aws-sdk-cognitoidentityprovider 1.149.0 → 1.151.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 596a7ce8aa6cd1e63718f70d3e9760e382113bfc5a0a384c59ee90b4a54f400d
-  data.tar.gz: cc937a7321ff09b987ea70b47b0e9ba2e853141238ba481ea1298c6a434d0e89
+  metadata.gz: '0782fc580517572f1ed5f75d94d233eedf24f386ec72f769bc42576877e8def3'
+  data.tar.gz: 8a34fa2ebbd9c840b5108d75f70e6968d88e837a9f705d5f748a367bc088cf77
 SHA512:
-  metadata.gz: 0a33ebb69d6441e6a61e0564f670e834792d19baf3305305a18d97d45c280d8138a35a3ab2ba04d836b395162a0697870ef323842f50a5db7dd3e18d548c73d7
-  data.tar.gz: 3b66ac29709c631addae7649fc7872460dbc0eacc7e02064a2763b34ae59cab2f7ae25bdf19a98972167da8df734f432dda4bcf8205e3b24d88d5f09787c4309
+  metadata.gz: 272b7102f4c3190658db9876e156467142bb387aa1906078f8830da83eae79af284d590005b57e50f25d7349e37881763db8e84b0f8d45324f955f4fe1027288
+  data.tar.gz: 336c40fda42f6acab013d6b3ffa0eb509d67ed3e1e98f696ffc3f69eb6f54a69d08f4f0238b56723baa1fb1d99f49f73769ebd5b35275df31adeb33e9bb97fd7

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.151.0 (2026-08-28)
+------------------
+
+* Feature - Adds two new operations - GetClientToken which allows M2M auth through the SDK, and DescribeTermsByClient to find which Terms are associated with a user-pool client without knowing the Terms resource id.
+
+1.150.0 (2026-08-27)
+------------------
+
+* Feature - Adds the AdminDeleteSoftwareToken API operation, enabling administrators to remove a user's registered TOTP (software token) MFA configuration from a user pool.
+
 1.149.0 (2026-07-24)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.149.0
+1.151.0

data/lib/aws-sdk-cognitoidentityprovider/client.rb

@@ -1113,6 +1113,61 @@ module Aws::CognitoIdentityProvider
       req.send_request(options)
     end
 
+    # Deletes a user's registered time-based one-time password (TOTP)
+    # multi-factor authentication (MFA) factor, also known as a software
+    # token. After this operation, the user can no longer sign in with TOTP
+    # MFA, and can register a new TOTP factor with `AssociateSoftwareToken`.
+    # Use this operation when a user loses access to their TOTP-generating
+    # device, for example, a lost or reset phone, and needs to register a
+    # new one.
+    #
+    # <note markdown="1"> Amazon Cognito evaluates Identity and Access Management (IAM) policies
+    # in requests for this API operation. For this operation, you must use
+    # IAM credentials to authorize requests, and you must grant yourself the
+    # corresponding IAM permission in a policy.
+    #
+    #  **Learn more**
+    #
+    #  * [Signing Amazon Web Services API Requests][1]
+    #
+    # * [Using the Amazon Cognito user pools API and user pool endpoints][2]
+    #
+    #  </note>
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-signing.html
+    # [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html
+    #
+    # @option params [required, String] :user_pool_id
+    #   The ID of the user pool where you want to delete the user's software
+    #   token.
+    #
+    # @option params [required, String] :username
+    #   The name of the user that you want to query or modify. The value of
+    #   this parameter is typically your user's username, but it can be any
+    #   of their alias attributes. If `username` isn't an alias attribute in
+    #   your user pool, this value must be the `sub` of a local user or the
+    #   username of a user from a third-party IdP.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.admin_delete_software_token({
+    #     user_pool_id: "UserPoolIdType", # required
+    #     username: "UsernameType", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/AdminDeleteSoftwareToken AWS API Documentation
+    #
+    # @overload admin_delete_software_token(params = {})
+    # @param [Hash] params ({})
+    def admin_delete_software_token(params = {}, options = {})
+      req = build_request(:admin_delete_software_token, params)
+      req.send_request(options)
+    end
+
     # Deletes a user profile in your user pool.
     #
     # <note markdown="1"> Amazon Cognito evaluates Identity and Access Management (IAM) policies
@@ -2027,10 +2082,6 @@ module Aws::CognitoIdentityProvider
     #   The `ProviderName` should be set to `Cognito` for users in Cognito
     #   user pools.
     #
-    #   All attributes in the DestinationUser profile must be mutable. If you
-    #   have assigned the user any immutable custom attributes, the operation
-    #   won't succeed.
-    #
     # @option params [required, Types::ProviderUserIdentifierType] :source_user
     #   An external IdP account for a user who doesn't exist yet in the user
     #   pool. This user must be a federated user (for example, a SAML or
@@ -7583,6 +7634,80 @@ module Aws::CognitoIdentityProvider
       req.send_request(options)
     end
 
+    # Returns details for the terms documents that are associated with an
+    # app client, identified by the app client ID, user pool ID, and terms
+    # name. For more information, see [Terms documents][1].
+    #
+    # To call `DescribeTermsByClient`, you must have the
+    # `cognito-idp:DescribeTermsByClient` Identity and Access Management
+    # (IAM) permission. This operation additionally validates your
+    # permission for `cognito-idp:DescribeTerms`, the action for . As a
+    # result, an IAM policy that denies `cognito-idp:DescribeTerms` also
+    # denies requests to `DescribeTermsByClient`.
+    #
+    # <note markdown="1"> Amazon Cognito evaluates Identity and Access Management (IAM) policies
+    # in requests for this API operation. For this operation, you must use
+    # IAM credentials to authorize requests, and you must grant yourself the
+    # corresponding IAM permission in a policy.
+    #
+    #  **Learn more**
+    #
+    #  * [Signing Amazon Web Services API Requests][2]
+    #
+    # * [Using the Amazon Cognito user pools API and user pool endpoints][3]
+    #
+    #  </note>
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managed-login.html#managed-login-terms-documents
+    # [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-signing.html
+    # [3]: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html
+    #
+    # @option params [required, String] :client_id
+    #   The ID of the app client that the terms documents are associated with.
+    #
+    # @option params [required, String] :user_pool_id
+    #   The ID of the user pool that contains the terms documents that you
+    #   want to describe.
+    #
+    # @option params [required, String] :terms_name
+    #   The name of the terms documents that you want to describe.
+    #
+    # @return [Types::DescribeTermsByClientResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::DescribeTermsByClientResponse#terms #terms} => Types::TermsType
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.describe_terms_by_client({
+    #     client_id: "ClientIdType", # required
+    #     user_pool_id: "UserPoolIdType", # required
+    #     terms_name: "TermsNameType", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.terms.terms_id #=> String
+    #   resp.terms.user_pool_id #=> String
+    #   resp.terms.client_id #=> String
+    #   resp.terms.terms_name #=> String
+    #   resp.terms.terms_source #=> String, one of "LINK"
+    #   resp.terms.enforcement #=> String, one of "NONE"
+    #   resp.terms.links #=> Hash
+    #   resp.terms.links["LanguageIdType"] #=> String
+    #   resp.terms.creation_date #=> Time
+    #   resp.terms.last_modified_date #=> Time
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/DescribeTermsByClient AWS API Documentation
+    #
+    # @overload describe_terms_by_client(params = {})
+    # @param [Hash] params ({})
+    def describe_terms_by_client(params = {}, options = {})
+      req = build_request(:describe_terms_by_client, params)
+      req.send_request(options)
+    end
+
     # Describes a user import job. For more information about user CSV
     # import, see [Importing users from a CSV file][1].
     #
@@ -7881,6 +8006,14 @@ module Aws::CognitoIdentityProvider
     # Given a user pool domain name, returns information about the domain
     # configuration.
     #
+    # <note markdown="1"> This operation doesn't return results when you query a prefix domain
+    # in a secondary Region. Prefix domains are Region-specific and can only
+    # be described in the Region where they were created. To describe a
+    # prefix domain for a replica user pool, make the request to the primary
+    # Region's endpoint.
+    #
+    #  </note>
+    #
     # <note markdown="1"> Amazon Cognito evaluates Identity and Access Management (IAM) policies
     # in requests for this API operation. For this operation, you must use
     # IAM credentials to authorize requests, and you must grant yourself the
@@ -8203,6 +8336,137 @@ module Aws::CognitoIdentityProvider
       req.send_request(options)
     end
 
+    # Issues an access token for machine-to-machine (M2M) authorization.
+    # Your app client provides its client ID and secret, and receives an
+    # access token that authorizes requests to your resource servers.
+    # `GetClientToken` provides the same functionality as the OAuth2
+    # client-credentials grant; both authorize an application rather than a
+    # user.
+    #
+    # To use this operation, you must configure the app client with a client
+    # secret and enable the `ALLOW_CLIENT_TOKEN_AUTH` authentication flow.
+    # The `ALLOW_CLIENT_TOKEN_AUTH` flow is mutually exclusive with user
+    # authentication flows. It must be the only authentication flow that you
+    # configure for the app client. For more information, see [Scopes, M2M,
+    # and resource servers][1].
+    #
+    # <note markdown="1"> Amazon Cognito doesn't evaluate Identity and Access Management (IAM)
+    # policies in requests for this API operation. For this operation, you
+    # can't use IAM credentials to authorize requests, and you can't grant
+    # IAM permissions in policies. For more information about authorization
+    # models in Amazon Cognito, see [Using the Amazon Cognito user pools API
+    # and user pool endpoints][2].
+    #
+    #  </note>
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-define-resource-servers.html
+    # [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pools-API-operations.html
+    #
+    # @option params [required, String] :client_id
+    #   The ID of the app client that requests the access token. The app
+    #   client must have a client secret and the `ALLOW_CLIENT_TOKEN_AUTH`
+    #   authentication flow.
+    #
+    # @option params [required, String] :secret
+    #   An active secret for the app client.
+    #
+    # @option params [Array<String>] :scopes
+    #   The custom scopes to authorize in the access token, in the format
+    #   `resource-server-identifier/scope-name`. Each scope must belong to a
+    #   resource server in your user pool. If you don't specify any scopes,
+    #   Amazon Cognito authorizes the scopes that are configured for the app
+    #   client.
+    #
+    # @option params [Hash<String,String>] :client_metadata
+    #   A map of custom key-value pairs that you can provide as input for any
+    #   custom workflows that this action triggers. You create custom
+    #   workflows by assigning Lambda functions to user pool triggers.
+    #
+    #   When Amazon Cognito invokes any of these functions, it passes a JSON
+    #   payload, which the function receives as input. This payload contains a
+    #   `clientMetadata` attribute that provides the data that you assigned to
+    #   the ClientMetadata parameter in your request. In your function code,
+    #   you can process the `clientMetadata` value to enhance your workflow
+    #   for your specific needs.
+    #
+    #   To review the Lambda trigger types that Amazon Cognito invokes at
+    #   runtime with API requests, see [ Connecting API actions to Lambda
+    #   triggers][1] in the *Amazon Cognito Developer Guide*.
+    #
+    #   <note markdown="1"> When you use the `ClientMetadata` parameter, note that Amazon Cognito
+    #   won't do the following:
+    #
+    #    * Store the `ClientMetadata` value. This data is available only to
+    #     Lambda triggers that are assigned to a user pool to support custom
+    #     workflows. If your user pool configuration doesn't include
+    #     triggers, the `ClientMetadata` parameter serves no purpose.
+    #
+    #   * Validate the `ClientMetadata` value.
+    #
+    #   * Encrypt the `ClientMetadata` value. Don't send sensitive
+    #     information in this parameter.
+    #
+    #    </note>
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event
+    #
+    # @return [Types::GetClientTokenResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetClientTokenResponse#client_authentication_result #client_authentication_result} => Types::ClientAuthenticationResultType
+    #
+    #
+    # @example Example: Example – Get an access token for machine-to-machine authorization
+    #
+    #   # The following example gets an access token for the app client 1example23456789 with the custom scope
+    #   # solar-system-data/asteroids.add.
+    #
+    #   resp = client.get_client_token({
+    #     client_id: "1example23456789", 
+    #     scopes: [
+    #       "solar-system-data/asteroids.add", 
+    #     ], 
+    #     secret: "exampleClientSecret123EXAMPLE", 
+    #   })
+    #
+    #   resp.to_h outputs the following:
+    #   {
+    #     client_authentication_result: {
+    #       access_token: "eyJra456defEXAMPLE", 
+    #       expires_in: 3600, 
+    #       token_type: "Bearer", 
+    #     }, 
+    #   }
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_client_token({
+    #     client_id: "ClientIdType", # required
+    #     secret: "ClientSecretType", # required
+    #     scopes: ["ScopeType"],
+    #     client_metadata: {
+    #       "StringType" => "StringType",
+    #     },
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.client_authentication_result.access_token #=> String
+    #   resp.client_authentication_result.expires_in #=> Integer
+    #   resp.client_authentication_result.token_type #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/GetClientToken AWS API Documentation
+    #
+    # @overload get_client_token(params = {})
+    # @param [Hash] params ({})
+    def get_client_token(params = {}, options = {})
+      req = build_request(:get_client_token, params)
+      req.send_request(options)
+    end
+
     # Given a device key, returns information about a remembered device for
     # the current user. For more information about device authentication,
     # see [Working with user devices in your user pool][1].
@@ -14418,7 +14682,7 @@ module Aws::CognitoIdentityProvider
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-cognitoidentityprovider'
-      context[:gem_version] = '1.149.0'
+      context[:gem_version] = '1.151.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-cognitoidentityprovider/client_api.rb

@@ -34,6 +34,8 @@ module Aws::CognitoIdentityProvider
     AdminCreateUserRequest = Shapes::StructureShape.new(name: 'AdminCreateUserRequest')
     AdminCreateUserResponse = Shapes::StructureShape.new(name: 'AdminCreateUserResponse')
     AdminCreateUserUnusedAccountValidityDaysType = Shapes::IntegerShape.new(name: 'AdminCreateUserUnusedAccountValidityDaysType')
+    AdminDeleteSoftwareTokenRequest = Shapes::StructureShape.new(name: 'AdminDeleteSoftwareTokenRequest')
+    AdminDeleteSoftwareTokenResponse = Shapes::StructureShape.new(name: 'AdminDeleteSoftwareTokenResponse')
     AdminDeleteUserAttributesRequest = Shapes::StructureShape.new(name: 'AdminDeleteUserAttributesRequest')
     AdminDeleteUserAttributesResponse = Shapes::StructureShape.new(name: 'AdminDeleteUserAttributesResponse')
     AdminDeleteUserRequest = Shapes::StructureShape.new(name: 'AdminDeleteUserRequest')
@@ -127,6 +129,7 @@ module Aws::CognitoIdentityProvider
     ChallengeResponsesType = Shapes::MapShape.new(name: 'ChallengeResponsesType')
     ChangePasswordRequest = Shapes::StructureShape.new(name: 'ChangePasswordRequest')
     ChangePasswordResponse = Shapes::StructureShape.new(name: 'ChangePasswordResponse')
+    ClientAuthenticationResultType = Shapes::StructureShape.new(name: 'ClientAuthenticationResultType')
     ClientIdType = Shapes::StringShape.new(name: 'ClientIdType')
     ClientMetadataType = Shapes::MapShape.new(name: 'ClientMetadataType')
     ClientNameType = Shapes::StringShape.new(name: 'ClientNameType')
@@ -218,6 +221,8 @@ module Aws::CognitoIdentityProvider
     DescribeResourceServerResponse = Shapes::StructureShape.new(name: 'DescribeResourceServerResponse')
     DescribeRiskConfigurationRequest = Shapes::StructureShape.new(name: 'DescribeRiskConfigurationRequest')
     DescribeRiskConfigurationResponse = Shapes::StructureShape.new(name: 'DescribeRiskConfigurationResponse')
+    DescribeTermsByClientRequest = Shapes::StructureShape.new(name: 'DescribeTermsByClientRequest')
+    DescribeTermsByClientResponse = Shapes::StructureShape.new(name: 'DescribeTermsByClientResponse')
     DescribeTermsRequest = Shapes::StructureShape.new(name: 'DescribeTermsRequest')
     DescribeTermsResponse = Shapes::StructureShape.new(name: 'DescribeTermsResponse')
     DescribeUserImportJobRequest = Shapes::StructureShape.new(name: 'DescribeUserImportJobRequest')
@@ -286,6 +291,8 @@ module Aws::CognitoIdentityProvider
     GenerateSecret = Shapes::BooleanShape.new(name: 'GenerateSecret')
     GetCSVHeaderRequest = Shapes::StructureShape.new(name: 'GetCSVHeaderRequest')
     GetCSVHeaderResponse = Shapes::StructureShape.new(name: 'GetCSVHeaderResponse')
+    GetClientTokenRequest = Shapes::StructureShape.new(name: 'GetClientTokenRequest')
+    GetClientTokenResponse = Shapes::StructureShape.new(name: 'GetClientTokenResponse')
     GetDeviceRequest = Shapes::StructureShape.new(name: 'GetDeviceRequest')
     GetDeviceResponse = Shapes::StructureShape.new(name: 'GetDeviceResponse')
     GetGroupRequest = Shapes::StructureShape.new(name: 'GetGroupRequest')
@@ -708,6 +715,12 @@ module Aws::CognitoIdentityProvider
     AdminCreateUserResponse.add_member(:user, Shapes::ShapeRef.new(shape: UserType, location_name: "User"))
     AdminCreateUserResponse.struct_class = Types::AdminCreateUserResponse
 
+    AdminDeleteSoftwareTokenRequest.add_member(:user_pool_id, Shapes::ShapeRef.new(shape: UserPoolIdType, required: true, location_name: "UserPoolId"))
+    AdminDeleteSoftwareTokenRequest.add_member(:username, Shapes::ShapeRef.new(shape: UsernameType, required: true, location_name: "Username"))
+    AdminDeleteSoftwareTokenRequest.struct_class = Types::AdminDeleteSoftwareTokenRequest
+
+    AdminDeleteSoftwareTokenResponse.struct_class = Types::AdminDeleteSoftwareTokenResponse
+
     AdminDeleteUserAttributesRequest.add_member(:user_pool_id, Shapes::ShapeRef.new(shape: UserPoolIdType, required: true, location_name: "UserPoolId"))
     AdminDeleteUserAttributesRequest.add_member(:username, Shapes::ShapeRef.new(shape: UsernameType, required: true, location_name: "Username"))
     AdminDeleteUserAttributesRequest.add_member(:user_attribute_names, Shapes::ShapeRef.new(shape: AttributeNameListType, required: true, location_name: "UserAttributeNames"))
@@ -1010,6 +1023,11 @@ module Aws::CognitoIdentityProvider
 
     ChangePasswordResponse.struct_class = Types::ChangePasswordResponse
 
+    ClientAuthenticationResultType.add_member(:access_token, Shapes::ShapeRef.new(shape: TokenModelType, location_name: "AccessToken"))
+    ClientAuthenticationResultType.add_member(:expires_in, Shapes::ShapeRef.new(shape: IntegerType, location_name: "ExpiresIn"))
+    ClientAuthenticationResultType.add_member(:token_type, Shapes::ShapeRef.new(shape: StringType, location_name: "TokenType"))
+    ClientAuthenticationResultType.struct_class = Types::ClientAuthenticationResultType
+
     ClientMetadataType.key = Shapes::ShapeRef.new(shape: StringType)
     ClientMetadataType.value = Shapes::ShapeRef.new(shape: StringType)
 
@@ -1353,6 +1371,14 @@ module Aws::CognitoIdentityProvider
     DescribeRiskConfigurationResponse.add_member(:risk_configuration, Shapes::ShapeRef.new(shape: RiskConfigurationType, required: true, location_name: "RiskConfiguration"))
     DescribeRiskConfigurationResponse.struct_class = Types::DescribeRiskConfigurationResponse
 
+    DescribeTermsByClientRequest.add_member(:client_id, Shapes::ShapeRef.new(shape: ClientIdType, required: true, location_name: "ClientId"))
+    DescribeTermsByClientRequest.add_member(:user_pool_id, Shapes::ShapeRef.new(shape: UserPoolIdType, required: true, location_name: "UserPoolId"))
+    DescribeTermsByClientRequest.add_member(:terms_name, Shapes::ShapeRef.new(shape: TermsNameType, required: true, location_name: "TermsName"))
+    DescribeTermsByClientRequest.struct_class = Types::DescribeTermsByClientRequest
+
+    DescribeTermsByClientResponse.add_member(:terms, Shapes::ShapeRef.new(shape: TermsType, location_name: "Terms"))
+    DescribeTermsByClientResponse.struct_class = Types::DescribeTermsByClientResponse
+
     DescribeTermsRequest.add_member(:terms_id, Shapes::ShapeRef.new(shape: TermsIdType, required: true, location_name: "TermsId"))
     DescribeTermsRequest.add_member(:user_pool_id, Shapes::ShapeRef.new(shape: UserPoolIdType, required: true, location_name: "UserPoolId"))
     DescribeTermsRequest.struct_class = Types::DescribeTermsRequest
@@ -1507,6 +1533,15 @@ module Aws::CognitoIdentityProvider
     GetCSVHeaderResponse.add_member(:csv_header, Shapes::ShapeRef.new(shape: ListOfStringTypes, location_name: "CSVHeader"))
     GetCSVHeaderResponse.struct_class = Types::GetCSVHeaderResponse
 
+    GetClientTokenRequest.add_member(:client_id, Shapes::ShapeRef.new(shape: ClientIdType, required: true, location_name: "ClientId"))
+    GetClientTokenRequest.add_member(:secret, Shapes::ShapeRef.new(shape: ClientSecretType, required: true, location_name: "Secret"))
+    GetClientTokenRequest.add_member(:scopes, Shapes::ShapeRef.new(shape: ScopeListType, location_name: "Scopes"))
+    GetClientTokenRequest.add_member(:client_metadata, Shapes::ShapeRef.new(shape: ClientMetadataType, location_name: "ClientMetadata"))
+    GetClientTokenRequest.struct_class = Types::GetClientTokenRequest
+
+    GetClientTokenResponse.add_member(:client_authentication_result, Shapes::ShapeRef.new(shape: ClientAuthenticationResultType, location_name: "ClientAuthenticationResult"))
+    GetClientTokenResponse.struct_class = Types::GetClientTokenResponse
+
     GetDeviceRequest.add_member(:device_key, Shapes::ShapeRef.new(shape: DeviceKeyType, required: true, location_name: "DeviceKey"))
     GetDeviceRequest.add_member(:access_token, Shapes::ShapeRef.new(shape: TokenModelType, location_name: "AccessToken"))
     GetDeviceRequest.struct_class = Types::GetDeviceRequest
@@ -2774,6 +2809,22 @@ module Aws::CognitoIdentityProvider
         o.errors << Shapes::ShapeRef.new(shape: InternalErrorException)
       end)
 
+      api.add_operation(:admin_delete_software_token, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "AdminDeleteSoftwareToken"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: AdminDeleteSoftwareTokenRequest)
+        o.output = Shapes::ShapeRef.new(shape: AdminDeleteSoftwareTokenResponse)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidParameterException)
+        o.errors << Shapes::ShapeRef.new(shape: NotAuthorizedException)
+        o.errors << Shapes::ShapeRef.new(shape: TooManyRequestsException)
+        o.errors << Shapes::ShapeRef.new(shape: UserNotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: UserNotConfirmedException)
+        o.errors << Shapes::ShapeRef.new(shape: OperationNotEnabledException)
+        o.errors << Shapes::ShapeRef.new(shape: InternalErrorException)
+      end)
+
       api.add_operation(:admin_delete_user, Seahorse::Model::Operation.new.tap do |o|
         o.name = "AdminDeleteUser"
         o.http_method = "POST"
@@ -3793,6 +3844,20 @@ module Aws::CognitoIdentityProvider
         o.errors << Shapes::ShapeRef.new(shape: InternalErrorException)
       end)
 
+      api.add_operation(:describe_terms_by_client, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "DescribeTermsByClient"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: DescribeTermsByClientRequest)
+        o.output = Shapes::ShapeRef.new(shape: DescribeTermsByClientResponse)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidParameterException)
+        o.errors << Shapes::ShapeRef.new(shape: TooManyRequestsException)
+        o.errors << Shapes::ShapeRef.new(shape: NotAuthorizedException)
+        o.errors << Shapes::ShapeRef.new(shape: OperationNotEnabledException)
+        o.errors << Shapes::ShapeRef.new(shape: InternalErrorException)
+      end)
+
       api.add_operation(:describe_user_import_job, Seahorse::Model::Operation.new.tap do |o|
         o.name = "DescribeUserImportJob"
         o.http_method = "POST"
@@ -3910,6 +3975,21 @@ module Aws::CognitoIdentityProvider
         o.errors << Shapes::ShapeRef.new(shape: InternalErrorException)
       end)
 
+      api.add_operation(:get_client_token, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "GetClientToken"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: GetClientTokenRequest)
+        o.output = Shapes::ShapeRef.new(shape: GetClientTokenResponse)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidParameterException)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: NotAuthorizedException)
+        o.errors << Shapes::ShapeRef.new(shape: TooManyRequestsException)
+        o.errors << Shapes::ShapeRef.new(shape: InternalErrorException)
+        o.errors << Shapes::ShapeRef.new(shape: OperationNotEnabledException)
+        o.errors << Shapes::ShapeRef.new(shape: ForbiddenException)
+      end)
+
       api.add_operation(:get_device, Seahorse::Model::Operation.new.tap do |o|
         o.name = "GetDevice"
         o.http_method = "POST"

data/lib/aws-sdk-cognitoidentityprovider/types.rb

@@ -593,6 +593,32 @@ module Aws::CognitoIdentityProvider
       include Aws::Structure
     end
 
+    # @!attribute [rw] user_pool_id
+    #   The ID of the user pool where you want to delete the user's
+    #   software token.
+    #   @return [String]
+    #
+    # @!attribute [rw] username
+    #   The name of the user that you want to query or modify. The value of
+    #   this parameter is typically your user's username, but it can be any
+    #   of their alias attributes. If `username` isn't an alias attribute
+    #   in your user pool, this value must be the `sub` of a local user or
+    #   the username of a user from a third-party IdP.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/AdminDeleteSoftwareTokenRequest AWS API Documentation
+    #
+    class AdminDeleteSoftwareTokenRequest < Struct.new(
+      :user_pool_id,
+      :username)
+      SENSITIVE = [:username]
+      include Aws::Structure
+    end
+
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/AdminDeleteSoftwareTokenResponse AWS API Documentation
+    #
+    class AdminDeleteSoftwareTokenResponse < Aws::EmptyStructure; end
+
     # Represents the request to delete user attributes as an administrator.
     #
     # @!attribute [rw] user_pool_id
@@ -1375,10 +1401,6 @@ module Aws::CognitoIdentityProvider
     #
     #   The `ProviderName` should be set to `Cognito` for users in Cognito
     #   user pools.
-    #
-    #   All attributes in the DestinationUser profile must be mutable. If
-    #   you have assigned the user any immutable custom attributes, the
-    #   operation won't succeed.
     #   @return [Types::ProviderUserIdentifierType]
     #
     # @!attribute [rw] source_user
@@ -3097,6 +3119,33 @@ module Aws::CognitoIdentityProvider
     #
     class ChangePasswordResponse < Aws::EmptyStructure; end
 
+    # The access token and its metadata from a machine-to-machine (M2M)
+    # client credentials grant.
+    #
+    # @!attribute [rw] access_token
+    #   The access token for the requested app client. Present this token to
+    #   a resource server to authorize a request, using the scopes granted
+    #   in the token.
+    #   @return [String]
+    #
+    # @!attribute [rw] expires_in
+    #   The number of seconds until the access token expires.
+    #   @return [Integer]
+    #
+    # @!attribute [rw] token_type
+    #   The type of the token. For example, `Bearer`.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/ClientAuthenticationResultType AWS API Documentation
+    #
+    class ClientAuthenticationResultType < Struct.new(
+      :access_token,
+      :expires_in,
+      :token_type)
+      SENSITIVE = [:access_token]
+      include Aws::Structure
+    end
+
     # Contains information about a client secret, including its unique
     # identifier, value, and creation timestamp.
     #
@@ -5601,6 +5650,43 @@ module Aws::CognitoIdentityProvider
       include Aws::Structure
     end
 
+    # @!attribute [rw] client_id
+    #   The ID of the app client that the terms documents are associated
+    #   with.
+    #   @return [String]
+    #
+    # @!attribute [rw] user_pool_id
+    #   The ID of the user pool that contains the terms documents that you
+    #   want to describe.
+    #   @return [String]
+    #
+    # @!attribute [rw] terms_name
+    #   The name of the terms documents that you want to describe.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/DescribeTermsByClientRequest AWS API Documentation
+    #
+    class DescribeTermsByClientRequest < Struct.new(
+      :client_id,
+      :user_pool_id,
+      :terms_name)
+      SENSITIVE = [:client_id]
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] terms
+    #   A summary of the requested terms documents. Includes a unique
+    #   identifier for later changes to the terms documents.
+    #   @return [Types::TermsType]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/DescribeTermsByClientResponse AWS API Documentation
+    #
+    class DescribeTermsByClientResponse < Struct.new(
+      :terms)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # @!attribute [rw] terms_id
     #   The ID of the terms documents that you want to describe.
     #   @return [String]
@@ -6643,6 +6729,84 @@ module Aws::CognitoIdentityProvider
       include Aws::Structure
     end
 
+    # @!attribute [rw] client_id
+    #   The ID of the app client that requests the access token. The app
+    #   client must have a client secret and the `ALLOW_CLIENT_TOKEN_AUTH`
+    #   authentication flow.
+    #   @return [String]
+    #
+    # @!attribute [rw] secret
+    #   An active secret for the app client.
+    #   @return [String]
+    #
+    # @!attribute [rw] scopes
+    #   The custom scopes to authorize in the access token, in the format
+    #   `resource-server-identifier/scope-name`. Each scope must belong to a
+    #   resource server in your user pool. If you don't specify any scopes,
+    #   Amazon Cognito authorizes the scopes that are configured for the app
+    #   client.
+    #   @return [Array<String>]
+    #
+    # @!attribute [rw] client_metadata
+    #   A map of custom key-value pairs that you can provide as input for
+    #   any custom workflows that this action triggers. You create custom
+    #   workflows by assigning Lambda functions to user pool triggers.
+    #
+    #   When Amazon Cognito invokes any of these functions, it passes a JSON
+    #   payload, which the function receives as input. This payload contains
+    #   a `clientMetadata` attribute that provides the data that you
+    #   assigned to the ClientMetadata parameter in your request. In your
+    #   function code, you can process the `clientMetadata` value to enhance
+    #   your workflow for your specific needs.
+    #
+    #   To review the Lambda trigger types that Amazon Cognito invokes at
+    #   runtime with API requests, see [ Connecting API actions to Lambda
+    #   triggers][1] in the *Amazon Cognito Developer Guide*.
+    #
+    #   <note markdown="1"> When you use the `ClientMetadata` parameter, note that Amazon
+    #   Cognito won't do the following:
+    #
+    #    * Store the `ClientMetadata` value. This data is available only to
+    #     Lambda triggers that are assigned to a user pool to support custom
+    #     workflows. If your user pool configuration doesn't include
+    #     triggers, the `ClientMetadata` parameter serves no purpose.
+    #
+    #   * Validate the `ClientMetadata` value.
+    #
+    #   * Encrypt the `ClientMetadata` value. Don't send sensitive
+    #     information in this parameter.
+    #
+    #    </note>
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event
+    #   @return [Hash<String,String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/GetClientTokenRequest AWS API Documentation
+    #
+    class GetClientTokenRequest < Struct.new(
+      :client_id,
+      :secret,
+      :scopes,
+      :client_metadata)
+      SENSITIVE = [:client_id, :secret]
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] client_authentication_result
+    #   The access token that Amazon Cognito issues for the app client, and
+    #   its metadata.
+    #   @return [Types::ClientAuthenticationResultType]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/GetClientTokenResponse AWS API Documentation
+    #
+    class GetClientTokenResponse < Struct.new(
+      :client_authentication_result)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Represents the request to get the device.
     #
     # @!attribute [rw] device_key

data/lib/aws-sdk-cognitoidentityprovider.rb

@@ -54,7 +54,7 @@ module Aws::CognitoIdentityProvider
   autoload :EndpointProvider, 'aws-sdk-cognitoidentityprovider/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-cognitoidentityprovider/endpoints'
 
-  GEM_VERSION = '1.149.0'
+  GEM_VERSION = '1.151.0'
 
 end
 

data/sig/client.rbs

@@ -150,6 +150,16 @@ module Aws
                              ) -> _AdminCreateUserResponseSuccess
                            | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _AdminCreateUserResponseSuccess
 
+      interface _AdminDeleteSoftwareTokenResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::AdminDeleteSoftwareTokenResponse]
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CognitoIdentityProvider/Client.html#admin_delete_software_token-instance_method
+      def admin_delete_software_token: (
+                                         user_pool_id: ::String,
+                                         username: ::String
+                                       ) -> _AdminDeleteSoftwareTokenResponseSuccess
+                                     | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _AdminDeleteSoftwareTokenResponseSuccess
+
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CognitoIdentityProvider/Client.html#admin_delete_user-instance_method
       def admin_delete_user: (
                                user_pool_id: ::String,
@@ -999,6 +1009,18 @@ module Aws
                           ) -> _DescribeTermsResponseSuccess
                         | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DescribeTermsResponseSuccess
 
+      interface _DescribeTermsByClientResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::DescribeTermsByClientResponse]
+        def terms: () -> Types::TermsType
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CognitoIdentityProvider/Client.html#describe_terms_by_client-instance_method
+      def describe_terms_by_client: (
+                                      client_id: ::String,
+                                      user_pool_id: ::String,
+                                      terms_name: ::String
+                                    ) -> _DescribeTermsByClientResponseSuccess
+                                  | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DescribeTermsByClientResponseSuccess
+
       interface _DescribeUserImportJobResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::DescribeUserImportJobResponse]
         def user_import_job: () -> Types::UserImportJobType
@@ -1079,6 +1101,19 @@ module Aws
                           ) -> _GetCSVHeaderResponseSuccess
                         | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _GetCSVHeaderResponseSuccess
 
+      interface _GetClientTokenResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::GetClientTokenResponse]
+        def client_authentication_result: () -> Types::ClientAuthenticationResultType
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CognitoIdentityProvider/Client.html#get_client_token-instance_method
+      def get_client_token: (
+                              client_id: ::String,
+                              secret: ::String,
+                              ?scopes: Array[::String],
+                              ?client_metadata: Hash[::String, ::String]
+                            ) -> _GetClientTokenResponseSuccess
+                          | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _GetClientTokenResponseSuccess
+
       interface _GetDeviceResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::GetDeviceResponse]
         def device: () -> Types::DeviceType

data/sig/types.rbs

@@ -100,6 +100,15 @@ module Aws::CognitoIdentityProvider
       SENSITIVE: []
     end
 
+    class AdminDeleteSoftwareTokenRequest
+      attr_accessor user_pool_id: ::String
+      attr_accessor username: ::String
+      SENSITIVE: [:username]
+    end
+
+    class AdminDeleteSoftwareTokenResponse < Aws::EmptyStructure
+    end
+
     class AdminDeleteUserAttributesRequest
       attr_accessor user_pool_id: ::String
       attr_accessor username: ::String
@@ -470,6 +479,13 @@ module Aws::CognitoIdentityProvider
     class ChangePasswordResponse < Aws::EmptyStructure
     end
 
+    class ClientAuthenticationResultType
+      attr_accessor access_token: ::String
+      attr_accessor expires_in: ::Integer
+      attr_accessor token_type: ::String
+      SENSITIVE: [:access_token]
+    end
+
     class ClientSecretDescriptorType
       attr_accessor client_secret_id: ::String
       attr_accessor client_secret_value: ::String
@@ -928,6 +944,18 @@ module Aws::CognitoIdentityProvider
       SENSITIVE: []
     end
 
+    class DescribeTermsByClientRequest
+      attr_accessor client_id: ::String
+      attr_accessor user_pool_id: ::String
+      attr_accessor terms_name: ::String
+      SENSITIVE: [:client_id]
+    end
+
+    class DescribeTermsByClientResponse
+      attr_accessor terms: Types::TermsType
+      SENSITIVE: []
+    end
+
     class DescribeTermsRequest
       attr_accessor terms_id: ::String
       attr_accessor user_pool_id: ::String
@@ -1144,6 +1172,19 @@ module Aws::CognitoIdentityProvider
       SENSITIVE: []
     end
 
+    class GetClientTokenRequest
+      attr_accessor client_id: ::String
+      attr_accessor secret: ::String
+      attr_accessor scopes: ::Array[::String]
+      attr_accessor client_metadata: ::Hash[::String, ::String]
+      SENSITIVE: [:client_id, :secret]
+    end
+
+    class GetClientTokenResponse
+      attr_accessor client_authentication_result: Types::ClientAuthenticationResultType
+      SENSITIVE: []
+    end
+
     class GetDeviceRequest
       attr_accessor device_key: ::String
       attr_accessor access_token: ::String

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-cognitoidentityprovider
 version: !ruby/object:Gem::Version
-  version: 1.149.0
+  version: 1.151.0
 platform: ruby
 authors:
 - Amazon Web Services