with the ALLOW_
prefix. Note that values with ALLOW_
prefix\n must be used only along with values with the ALLOW_
prefix.
Valid values include:
\n\n ALLOW_ADMIN_USER_PASSWORD_AUTH
: Enable admin based user password\n authentication flow ADMIN_USER_PASSWORD_AUTH
. This setting replaces\n the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, Amazon Cognito\n receives the password in the request instead of using the Secure Remote Password\n (SRP) protocol to verify passwords.
\n ALLOW_CUSTOM_AUTH
: Enable Lambda trigger based\n authentication.
\n ALLOW_USER_PASSWORD_AUTH
: Enable user password-based\n authentication. In this flow, Amazon Cognito receives the password in the request instead\n of using the SRP protocol to verify passwords.
\n ALLOW_USER_SRP_AUTH
: Enable SRP-based authentication.
\n ALLOW_REFRESH_TOKEN_AUTH
: Enable authflow to refresh\n tokens.
The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in \nyour users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and \npassword, or a custom authentication process that you define with Lambda functions.
\nIf you don't specify a value for ExplicitAuthFlows
, your user client supports ALLOW_REFRESH_TOKEN_AUTH
, ALLOW_USER_SRP_AUTH
, and ALLOW_CUSTOM_AUTH
.
Valid values include:
\n\n ALLOW_ADMIN_USER_PASSWORD_AUTH
: Enable admin based user password\n authentication flow ADMIN_USER_PASSWORD_AUTH
. This setting replaces\n the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, your app\n passes a user name and password to Amazon Cognito in the request, instead of using the Secure \n Remote Password (SRP) protocol to securely transmit the password.
\n ALLOW_CUSTOM_AUTH
: Enable Lambda trigger based\n authentication.
\n ALLOW_USER_PASSWORD_AUTH
: Enable user password-based\n authentication. In this flow, Amazon Cognito receives the password in the request instead\n of using the SRP protocol to verify passwords.
\n ALLOW_USER_SRP_AUTH
: Enable SRP-based authentication.
\n ALLOW_REFRESH_TOKEN_AUTH
: Enable authflow to refresh\n tokens.
In some environments, you will see the values ADMIN_NO_SRP_AUTH
, CUSTOM_AUTH_FLOW_ONLY
, or USER_PASSWORD_AUTH
. \nYou can't assign these legacy ExplicitAuthFlows
values to user pool clients at the same time as values that begin with ALLOW_
,\nlike ALLOW_USER_SRP_AUTH
.
Set to true if the client is allowed to follow the OAuth protocol when interacting\n with Amazon Cognito user pools.
" } }, @@ -12156,6 +13782,12 @@ "smithy.api#documentation": "A container with the policies you want to update in a user pool.
" } }, + "DeletionProtection": { + "target": "com.amazonaws.cognitoidentityprovider#DeletionProtectionType", + "traits": { + "smithy.api#documentation": "When active, DeletionProtection
prevents accidental deletion of your user\n pool. Before you can delete a user pool that you have protected against deletion, you\n must deactivate this feature.
When you try to delete a protected user pool in a DeleteUserPool
API request, \n Amazon Cognito returns an InvalidParameterException
error. To delete a protected user pool, \n send a new DeleteUserPool
request after you deactivate deletion protection in an \n UpdateUserPool
API request.
The number of users that were successfully imported.
" } }, "SkippedUsers": { "target": "com.amazonaws.cognitoidentityprovider#LongType", "traits": { + "smithy.api#default": 0, "smithy.api#documentation": "The number of users that were skipped.
" } }, "FailedUsers": { "target": "com.amazonaws.cognitoidentityprovider#LongType", "traits": { + "smithy.api#default": 0, "smithy.api#documentation": "The number of users that couldn't be imported.
" } }, @@ -12636,19 +14285,20 @@ "RefreshTokenValidity": { "target": "com.amazonaws.cognitoidentityprovider#RefreshTokenValidityType", "traits": { - "smithy.api#documentation": "The refresh token time limit. After this limit expires, your user can't use \n their refresh token. To specify the time unit for RefreshTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set RefreshTokenValidity
as 10
and\n TokenValidityUnits
as days
, your user can refresh their session\n and retrieve new access and ID tokens for 10 days.
The default time unit for RefreshTokenValidity
in an API request is days. \n You can't set RefreshTokenValidity
to 0. If you do, Amazon Cognito overrides the \n value with the default value of 30 days. Valid range is displayed below \n in seconds.
The refresh token time limit. After this limit expires, your user can't use \n their refresh token. To specify the time unit for RefreshTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set RefreshTokenValidity
as 10
and\n TokenValidityUnits
as days
, your user can refresh their session\n and retrieve new access and ID tokens for 10 days.
The default time unit for RefreshTokenValidity
in an API request is days. \n You can't set RefreshTokenValidity
to 0. If you do, Amazon Cognito overrides the \n value with the default value of 30 days. Valid range is displayed below \n in seconds.
If you don't specify otherwise in the configuration of your app client, your refresh\n tokens are valid for 30 days.
" } }, "AccessTokenValidity": { "target": "com.amazonaws.cognitoidentityprovider#AccessTokenValidityType", "traits": { - "smithy.api#documentation": "The access token time limit. After this limit expires, your user can't use \n their access token. To specify the time unit for AccessTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set AccessTokenValidity
to 10
and\n TokenValidityUnits
to hours
, your user can authorize access with\n their access token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
The access token time limit. After this limit expires, your user can't use \n their access token. To specify the time unit for AccessTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set AccessTokenValidity
to 10
and\n TokenValidityUnits
to hours
, your user can authorize access with\n their access token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your access\n tokens are valid for one hour.
" } }, "IdTokenValidity": { "target": "com.amazonaws.cognitoidentityprovider#IdTokenValidityType", "traits": { - "smithy.api#documentation": "The ID token time limit. After this limit expires, your user can't use \n their ID token. To specify the time unit for IdTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set IdTokenValidity
as 10
and\n TokenValidityUnits
as hours
, your user can authenticate their \n session with their ID token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
The ID token time limit. After this limit expires, your user can't use \n their ID token. To specify the time unit for IdTokenValidity
as \n seconds
, minutes
, hours
, or days
, \n set a TokenValidityUnits
value in your API request.
For example, when you set IdTokenValidity
as 10
and\n TokenValidityUnits
as hours
, your user can authenticate their \n session with their ID token for 10 hours.
The default time unit for AccessTokenValidity
in an API request is hours. \n Valid range is displayed below in seconds.
If you don't specify otherwise in the configuration of your app client, your ID\n tokens are valid for one hour.
" } }, "TokenValidityUnits": { @@ -12672,7 +14322,7 @@ "ExplicitAuthFlows": { "target": "com.amazonaws.cognitoidentityprovider#ExplicitAuthFlowsListType", "traits": { - "smithy.api#documentation": "The authentication flows that are supported by the user pool clients. Flow names\n without the ALLOW_
prefix are no longer supported in favor of new names\n with the ALLOW_
prefix. Note that values with ALLOW_
prefix\n must be used only along with values including the ALLOW_
prefix.
Valid values include:
\n\n ALLOW_ADMIN_USER_PASSWORD_AUTH
: Enable admin based user password\n authentication flow ADMIN_USER_PASSWORD_AUTH
. This setting replaces\n the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, Amazon Cognito\n receives the password in the request instead of using the Secure Remote Password\n (SRP) protocol to verify passwords.
\n ALLOW_CUSTOM_AUTH
: Enable Lambda trigger based\n authentication.
\n ALLOW_USER_PASSWORD_AUTH
: Enable user password-based\n authentication. In this flow, Amazon Cognito receives the password in the request instead\n of using the SRP protocol to verify passwords.
\n ALLOW_USER_SRP_AUTH
: Enable SRP-based authentication.
\n ALLOW_REFRESH_TOKEN_AUTH
: Enable authflow to refresh\n tokens.
The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in \nyour users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and \npassword, or a custom authentication process that you define with Lambda functions.
\nIf you don't specify a value for ExplicitAuthFlows
, your user client supports ALLOW_REFRESH_TOKEN_AUTH
, ALLOW_USER_SRP_AUTH
, and ALLOW_CUSTOM_AUTH
.
Valid values include:
\n\n ALLOW_ADMIN_USER_PASSWORD_AUTH
: Enable admin based user password\n authentication flow ADMIN_USER_PASSWORD_AUTH
. This setting replaces\n the ADMIN_NO_SRP_AUTH
setting. With this authentication flow, your app\n passes a user name and password to Amazon Cognito in the request, instead of using the Secure \n Remote Password (SRP) protocol to securely transmit the password.
\n ALLOW_CUSTOM_AUTH
: Enable Lambda trigger based\n authentication.
\n ALLOW_USER_PASSWORD_AUTH
: Enable user password-based\n authentication. In this flow, Amazon Cognito receives the password in the request instead\n of using the SRP protocol to verify passwords.
\n ALLOW_USER_SRP_AUTH
: Enable SRP-based authentication.
\n ALLOW_REFRESH_TOKEN_AUTH
: Enable authflow to refresh\n tokens.
In some environments, you will see the values ADMIN_NO_SRP_AUTH
, CUSTOM_AUTH_FLOW_ONLY
, or USER_PASSWORD_AUTH
. \nYou can't assign these legacy ExplicitAuthFlows
values to user pool clients at the same time as values that begin with ALLOW_
,\nlike ALLOW_USER_SRP_AUTH
.
Set to true if the client is allowed to follow the OAuth protocol when interacting\n with Amazon Cognito user pools.
" } }, @@ -12814,22 +14464,26 @@ } }, "com.amazonaws.cognitoidentityprovider#UserPoolMfaType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "OFF", - "name": "OFF" - }, - { - "value": "ON", - "name": "ON" - }, - { - "value": "OPTIONAL", - "name": "OPTIONAL" + "type": "enum", + "members": { + "OFF": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "OFF" + } + }, + "ON": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "ON" + } + }, + "OPTIONAL": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "OPTIONAL" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#UserPoolNameType": { @@ -12905,6 +14559,12 @@ "smithy.api#documentation": "The policies associated with the user pool.
" } }, + "DeletionProtection": { + "target": "com.amazonaws.cognitoidentityprovider#DeletionProtectionType", + "traits": { + "smithy.api#documentation": "When active, DeletionProtection
prevents accidental deletion of your user\n pool. Before you can delete a user pool that you have protected against deletion, you\n must deactivate this feature.
When you try to delete a protected user pool in a DeleteUserPool
API request, \n Amazon Cognito returns an InvalidParameterException
error. To delete a protected user pool, \n send a new DeleteUserPool
request after you deactivate deletion protection in an \n UpdateUserPool
API request.
A number estimating the size of the user pool.
" } }, @@ -13085,38 +14746,50 @@ } }, "com.amazonaws.cognitoidentityprovider#UserStatusType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "UNCONFIRMED", - "name": "UNCONFIRMED" - }, - { - "value": "CONFIRMED", - "name": "CONFIRMED" - }, - { - "value": "ARCHIVED", - "name": "ARCHIVED" - }, - { - "value": "COMPROMISED", - "name": "COMPROMISED" - }, - { - "value": "UNKNOWN", - "name": "UNKNOWN" - }, - { - "value": "RESET_REQUIRED", - "name": "RESET_REQUIRED" - }, - { - "value": "FORCE_CHANGE_PASSWORD", - "name": "FORCE_CHANGE_PASSWORD" + "type": "enum", + "members": { + "UNCONFIRMED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "UNCONFIRMED" + } + }, + "CONFIRMED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "CONFIRMED" + } + }, + "ARCHIVED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "ARCHIVED" + } + }, + "COMPROMISED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "COMPROMISED" + } + }, + "UNKNOWN": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "UNKNOWN" + } + }, + "RESET_REQUIRED": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "RESET_REQUIRED" + } + }, + "FORCE_CHANGE_PASSWORD": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "FORCE_CHANGE_PASSWORD" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#UserType": { @@ -13149,6 +14822,7 @@ "Enabled": { "target": "com.amazonaws.cognitoidentityprovider#BooleanType", "traits": { + "smithy.api#default": false, "smithy.api#documentation": "Specifies whether the user is enabled.
" } }, @@ -13170,18 +14844,20 @@ } }, "com.amazonaws.cognitoidentityprovider#UsernameAttributeType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "phone_number", - "name": "PHONE_NUMBER" - }, - { - "value": "email", - "name": "EMAIL" + "type": "enum", + "members": { + "PHONE_NUMBER": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "phone_number" + } + }, + "EMAIL": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "email" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#UsernameAttributesListType": { @@ -13283,18 +14959,20 @@ } }, "com.amazonaws.cognitoidentityprovider#VerifiedAttributeType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "phone_number", - "name": "PHONE_NUMBER" - }, - { - "value": "email", - "name": "EMAIL" + "type": "enum", + "members": { + "PHONE_NUMBER": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "phone_number" + } + }, + "EMAIL": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "email" } - ] + } } }, "com.amazonaws.cognitoidentityprovider#VerifiedAttributesListType": { @@ -13404,18 +15082,20 @@ } }, "com.amazonaws.cognitoidentityprovider#VerifySoftwareTokenResponseType": { - "type": "string", - "traits": { - "smithy.api#enum": [ - { - "value": "SUCCESS", - "name": "SUCCESS" - }, - { - "value": "ERROR", - "name": "ERROR" + "type": "enum", + "members": { + "SUCCESS": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "SUCCESS" } - ] + }, + "ERROR": { + "target": "smithy.api#Unit", + "traits": { + "smithy.api#enumValue": "ERROR" + } + } } }, "com.amazonaws.cognitoidentityprovider#VerifyUserAttribute": { @@ -13510,10 +15190,7 @@ } }, "com.amazonaws.cognitoidentityprovider#WrappedBooleanType": { - "type": "boolean", - "traits": { - "smithy.api#box": {} - } + "type": "boolean" } } }