aws-sdk-cognitoidentityprovider 1.153.0 → 1.154.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f2d8e69826a921806c9f32d3f91cf185d90bf22fa6b2dd477232f8b9f1ce5226
-  data.tar.gz: 939e7fdec1b0bd1276a771ab50b027c804491e939d4ecf352fd3ae8bddf6f84e
+  metadata.gz: 75ec8bb92f4a2ffff1685d217e134ae73308e425c561818e16924960d5051576
+  data.tar.gz: cc897105ab9bb7882111702a4cdfcff5283e35f0f395e894540a6bb0b5389ae4
 SHA512:
-  metadata.gz: 4ac162517b646d5f5c75c8c28b888f548e656ea2bf6750b6db17631451f0fd3325d1f2bfa78ff1054193206b4f1202d85cb165bcd158cc511cf5db669f920906
-  data.tar.gz: aaaf50b049e9793cc75565ce4f9a7666d2d389d99ec81137393b4b9eed45cbdb31604e088df17a2fb0984e4739cbdbed546463d64ab0ac5af0577c6e197ad1f4
+  metadata.gz: de79ab7bfa7c36bfbf6ad3b2c37e6b19be415dbbc17abdf44e0d469c8ef0bd09281c55ff1057503f952895062f0da0a84843dcbab2758a81177e6d11b2313548
+  data.tar.gz: 9cde89501e44fd57473488fe29dc2302a62543c0eda55b2702218eb99e5f988af8ea6a836f99f0c13e856c8d229a1621559b6330270b07f69e5bbf919262e713

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.154.0 (2026-10-02)
+------------------
+
+* Feature - Amazon Cognito User Pools now supports the OIDC-standard authentication context class reference (ACR) and authentication methods reference (AMR) claims on issued access and Id tokens. Amazon Cognito User Pools also now supports step-up authentication via our existing authentication APIs.
+
 1.153.0 (2026-09-11)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.153.0
+1.154.0

data/lib/aws-sdk-cognitoidentityprovider/client.rb

@@ -1841,6 +1841,37 @@ module Aws::CognitoIdentityProvider
     #       `AvailableChallenges` parameter that specifies the available
     #       sign-in methods.
     #
+    #     * `TARGET_ACR_VALUES`. An optional, space-separated list of the
+    #       authentication context class reference (ACR) level URIs that you
+    #       want the user to reach. List the levels in priority order, from
+    #       highest to lowest. Amazon Cognito attempts the highest-priority
+    #       level that the user can satisfy, and falls back through the list.
+    #       Amazon Cognito ignores any value that it doesn't recognize. If
+    #       none of the requested values are valid, Amazon Cognito returns an
+    #       error.
+    #
+    #       Requesting step-up authentication with this parameter requires the
+    #       Essentials or Plus feature plan. On a lower feature plan,
+    #       AdminInitiateAuth returns a FeatureUnavailableInTierException.
+    #       `USERNAME` is required. When you provide an `ACCESS_TOKEN`, you
+    #       must also provide `TARGET_ACR_VALUES`. Amazon Cognito returns an
+    #       error if you provide an `ACCESS_TOKEN` without
+    #       `TARGET_ACR_VALUES`. The `USERNAME` that you provide must match
+    #       the user that the `ACCESS_TOKEN` was issued for.
+    #
+    #       For more information about step-up authentication and how Amazon
+    #       Cognito handles multi-factor authentication requirements, see
+    #       [Step-up authentication with ACR and AMR][1] in the *Amazon
+    #       Cognito Developer Guide*.
+    #
+    #     * `MAX_AGE`. An optional integer that sets the maximum number of
+    #       seconds allowed since the user last authenticated. If the user's
+    #       most recent authentication is older than this value, Amazon
+    #       Cognito discards the authentication-methods credit from any access
+    #       token that you provide and processes the request as a fresh
+    #       authentication toward the target level. The access token itself
+    #       remains valid.
+    #
     #   USER\_SRP\_AUTH
     #   : * `USERNAME` (required)
     #
@@ -1866,13 +1897,14 @@ module Aws::CognitoIdentityProvider
     #       with SRP authentication)
     #
     #   For more information about `SECRET_HASH`, see [Computing secret hash
-    #   values][1]. For information about `DEVICE_KEY`, see [Working with user
-    #   devices in your user pool][2].
+    #   values][2]. For information about `DEVICE_KEY`, see [Working with user
+    #   devices in your user pool][3].
     #
     #
     #
-    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
-    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-step-up-authentication.html
+    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
+    #   [3]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
     #
     # @option params [Hash<String,String>] :client_metadata
     #   A map of custom key-value pairs that you can provide as input for any
@@ -2957,6 +2989,7 @@ module Aws::CognitoIdentityProvider
     #   * {Types::AdminRespondToAuthChallengeResponse#session #session} => String
     #   * {Types::AdminRespondToAuthChallengeResponse#challenge_parameters #challenge_parameters} => Hash&lt;String,String&gt;
     #   * {Types::AdminRespondToAuthChallengeResponse#authentication_result #authentication_result} => Types::AuthenticationResultType
+    #   * {Types::AdminRespondToAuthChallengeResponse#available_challenges #available_challenges} => Array&lt;String&gt;
     #
     # @example Request syntax with placeholder values
     #
@@ -3001,6 +3034,8 @@ module Aws::CognitoIdentityProvider
     #   resp.authentication_result.id_token #=> String
     #   resp.authentication_result.new_device_metadata.device_key #=> String
     #   resp.authentication_result.new_device_metadata.device_group_key #=> String
+    #   resp.available_challenges #=> Array
+    #   resp.available_challenges[0] #=> String, one of "SMS_MFA", "EMAIL_OTP", "SOFTWARE_TOKEN_MFA", "SELECT_MFA_TYPE", "MFA_SETUP", "PASSWORD_VERIFIER", "CUSTOM_CHALLENGE", "SELECT_CHALLENGE", "DEVICE_SRP_AUTH", "DEVICE_PASSWORD_VERIFIER", "ADMIN_NO_SRP_AUTH", "NEW_PASSWORD_REQUIRED", "SMS_OTP", "PASSWORD", "WEB_AUTHN", "PASSWORD_SRP"
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/AdminRespondToAuthChallenge AWS API Documentation
     #
@@ -4432,6 +4467,21 @@ module Aws::CognitoIdentityProvider
     #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
     #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managing-saml-idp-naming.html
     #
+    # @option params [Hash<String,String>] :acr_mapping
+    #   A mapping between the authentication context class reference (ACR)
+    #   levels of your user pool and the ACR values of the external OpenID
+    #   Connect (OIDC) identity provider (IdP). The map is keyed by level,
+    #   from `Level1` through `Level4`, and each value is the ACR value that
+    #   the IdP uses for the corresponding level. Amazon Cognito uses this
+    #   mapping to translate a requested user pool ACR level to the value that
+    #   the IdP expects, and to map an ACR value that the IdP returns back to
+    #   a user pool level. When the IdP returns an ACR value that isn't
+    #   mapped, Amazon Cognito resolves it to the lowest level. Only OIDC IdPs
+    #   support ACR mapping.
+    #
+    #   Setting `AcrMapping` is available in all feature plans. It isn't
+    #   restricted to the Essentials or Plus feature plan.
+    #
     # @return [Types::CreateIdentityProviderResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::CreateIdentityProviderResponse#identity_provider #identity_provider} => Types::IdentityProviderType
@@ -4449,6 +4499,9 @@ module Aws::CognitoIdentityProvider
     #       "AttributeMappingKeyType" => "StringType",
     #     },
     #     idp_identifiers: ["IdpIdentifierType"],
+    #     acr_mapping: {
+    #       "AcrMappingKeyType" => "AcrValueType",
+    #     },
     #   })
     #
     # @example Response structure
@@ -4462,6 +4515,8 @@ module Aws::CognitoIdentityProvider
     #   resp.identity_provider.attribute_mapping["AttributeMappingKeyType"] #=> String
     #   resp.identity_provider.idp_identifiers #=> Array
     #   resp.identity_provider.idp_identifiers[0] #=> String
+    #   resp.identity_provider.acr_mapping #=> Hash
+    #   resp.identity_provider.acr_mapping["AcrMappingKeyType"] #=> String
     #   resp.identity_provider.last_modified_date #=> Time
     #   resp.identity_provider.creation_date #=> Time
     #
@@ -5158,6 +5213,30 @@ module Aws::CognitoIdentityProvider
     #   The issuer configuration for the user pool. Specifies the issuer type
     #   for token generation.
     #
+    # @option params [Hash<String,Types::AcrLevelConfigType>] :acr_configuration
+    #   The custom names for the authentication context class reference (ACR)
+    #   levels in your user pool. Amazon Cognito defines four fixed ACR levels
+    #   that represent increasing authentication assurance. The combination of
+    #   authentication factors that satisfies each level is fixed and you
+    #   can't change it. With this configuration, you customize only the URI
+    #   name that Amazon Cognito reports for each level in the `acr` token
+    #   claim.
+    #
+    #   You can override a subset of the levels. By default, the levels are
+    #   named `urn:cognito:loa:1` through `urn:cognito:loa:4`, and Amazon
+    #   Cognito applies the default name to any level that you don't specify.
+    #   Each name must be unique across all four levels, including any default
+    #   names that apply to levels you don't override. A name can contain any
+    #   character that is valid in a URL or a URN.
+    #
+    #   Configuring custom ACR level names requires the Essentials or Plus
+    #   feature plan. To activate this setting, your user pool must be in the
+    #   [ Essentials tier][1] or higher.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html
+    #
     # @return [Types::CreateUserPoolResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::CreateUserPoolResponse#user_pool #user_pool} => Types::UserPoolType
@@ -5772,6 +5851,11 @@ module Aws::CognitoIdentityProvider
     #     issuer_configuration: {
     #       type: "ORIGINAL", # accepts ORIGINAL, UPDATED
     #     },
+    #     acr_configuration: {
+    #       "AcrLevelKeyType" => {
+    #         acr_value: "AcrValueType", # required
+    #       },
+    #     },
     #   })
     #
     # @example Response structure
@@ -5879,6 +5963,8 @@ module Aws::CognitoIdentityProvider
     #   resp.user_pool.key_configuration.key_type #=> String, one of "AWS_OWNED_KEY", "CUSTOMER_MANAGED_KEY"
     #   resp.user_pool.key_configuration.kms_key_arn #=> String
     #   resp.user_pool.issuer_configuration.type #=> String, one of "ORIGINAL", "UPDATED"
+    #   resp.user_pool.acr_configuration #=> Hash
+    #   resp.user_pool.acr_configuration["AcrLevelKeyType"].acr_value #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/CreateUserPool AWS API Documentation
     #
@@ -7332,6 +7418,8 @@ module Aws::CognitoIdentityProvider
     #   resp.identity_provider.attribute_mapping["AttributeMappingKeyType"] #=> String
     #   resp.identity_provider.idp_identifiers #=> Array
     #   resp.identity_provider.idp_identifiers[0] #=> String
+    #   resp.identity_provider.acr_mapping #=> Hash
+    #   resp.identity_provider.acr_mapping["AcrMappingKeyType"] #=> String
     #   resp.identity_provider.last_modified_date #=> Time
     #   resp.identity_provider.creation_date #=> Time
     #
@@ -7640,10 +7728,9 @@ module Aws::CognitoIdentityProvider
     #
     # To call `DescribeTermsByClient`, you must have the
     # `cognito-idp:DescribeTermsByClient` Identity and Access Management
-    # (IAM) permission. This operation additionally validates your
-    # permission for `cognito-idp:DescribeTerms`, the action for . As a
-    # result, an IAM policy that denies `cognito-idp:DescribeTerms` also
-    # denies requests to `DescribeTermsByClient`.
+    # (IAM) permission. An IAM policy that denies
+    # `cognito-idp:DescribeTerms` also denies requests to
+    # `DescribeTermsByClient`.
     #
     # <note markdown="1"> Amazon Cognito evaluates Identity and Access Management (IAM) policies
     # in requests for this API operation. For this operation, you must use
@@ -7898,6 +7985,8 @@ module Aws::CognitoIdentityProvider
     #   resp.user_pool.key_configuration.key_type #=> String, one of "AWS_OWNED_KEY", "CUSTOMER_MANAGED_KEY"
     #   resp.user_pool.key_configuration.kms_key_arn #=> String
     #   resp.user_pool.issuer_configuration.type #=> String, one of "ORIGINAL", "UPDATED"
+    #   resp.user_pool.acr_configuration #=> Hash
+    #   resp.user_pool.acr_configuration["AcrLevelKeyType"].acr_value #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/DescribeUserPool AWS API Documentation
     #
@@ -8339,9 +8428,6 @@ module Aws::CognitoIdentityProvider
     # Issues an access token for machine-to-machine (M2M) authorization.
     # Your app client provides its client ID and secret, and receives an
     # access token that authorizes requests to your resource servers.
-    # `GetClientToken` provides the same functionality as the OAuth2
-    # client-credentials grant; both authorize an application rather than a
-    # user.
     #
     # To use this operation, you must configure the app client with a client
     # secret and enable the `ALLOW_CLIENT_TOKEN_AUTH` authentication flow.
@@ -8629,6 +8715,8 @@ module Aws::CognitoIdentityProvider
     #   resp.identity_provider.attribute_mapping["AttributeMappingKeyType"] #=> String
     #   resp.identity_provider.idp_identifiers #=> Array
     #   resp.identity_provider.idp_identifiers[0] #=> String
+    #   resp.identity_provider.acr_mapping #=> Hash
+    #   resp.identity_provider.acr_mapping["AcrMappingKeyType"] #=> String
     #   resp.identity_provider.last_modified_date #=> Time
     #   resp.identity_provider.creation_date #=> Time
     #
@@ -9491,6 +9579,37 @@ module Aws::CognitoIdentityProvider
     #       `AvailableChallenges` parameter that specifies the available
     #       sign-in methods.
     #
+    #     * `TARGET_ACR_VALUES`. An optional, space-separated list of the
+    #       authentication context class reference (ACR) level URIs that you
+    #       want the user to reach. List the levels in priority order, from
+    #       highest to lowest. Amazon Cognito attempts the highest-priority
+    #       level that the user can satisfy, and falls back through the list.
+    #       Amazon Cognito ignores any value that it doesn't recognize. If
+    #       none of the requested values are valid, Amazon Cognito returns an
+    #       error.
+    #
+    #       Requesting step-up authentication with this parameter requires the
+    #       Essentials or Plus feature plan. On a lower feature plan,
+    #       InitiateAuth returns a FeatureUnavailableInTierException.
+    #       `USERNAME` is required. When you provide an `ACCESS_TOKEN`, you
+    #       must also provide `TARGET_ACR_VALUES`. Amazon Cognito returns an
+    #       error if you provide an `ACCESS_TOKEN` without
+    #       `TARGET_ACR_VALUES`. The `USERNAME` that you provide must match
+    #       the user that the `ACCESS_TOKEN` was issued for.
+    #
+    #       For more information about step-up authentication and how Amazon
+    #       Cognito handles multi-factor authentication requirements, see
+    #       [Step-up authentication with ACR and AMR][1] in the *Amazon
+    #       Cognito Developer Guide*.
+    #
+    #     * `MAX_AGE`. An optional integer that sets the maximum number of
+    #       seconds allowed since the user last authenticated. If the user's
+    #       most recent authentication is older than this value, Amazon
+    #       Cognito discards the authentication-methods credit from any access
+    #       token that you provide and processes the request as a fresh
+    #       authentication toward the target level. The access token itself
+    #       remains valid.
+    #
     #   USER\_SRP\_AUTH
     #   : * `USERNAME` (required)
     #
@@ -9516,13 +9635,14 @@ module Aws::CognitoIdentityProvider
     #       custom challenges)
     #
     #   For more information about `SECRET_HASH`, see [Computing secret hash
-    #   values][1]. For information about `DEVICE_KEY`, see [Working with user
-    #   devices in your user pool][2].
+    #   values][2]. For information about `DEVICE_KEY`, see [Working with user
+    #   devices in your user pool][3].
     #
     #
     #
-    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
-    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-step-up-authentication.html
+    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
+    #   [3]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
     #
     # @option params [Hash<String,String>] :client_metadata
     #   A map of custom key-value pairs that you can provide as input for any
@@ -11398,6 +11518,7 @@ module Aws::CognitoIdentityProvider
     #   * {Types::RespondToAuthChallengeResponse#session #session} => String
     #   * {Types::RespondToAuthChallengeResponse#challenge_parameters #challenge_parameters} => Hash&lt;String,String&gt;
     #   * {Types::RespondToAuthChallengeResponse#authentication_result #authentication_result} => Types::AuthenticationResultType
+    #   * {Types::RespondToAuthChallengeResponse#available_challenges #available_challenges} => Array&lt;String&gt;
     #
     # @example Request syntax with placeholder values
     #
@@ -11433,6 +11554,8 @@ module Aws::CognitoIdentityProvider
     #   resp.authentication_result.id_token #=> String
     #   resp.authentication_result.new_device_metadata.device_key #=> String
     #   resp.authentication_result.new_device_metadata.device_group_key #=> String
+    #   resp.available_challenges #=> Array
+    #   resp.available_challenges[0] #=> String, one of "SMS_MFA", "EMAIL_OTP", "SOFTWARE_TOKEN_MFA", "SELECT_MFA_TYPE", "MFA_SETUP", "PASSWORD_VERIFIER", "CUSTOM_CHALLENGE", "SELECT_CHALLENGE", "DEVICE_SRP_AUTH", "DEVICE_PASSWORD_VERIFIER", "ADMIN_NO_SRP_AUTH", "NEW_PASSWORD_REQUIRED", "SMS_OTP", "PASSWORD", "WEB_AUTHN", "PASSWORD_SRP"
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/RespondToAuthChallenge AWS API Documentation
     #
@@ -12914,6 +13037,16 @@ module Aws::CognitoIdentityProvider
     #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
     #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managing-saml-idp-naming.html
     #
+    # @option params [Hash<String,String>] :acr_mapping
+    #   A mapping between the authentication context class reference (ACR)
+    #   levels of your user pool and the ACR values of the external OpenID
+    #   Connect (OIDC) identity provider (IdP). This mapping has the same
+    #   behavior as it does when you create an identity provider. Only OIDC
+    #   IdPs support ACR mapping.
+    #
+    #   Setting `AcrMapping` is available in all feature plans. It isn't
+    #   restricted to the Essentials or Plus feature plan.
+    #
     # @return [Types::UpdateIdentityProviderResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::UpdateIdentityProviderResponse#identity_provider #identity_provider} => Types::IdentityProviderType
@@ -12930,6 +13063,9 @@ module Aws::CognitoIdentityProvider
     #       "AttributeMappingKeyType" => "StringType",
     #     },
     #     idp_identifiers: ["IdpIdentifierType"],
+    #     acr_mapping: {
+    #       "AcrMappingKeyType" => "AcrValueType",
+    #     },
     #   })
     #
     # @example Response structure
@@ -12943,6 +13079,8 @@ module Aws::CognitoIdentityProvider
     #   resp.identity_provider.attribute_mapping["AttributeMappingKeyType"] #=> String
     #   resp.identity_provider.idp_identifiers #=> Array
     #   resp.identity_provider.idp_identifiers[0] #=> String
+    #   resp.identity_provider.acr_mapping #=> Hash
+    #   resp.identity_provider.acr_mapping["AcrMappingKeyType"] #=> String
     #   resp.identity_provider.last_modified_date #=> Time
     #   resp.identity_provider.creation_date #=> Time
     #
@@ -13731,6 +13869,22 @@ module Aws::CognitoIdentityProvider
     #   parameter must match the existing configuration and cannot be
     #   modified.
     #
+    # @option params [Hash<String,Types::AcrLevelConfigType>] :acr_configuration
+    #   The custom names for the authentication context class reference (ACR)
+    #   levels in your user pool. This configuration has the same behavior as
+    #   it does when you create a user pool: you customize only the URI name
+    #   that Amazon Cognito reports for each of the four fixed ACR levels, and
+    #   any level that you don't specify keeps its default name. Each name
+    #   must be unique across all four levels, including default names.
+    #
+    #   Configuring custom ACR level names requires the Essentials or Plus
+    #   feature plan. To activate this setting, your user pool must be in the
+    #   [ Essentials tier][1] or higher.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html
+    #
     # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
     #
     # @example Request syntax with placeholder values
@@ -13858,6 +14012,11 @@ module Aws::CognitoIdentityProvider
     #     issuer_configuration: {
     #       type: "ORIGINAL", # accepts ORIGINAL, UPDATED
     #     },
+    #     acr_configuration: {
+    #       "AcrLevelKeyType" => {
+    #         acr_value: "AcrValueType", # required
+    #       },
+    #     },
     #   })
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/UpdateUserPool AWS API Documentation
@@ -14682,7 +14841,7 @@ module Aws::CognitoIdentityProvider
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-cognitoidentityprovider'
-      context[:gem_version] = '1.153.0'
+      context[:gem_version] = '1.154.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-cognitoidentityprovider/client_api.rb

@@ -23,6 +23,12 @@ module Aws::CognitoIdentityProvider
     AccountTakeoverActionsType = Shapes::StructureShape.new(name: 'AccountTakeoverActionsType')
     AccountTakeoverEventActionType = Shapes::StringShape.new(name: 'AccountTakeoverEventActionType')
     AccountTakeoverRiskConfigurationType = Shapes::StructureShape.new(name: 'AccountTakeoverRiskConfigurationType')
+    AcrConfigurationType = Shapes::MapShape.new(name: 'AcrConfigurationType')
+    AcrLevelConfigType = Shapes::StructureShape.new(name: 'AcrLevelConfigType')
+    AcrLevelKeyType = Shapes::StringShape.new(name: 'AcrLevelKeyType')
+    AcrMappingKeyType = Shapes::StringShape.new(name: 'AcrMappingKeyType')
+    AcrMappingType = Shapes::MapShape.new(name: 'AcrMappingType')
+    AcrValueType = Shapes::StringShape.new(name: 'AcrValueType')
     AddCustomAttributesRequest = Shapes::StructureShape.new(name: 'AddCustomAttributesRequest')
     AddCustomAttributesResponse = Shapes::StructureShape.new(name: 'AddCustomAttributesResponse')
     AddUserPoolClientSecretRequest = Shapes::StructureShape.new(name: 'AddUserPoolClientSecretRequest')
@@ -670,6 +676,15 @@ module Aws::CognitoIdentityProvider
     AccountTakeoverRiskConfigurationType.add_member(:actions, Shapes::ShapeRef.new(shape: AccountTakeoverActionsType, required: true, location_name: "Actions"))
     AccountTakeoverRiskConfigurationType.struct_class = Types::AccountTakeoverRiskConfigurationType
 
+    AcrConfigurationType.key = Shapes::ShapeRef.new(shape: AcrLevelKeyType)
+    AcrConfigurationType.value = Shapes::ShapeRef.new(shape: AcrLevelConfigType)
+
+    AcrLevelConfigType.add_member(:acr_value, Shapes::ShapeRef.new(shape: AcrValueType, required: true, location_name: "AcrValue"))
+    AcrLevelConfigType.struct_class = Types::AcrLevelConfigType
+
+    AcrMappingType.key = Shapes::ShapeRef.new(shape: AcrMappingKeyType)
+    AcrMappingType.value = Shapes::ShapeRef.new(shape: AcrValueType)
+
     AddCustomAttributesRequest.add_member(:user_pool_id, Shapes::ShapeRef.new(shape: UserPoolIdType, required: true, location_name: "UserPoolId"))
     AddCustomAttributesRequest.add_member(:custom_attributes, Shapes::ShapeRef.new(shape: CustomAttributesListType, required: true, location_name: "CustomAttributes"))
     AddCustomAttributesRequest.struct_class = Types::AddCustomAttributesRequest
@@ -868,6 +883,7 @@ module Aws::CognitoIdentityProvider
     AdminRespondToAuthChallengeResponse.add_member(:session, Shapes::ShapeRef.new(shape: SessionType, location_name: "Session"))
     AdminRespondToAuthChallengeResponse.add_member(:challenge_parameters, Shapes::ShapeRef.new(shape: ChallengeParametersType, location_name: "ChallengeParameters"))
     AdminRespondToAuthChallengeResponse.add_member(:authentication_result, Shapes::ShapeRef.new(shape: AuthenticationResultType, location_name: "AuthenticationResult"))
+    AdminRespondToAuthChallengeResponse.add_member(:available_challenges, Shapes::ShapeRef.new(shape: AvailableChallengeListType, location_name: "AvailableChallenges"))
     AdminRespondToAuthChallengeResponse.struct_class = Types::AdminRespondToAuthChallengeResponse
 
     AdminSetUserMFAPreferenceRequest.add_member(:sms_mfa_settings, Shapes::ShapeRef.new(shape: SMSMfaSettingsType, location_name: "SMSMfaSettings"))
@@ -1132,6 +1148,7 @@ module Aws::CognitoIdentityProvider
     CreateIdentityProviderRequest.add_member(:provider_details, Shapes::ShapeRef.new(shape: ProviderDetailsType, required: true, location_name: "ProviderDetails"))
     CreateIdentityProviderRequest.add_member(:attribute_mapping, Shapes::ShapeRef.new(shape: AttributeMappingType, location_name: "AttributeMapping"))
     CreateIdentityProviderRequest.add_member(:idp_identifiers, Shapes::ShapeRef.new(shape: IdpIdentifiersListType, location_name: "IdpIdentifiers"))
+    CreateIdentityProviderRequest.add_member(:acr_mapping, Shapes::ShapeRef.new(shape: AcrMappingType, location_name: "AcrMapping"))
     CreateIdentityProviderRequest.struct_class = Types::CreateIdentityProviderRequest
 
     CreateIdentityProviderResponse.add_member(:identity_provider, Shapes::ShapeRef.new(shape: IdentityProviderType, required: true, location_name: "IdentityProvider"))
@@ -1251,6 +1268,7 @@ module Aws::CognitoIdentityProvider
     CreateUserPoolRequest.add_member(:user_pool_tier, Shapes::ShapeRef.new(shape: UserPoolTierType, location_name: "UserPoolTier"))
     CreateUserPoolRequest.add_member(:key_configuration, Shapes::ShapeRef.new(shape: KeyConfigurationType, location_name: "KeyConfiguration"))
     CreateUserPoolRequest.add_member(:issuer_configuration, Shapes::ShapeRef.new(shape: IssuerConfigurationType, location_name: "IssuerConfiguration"))
+    CreateUserPoolRequest.add_member(:acr_configuration, Shapes::ShapeRef.new(shape: AcrConfigurationType, location_name: "AcrConfiguration"))
     CreateUserPoolRequest.struct_class = Types::CreateUserPoolRequest
 
     CreateUserPoolResponse.add_member(:user_pool, Shapes::ShapeRef.new(shape: UserPoolType, location_name: "UserPool"))
@@ -1666,6 +1684,7 @@ module Aws::CognitoIdentityProvider
     IdentityProviderType.add_member(:provider_details, Shapes::ShapeRef.new(shape: ProviderDetailsType, location_name: "ProviderDetails"))
     IdentityProviderType.add_member(:attribute_mapping, Shapes::ShapeRef.new(shape: AttributeMappingType, location_name: "AttributeMapping"))
     IdentityProviderType.add_member(:idp_identifiers, Shapes::ShapeRef.new(shape: IdpIdentifiersListType, location_name: "IdpIdentifiers"))
+    IdentityProviderType.add_member(:acr_mapping, Shapes::ShapeRef.new(shape: AcrMappingType, location_name: "AcrMapping"))
     IdentityProviderType.add_member(:last_modified_date, Shapes::ShapeRef.new(shape: DateType, location_name: "LastModifiedDate"))
     IdentityProviderType.add_member(:creation_date, Shapes::ShapeRef.new(shape: DateType, location_name: "CreationDate"))
     IdentityProviderType.struct_class = Types::IdentityProviderType
@@ -2052,6 +2071,7 @@ module Aws::CognitoIdentityProvider
     RespondToAuthChallengeResponse.add_member(:session, Shapes::ShapeRef.new(shape: SessionType, location_name: "Session"))
     RespondToAuthChallengeResponse.add_member(:challenge_parameters, Shapes::ShapeRef.new(shape: ChallengeParametersType, location_name: "ChallengeParameters"))
     RespondToAuthChallengeResponse.add_member(:authentication_result, Shapes::ShapeRef.new(shape: AuthenticationResultType, location_name: "AuthenticationResult"))
+    RespondToAuthChallengeResponse.add_member(:available_challenges, Shapes::ShapeRef.new(shape: AvailableChallengeListType, location_name: "AvailableChallenges"))
     RespondToAuthChallengeResponse.struct_class = Types::RespondToAuthChallengeResponse
 
     RevokeTokenRequest.add_member(:token, Shapes::ShapeRef.new(shape: TokenModelType, required: true, location_name: "Token"))
@@ -2338,6 +2358,7 @@ module Aws::CognitoIdentityProvider
     UpdateIdentityProviderRequest.add_member(:provider_details, Shapes::ShapeRef.new(shape: ProviderDetailsType, location_name: "ProviderDetails"))
     UpdateIdentityProviderRequest.add_member(:attribute_mapping, Shapes::ShapeRef.new(shape: AttributeMappingType, location_name: "AttributeMapping"))
     UpdateIdentityProviderRequest.add_member(:idp_identifiers, Shapes::ShapeRef.new(shape: IdpIdentifiersListType, location_name: "IdpIdentifiers"))
+    UpdateIdentityProviderRequest.add_member(:acr_mapping, Shapes::ShapeRef.new(shape: AcrMappingType, location_name: "AcrMapping"))
     UpdateIdentityProviderRequest.struct_class = Types::UpdateIdentityProviderRequest
 
     UpdateIdentityProviderResponse.add_member(:identity_provider, Shapes::ShapeRef.new(shape: IdentityProviderType, required: true, location_name: "IdentityProvider"))
@@ -2459,6 +2480,7 @@ module Aws::CognitoIdentityProvider
     UpdateUserPoolRequest.add_member(:user_pool_tier, Shapes::ShapeRef.new(shape: UserPoolTierType, location_name: "UserPoolTier"))
     UpdateUserPoolRequest.add_member(:key_configuration, Shapes::ShapeRef.new(shape: KeyConfigurationType, location_name: "KeyConfiguration"))
     UpdateUserPoolRequest.add_member(:issuer_configuration, Shapes::ShapeRef.new(shape: IssuerConfigurationType, location_name: "IssuerConfiguration"))
+    UpdateUserPoolRequest.add_member(:acr_configuration, Shapes::ShapeRef.new(shape: AcrConfigurationType, location_name: "AcrConfiguration"))
     UpdateUserPoolRequest.struct_class = Types::UpdateUserPoolRequest
 
     UpdateUserPoolResponse.struct_class = Types::UpdateUserPoolResponse
@@ -2611,6 +2633,7 @@ module Aws::CognitoIdentityProvider
     UserPoolType.add_member(:user_pool_tier, Shapes::ShapeRef.new(shape: UserPoolTierType, location_name: "UserPoolTier"))
     UserPoolType.add_member(:key_configuration, Shapes::ShapeRef.new(shape: KeyConfigurationType, location_name: "KeyConfiguration"))
     UserPoolType.add_member(:issuer_configuration, Shapes::ShapeRef.new(shape: IssuerConfigurationType, location_name: "IssuerConfiguration"))
+    UserPoolType.add_member(:acr_configuration, Shapes::ShapeRef.new(shape: AcrConfigurationType, location_name: "AcrConfiguration"))
     UserPoolType.struct_class = Types::UserPoolType
 
     UserType.add_member(:username, Shapes::ShapeRef.new(shape: UsernameType, location_name: "Username"))
@@ -2986,6 +3009,7 @@ module Aws::CognitoIdentityProvider
         o.errors << Shapes::ShapeRef.new(shape: UserNotFoundException)
         o.errors << Shapes::ShapeRef.new(shape: UserNotConfirmedException)
         o.errors << Shapes::ShapeRef.new(shape: OperationNotEnabledException)
+        o.errors << Shapes::ShapeRef.new(shape: FeatureUnavailableInTierException)
       end)
 
       api.add_operation(:admin_link_provider_for_user, Seahorse::Model::Operation.new.tap do |o|
@@ -4237,6 +4261,7 @@ module Aws::CognitoIdentityProvider
         o.errors << Shapes::ShapeRef.new(shape: InvalidEmailRoleAccessPolicyException)
         o.errors << Shapes::ShapeRef.new(shape: InvalidSmsRoleTrustRelationshipException)
         o.errors << Shapes::ShapeRef.new(shape: OperationNotEnabledException)
+        o.errors << Shapes::ShapeRef.new(shape: FeatureUnavailableInTierException)
         o.errors << Shapes::ShapeRef.new(shape: ForbiddenException)
       end)
 

data/lib/aws-sdk-cognitoidentityprovider/types.rb

@@ -136,6 +136,27 @@ module Aws::CognitoIdentityProvider
       include Aws::Structure
     end
 
+    # The configuration for a single authentication context class reference
+    # (ACR) level in a user pool. Each entry in an `AcrConfiguration` map
+    # associates a level (`Level1` through `Level4`) with this
+    # configuration, which provides the custom name that Amazon Cognito
+    # reports for that level in the `acr` token claim.
+    #
+    # @!attribute [rw] acr_value
+    #   The custom name for this authentication context class reference
+    #   (ACR) level. This value is the URI that Amazon Cognito reports in
+    #   the `acr` token claim when a user meets this level. The name must be
+    #   unique across all levels in the user pool, including default names.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/AcrLevelConfigType AWS API Documentation
+    #
+    class AcrLevelConfigType < Struct.new(
+      :acr_value)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Represents the request to add custom attributes.
     #
     # @!attribute [rw] user_pool_id
@@ -1082,6 +1103,37 @@ module Aws::CognitoIdentityProvider
     #       `AvailableChallenges` parameter that specifies the available
     #       sign-in methods.
     #
+    #     * `TARGET_ACR_VALUES`. An optional, space-separated list of the
+    #       authentication context class reference (ACR) level URIs that you
+    #       want the user to reach. List the levels in priority order, from
+    #       highest to lowest. Amazon Cognito attempts the highest-priority
+    #       level that the user can satisfy, and falls back through the
+    #       list. Amazon Cognito ignores any value that it doesn't
+    #       recognize. If none of the requested values are valid, Amazon
+    #       Cognito returns an error.
+    #
+    #       Requesting step-up authentication with this parameter requires
+    #       the Essentials or Plus feature plan. On a lower feature plan,
+    #       AdminInitiateAuth returns a FeatureUnavailableInTierException.
+    #       `USERNAME` is required. When you provide an `ACCESS_TOKEN`, you
+    #       must also provide `TARGET_ACR_VALUES`. Amazon Cognito returns an
+    #       error if you provide an `ACCESS_TOKEN` without
+    #       `TARGET_ACR_VALUES`. The `USERNAME` that you provide must match
+    #       the user that the `ACCESS_TOKEN` was issued for.
+    #
+    #       For more information about step-up authentication and how Amazon
+    #       Cognito handles multi-factor authentication requirements, see
+    #       [Step-up authentication with ACR and AMR][1] in the *Amazon
+    #       Cognito Developer Guide*.
+    #
+    #     * `MAX_AGE`. An optional integer that sets the maximum number of
+    #       seconds allowed since the user last authenticated. If the
+    #       user's most recent authentication is older than this value,
+    #       Amazon Cognito discards the authentication-methods credit from
+    #       any access token that you provide and processes the request as a
+    #       fresh authentication toward the target level. The access token
+    #       itself remains valid.
+    #
     #   USER\_SRP\_AUTH
     #   : * `USERNAME` (required)
     #
@@ -1107,13 +1159,14 @@ module Aws::CognitoIdentityProvider
     #       with SRP authentication)
     #
     #   For more information about `SECRET_HASH`, see [Computing secret hash
-    #   values][1]. For information about `DEVICE_KEY`, see [Working with
-    #   user devices in your user pool][2].
+    #   values][2]. For information about `DEVICE_KEY`, see [Working with
+    #   user devices in your user pool][3].
     #
     #
     #
-    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
-    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-step-up-authentication.html
+    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
+    #   [3]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
     #   @return [Hash<String,String>]
     #
     # @!attribute [rw] client_metadata
@@ -2202,13 +2255,26 @@ module Aws::CognitoIdentityProvider
     #   successful sign-in.
     #   @return [Types::AuthenticationResultType]
     #
+    # @!attribute [rw] available_challenges
+    #   This response parameter lists the available authentication
+    #   challenges that users can select from in [choice-based
+    #   authentication][1]. For example, they might be able to choose
+    #   between passkey authentication, a one-time password from an SMS
+    #   message, and a traditional password.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flows-selection-sdk.html#authentication-flows-selection-choice
+    #   @return [Array<String>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/AdminRespondToAuthChallengeResponse AWS API Documentation
     #
     class AdminRespondToAuthChallengeResponse < Struct.new(
       :challenge_name,
       :session,
       :challenge_parameters,
-      :authentication_result)
+      :authentication_result,
+      :available_challenges)
       SENSITIVE = [:session]
       include Aws::Structure
     end
@@ -3940,6 +4006,22 @@ module Aws::CognitoIdentityProvider
     #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managing-saml-idp-naming.html
     #   @return [Array<String>]
     #
+    # @!attribute [rw] acr_mapping
+    #   A mapping between the authentication context class reference (ACR)
+    #   levels of your user pool and the ACR values of the external OpenID
+    #   Connect (OIDC) identity provider (IdP). The map is keyed by level,
+    #   from `Level1` through `Level4`, and each value is the ACR value that
+    #   the IdP uses for the corresponding level. Amazon Cognito uses this
+    #   mapping to translate a requested user pool ACR level to the value
+    #   that the IdP expects, and to map an ACR value that the IdP returns
+    #   back to a user pool level. When the IdP returns an ACR value that
+    #   isn't mapped, Amazon Cognito resolves it to the lowest level. Only
+    #   OIDC IdPs support ACR mapping.
+    #
+    #   Setting `AcrMapping` is available in all feature plans. It isn't
+    #   restricted to the Essentials or Plus feature plan.
+    #   @return [Hash<String,String>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/CreateIdentityProviderRequest AWS API Documentation
     #
     class CreateIdentityProviderRequest < Struct.new(
@@ -3948,7 +4030,8 @@ module Aws::CognitoIdentityProvider
       :provider_type,
       :provider_details,
       :attribute_mapping,
-      :idp_identifiers)
+      :idp_identifiers,
+      :acr_mapping)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -5048,6 +5131,31 @@ module Aws::CognitoIdentityProvider
     #   type for token generation.
     #   @return [Types::IssuerConfigurationType]
     #
+    # @!attribute [rw] acr_configuration
+    #   The custom names for the authentication context class reference
+    #   (ACR) levels in your user pool. Amazon Cognito defines four fixed
+    #   ACR levels that represent increasing authentication assurance. The
+    #   combination of authentication factors that satisfies each level is
+    #   fixed and you can't change it. With this configuration, you
+    #   customize only the URI name that Amazon Cognito reports for each
+    #   level in the `acr` token claim.
+    #
+    #   You can override a subset of the levels. By default, the levels are
+    #   named `urn:cognito:loa:1` through `urn:cognito:loa:4`, and Amazon
+    #   Cognito applies the default name to any level that you don't
+    #   specify. Each name must be unique across all four levels, including
+    #   any default names that apply to levels you don't override. A name
+    #   can contain any character that is valid in a URL or a URN.
+    #
+    #   Configuring custom ACR level names requires the Essentials or Plus
+    #   feature plan. To activate this setting, your user pool must be in
+    #   the [ Essentials tier][1] or higher.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html
+    #   @return [Hash<String,Types::AcrLevelConfigType>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/CreateUserPoolRequest AWS API Documentation
     #
     class CreateUserPoolRequest < Struct.new(
@@ -5076,7 +5184,8 @@ module Aws::CognitoIdentityProvider
       :account_recovery_setting,
       :user_pool_tier,
       :key_configuration,
-      :issuer_configuration)
+      :issuer_configuration,
+      :acr_configuration)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -5675,7 +5784,7 @@ module Aws::CognitoIdentityProvider
     end
 
     # @!attribute [rw] terms
-    #   A summary of the requested terms documents. Includes a unique
+    #   A summary of the requested terms documents, including a unique
     #   identifier for later changes to the terms documents.
     #   @return [Types::TermsType]
     #
@@ -6512,8 +6621,17 @@ module Aws::CognitoIdentityProvider
       include Aws::Structure
     end
 
-    # This exception is thrown when a feature you attempted to configure
-    # isn't available in your current feature plan.
+    # This exception is thrown when a feature that you attempted to use or
+    # configure isn't included in your user pool's current feature plan.
+    # This can occur when:
+    #
+    # * You configure a feature that your feature plan doesn't support.
+    #
+    # * You make a request that uses a feature that requires a higher
+    #   feature plan.
+    #
+    # To resolve this issue, upgrade your user pool to a feature plan that
+    # includes the feature.
     #
     # @!attribute [rw] message
     #   @return [String]
@@ -7663,6 +7781,15 @@ module Aws::CognitoIdentityProvider
     #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html#get-authorize-request-parameters
     #   @return [Array<String>]
     #
+    # @!attribute [rw] acr_mapping
+    #   A mapping between the authentication context class reference (ACR)
+    #   levels of your user pool and the ACR values of the external OpenID
+    #   Connect (OIDC) identity provider (IdP), so that your application
+    #   gets a consistent step-up experience regardless of which IdP
+    #   authenticated the user. The map is keyed by level, from `Level1`
+    #   through `Level4`.
+    #   @return [Hash<String,String>]
+    #
     # @!attribute [rw] last_modified_date
     #   The date and time when the item was modified. Amazon Cognito returns
     #   this timestamp in UNIX epoch time format. Your SDK might render the
@@ -7686,6 +7813,7 @@ module Aws::CognitoIdentityProvider
       :provider_details,
       :attribute_mapping,
       :idp_identifiers,
+      :acr_mapping,
       :last_modified_date,
       :creation_date)
       SENSITIVE = []
@@ -7791,6 +7919,37 @@ module Aws::CognitoIdentityProvider
     #       `AvailableChallenges` parameter that specifies the available
     #       sign-in methods.
     #
+    #     * `TARGET_ACR_VALUES`. An optional, space-separated list of the
+    #       authentication context class reference (ACR) level URIs that you
+    #       want the user to reach. List the levels in priority order, from
+    #       highest to lowest. Amazon Cognito attempts the highest-priority
+    #       level that the user can satisfy, and falls back through the
+    #       list. Amazon Cognito ignores any value that it doesn't
+    #       recognize. If none of the requested values are valid, Amazon
+    #       Cognito returns an error.
+    #
+    #       Requesting step-up authentication with this parameter requires
+    #       the Essentials or Plus feature plan. On a lower feature plan,
+    #       InitiateAuth returns a FeatureUnavailableInTierException.
+    #       `USERNAME` is required. When you provide an `ACCESS_TOKEN`, you
+    #       must also provide `TARGET_ACR_VALUES`. Amazon Cognito returns an
+    #       error if you provide an `ACCESS_TOKEN` without
+    #       `TARGET_ACR_VALUES`. The `USERNAME` that you provide must match
+    #       the user that the `ACCESS_TOKEN` was issued for.
+    #
+    #       For more information about step-up authentication and how Amazon
+    #       Cognito handles multi-factor authentication requirements, see
+    #       [Step-up authentication with ACR and AMR][1] in the *Amazon
+    #       Cognito Developer Guide*.
+    #
+    #     * `MAX_AGE`. An optional integer that sets the maximum number of
+    #       seconds allowed since the user last authenticated. If the
+    #       user's most recent authentication is older than this value,
+    #       Amazon Cognito discards the authentication-methods credit from
+    #       any access token that you provide and processes the request as a
+    #       fresh authentication toward the target level. The access token
+    #       itself remains valid.
+    #
     #   USER\_SRP\_AUTH
     #   : * `USERNAME` (required)
     #
@@ -7816,13 +7975,14 @@ module Aws::CognitoIdentityProvider
     #       custom challenges)
     #
     #   For more information about `SECRET_HASH`, see [Computing secret hash
-    #   values][1]. For information about `DEVICE_KEY`, see [Working with
-    #   user devices in your user pool][2].
+    #   values][2]. For information about `DEVICE_KEY`, see [Working with
+    #   user devices in your user pool][3].
     #
     #
     #
-    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
-    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-step-up-authentication.html
+    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
+    #   [3]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
     #   @return [Hash<String,String>]
     #
     # @!attribute [rw] client_metadata
@@ -10694,13 +10854,26 @@ module Aws::CognitoIdentityProvider
     #   successful sign-in.
     #   @return [Types::AuthenticationResultType]
     #
+    # @!attribute [rw] available_challenges
+    #   This response parameter lists the available authentication
+    #   challenges that users can select from in [choice-based
+    #   authentication][1]. For example, they might be able to choose
+    #   between passkey authentication, a one-time password from an SMS
+    #   message, and a traditional password.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/authentication-flows-selection-sdk.html#authentication-flows-selection-choice
+    #   @return [Array<String>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/RespondToAuthChallengeResponse AWS API Documentation
     #
     class RespondToAuthChallengeResponse < Struct.new(
       :challenge_name,
       :session,
       :challenge_parameters,
-      :authentication_result)
+      :authentication_result,
+      :available_challenges)
       SENSITIVE = [:session]
       include Aws::Structure
     end
@@ -12527,6 +12700,17 @@ module Aws::CognitoIdentityProvider
     #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managing-saml-idp-naming.html
     #   @return [Array<String>]
     #
+    # @!attribute [rw] acr_mapping
+    #   A mapping between the authentication context class reference (ACR)
+    #   levels of your user pool and the ACR values of the external OpenID
+    #   Connect (OIDC) identity provider (IdP). This mapping has the same
+    #   behavior as it does when you create an identity provider. Only OIDC
+    #   IdPs support ACR mapping.
+    #
+    #   Setting `AcrMapping` is available in all feature plans. It isn't
+    #   restricted to the Essentials or Plus feature plan.
+    #   @return [Hash<String,String>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/UpdateIdentityProviderRequest AWS API Documentation
     #
     class UpdateIdentityProviderRequest < Struct.new(
@@ -12534,7 +12718,8 @@ module Aws::CognitoIdentityProvider
       :provider_name,
       :provider_details,
       :attribute_mapping,
-      :idp_identifiers)
+      :idp_identifiers,
+      :acr_mapping)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -13606,6 +13791,24 @@ module Aws::CognitoIdentityProvider
     #   modified.
     #   @return [Types::IssuerConfigurationType]
     #
+    # @!attribute [rw] acr_configuration
+    #   The custom names for the authentication context class reference
+    #   (ACR) levels in your user pool. This configuration has the same
+    #   behavior as it does when you create a user pool: you customize only
+    #   the URI name that Amazon Cognito reports for each of the four fixed
+    #   ACR levels, and any level that you don't specify keeps its default
+    #   name. Each name must be unique across all four levels, including
+    #   default names.
+    #
+    #   Configuring custom ACR level names requires the Essentials or Plus
+    #   feature plan. To activate this setting, your user pool must be in
+    #   the [ Essentials tier][1] or higher.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html
+    #   @return [Hash<String,Types::AcrLevelConfigType>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/UpdateUserPoolRequest AWS API Documentation
     #
     class UpdateUserPoolRequest < Struct.new(
@@ -13631,7 +13834,8 @@ module Aws::CognitoIdentityProvider
       :pool_name,
       :user_pool_tier,
       :key_configuration,
-      :issuer_configuration)
+      :issuer_configuration,
+      :acr_configuration)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -14823,6 +15027,21 @@ module Aws::CognitoIdentityProvider
     #   settings.
     #   @return [Types::IssuerConfigurationType]
     #
+    # @!attribute [rw] acr_configuration
+    #   The names of the authentication context class reference (ACR) levels
+    #   for the user pool. Amazon Cognito always returns the effective
+    #   configuration, with default names merged in for any level that you
+    #   haven't customized.
+    #
+    #   Configuring custom ACR level names requires the Essentials or Plus
+    #   feature plan. To activate this setting, your user pool must be in
+    #   the [ Essentials tier][1] or higher.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html
+    #   @return [Hash<String,Types::AcrLevelConfigType>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/UserPoolType AWS API Documentation
     #
     class UserPoolType < Struct.new(
@@ -14861,7 +15080,8 @@ module Aws::CognitoIdentityProvider
       :account_recovery_setting,
       :user_pool_tier,
       :key_configuration,
-      :issuer_configuration)
+      :issuer_configuration,
+      :acr_configuration)
       SENSITIVE = []
       include Aws::Structure
     end

data/lib/aws-sdk-cognitoidentityprovider.rb

@@ -54,7 +54,7 @@ module Aws::CognitoIdentityProvider
   autoload :EndpointProvider, 'aws-sdk-cognitoidentityprovider/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-cognitoidentityprovider/endpoints'
 
-  GEM_VERSION = '1.153.0'
+  GEM_VERSION = '1.154.0'
 
 end
 

data/sig/client.rbs

@@ -374,6 +374,7 @@ module Aws
         def session: () -> ::String
         def challenge_parameters: () -> ::Hash[::String, ::String]
         def authentication_result: () -> Types::AuthenticationResultType
+        def available_challenges: () -> ::Array[("SMS_MFA" | "EMAIL_OTP" | "SOFTWARE_TOKEN_MFA" | "SELECT_MFA_TYPE" | "MFA_SETUP" | "PASSWORD_VERIFIER" | "CUSTOM_CHALLENGE" | "SELECT_CHALLENGE" | "DEVICE_SRP_AUTH" | "DEVICE_PASSWORD_VERIFIER" | "ADMIN_NO_SRP_AUTH" | "NEW_PASSWORD_REQUIRED" | "SMS_OTP" | "PASSWORD" | "WEB_AUTHN" | "PASSWORD_SRP")]
       end
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CognitoIdentityProvider/Client.html#admin_respond_to_auth_challenge-instance_method
       def admin_respond_to_auth_challenge: (
@@ -613,7 +614,8 @@ module Aws
                                       provider_type: ("SAML" | "Facebook" | "Google" | "LoginWithAmazon" | "SignInWithApple" | "OIDC"),
                                       provider_details: Hash[::String, ::String],
                                       ?attribute_mapping: Hash[::String, ::String],
-                                      ?idp_identifiers: Array[::String]
+                                      ?idp_identifiers: Array[::String],
+                                      ?acr_mapping: Hash[::String, ::String]
                                     ) -> _CreateIdentityProviderResponseSuccess
                                   | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _CreateIdentityProviderResponseSuccess
 
@@ -749,7 +751,10 @@ module Aws
                               },
                               ?issuer_configuration: {
                                 type: ("ORIGINAL" | "UPDATED")?
-                              }
+                              },
+                              ?acr_configuration: Hash[::String, {
+                                  acr_value: ::String
+                                }]
                             ) -> _CreateUserPoolResponseSuccess
                           | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _CreateUserPoolResponseSuccess
 
@@ -1498,6 +1503,7 @@ module Aws
         def session: () -> ::String
         def challenge_parameters: () -> ::Hash[::String, ::String]
         def authentication_result: () -> Types::AuthenticationResultType
+        def available_challenges: () -> ::Array[("SMS_MFA" | "EMAIL_OTP" | "SOFTWARE_TOKEN_MFA" | "SELECT_MFA_TYPE" | "MFA_SETUP" | "PASSWORD_VERIFIER" | "CUSTOM_CHALLENGE" | "SELECT_CHALLENGE" | "DEVICE_SRP_AUTH" | "DEVICE_PASSWORD_VERIFIER" | "ADMIN_NO_SRP_AUTH" | "NEW_PASSWORD_REQUIRED" | "SMS_OTP" | "PASSWORD" | "WEB_AUTHN" | "PASSWORD_SRP")]
       end
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CognitoIdentityProvider/Client.html#respond_to_auth_challenge-instance_method
       def respond_to_auth_challenge: (
@@ -1828,7 +1834,8 @@ module Aws
                                       provider_name: ::String,
                                       ?provider_details: Hash[::String, ::String],
                                       ?attribute_mapping: Hash[::String, ::String],
-                                      ?idp_identifiers: Array[::String]
+                                      ?idp_identifiers: Array[::String],
+                                      ?acr_mapping: Hash[::String, ::String]
                                     ) -> _UpdateIdentityProviderResponseSuccess
                                   | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _UpdateIdentityProviderResponseSuccess
 
@@ -1974,7 +1981,10 @@ module Aws
                               },
                               ?issuer_configuration: {
                                 type: ("ORIGINAL" | "UPDATED")?
-                              }
+                              },
+                              ?acr_configuration: Hash[::String, {
+                                  acr_value: ::String
+                                }]
                             ) -> _UpdateUserPoolResponseSuccess
                           | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _UpdateUserPoolResponseSuccess
 

data/sig/types.rbs

@@ -37,6 +37,11 @@ module Aws::CognitoIdentityProvider
       SENSITIVE: []
     end
 
+    class AcrLevelConfigType
+      attr_accessor acr_value: ::String
+      SENSITIVE: []
+    end
+
     class AddCustomAttributesRequest
       attr_accessor user_pool_id: ::String
       attr_accessor custom_attributes: ::Array[Types::SchemaAttributeType]
@@ -311,6 +316,7 @@ module Aws::CognitoIdentityProvider
       attr_accessor session: ::String
       attr_accessor challenge_parameters: ::Hash[::String, ::String]
       attr_accessor authentication_result: Types::AuthenticationResultType
+      attr_accessor available_challenges: ::Array[("SMS_MFA" | "EMAIL_OTP" | "SOFTWARE_TOKEN_MFA" | "SELECT_MFA_TYPE" | "MFA_SETUP" | "PASSWORD_VERIFIER" | "CUSTOM_CHALLENGE" | "SELECT_CHALLENGE" | "DEVICE_SRP_AUTH" | "DEVICE_PASSWORD_VERIFIER" | "ADMIN_NO_SRP_AUTH" | "NEW_PASSWORD_REQUIRED" | "SMS_OTP" | "PASSWORD" | "WEB_AUTHN" | "PASSWORD_SRP")]
       SENSITIVE: [:session]
     end
 
@@ -616,6 +622,7 @@ module Aws::CognitoIdentityProvider
       attr_accessor provider_details: ::Hash[::String, ::String]
       attr_accessor attribute_mapping: ::Hash[::String, ::String]
       attr_accessor idp_identifiers: ::Array[::String]
+      attr_accessor acr_mapping: ::Hash[::String, ::String]
       SENSITIVE: []
     end
 
@@ -767,6 +774,7 @@ module Aws::CognitoIdentityProvider
       attr_accessor user_pool_tier: ("LITE" | "ESSENTIALS" | "PLUS")
       attr_accessor key_configuration: Types::KeyConfigurationType
       attr_accessor issuer_configuration: Types::IssuerConfigurationType
+      attr_accessor acr_configuration: ::Hash[::String, Types::AcrLevelConfigType]
       SENSITIVE: []
     end
 
@@ -1363,6 +1371,7 @@ module Aws::CognitoIdentityProvider
       attr_accessor provider_details: ::Hash[::String, ::String]
       attr_accessor attribute_mapping: ::Hash[::String, ::String]
       attr_accessor idp_identifiers: ::Array[::String]
+      attr_accessor acr_mapping: ::Hash[::String, ::String]
       attr_accessor last_modified_date: ::Time
       attr_accessor creation_date: ::Time
       SENSITIVE: []
@@ -1875,6 +1884,7 @@ module Aws::CognitoIdentityProvider
       attr_accessor session: ::String
       attr_accessor challenge_parameters: ::Hash[::String, ::String]
       attr_accessor authentication_result: Types::AuthenticationResultType
+      attr_accessor available_challenges: ::Array[("SMS_MFA" | "EMAIL_OTP" | "SOFTWARE_TOKEN_MFA" | "SELECT_MFA_TYPE" | "MFA_SETUP" | "PASSWORD_VERIFIER" | "CUSTOM_CHALLENGE" | "SELECT_CHALLENGE" | "DEVICE_SRP_AUTH" | "DEVICE_PASSWORD_VERIFIER" | "ADMIN_NO_SRP_AUTH" | "NEW_PASSWORD_REQUIRED" | "SMS_OTP" | "PASSWORD" | "WEB_AUTHN" | "PASSWORD_SRP")]
       SENSITIVE: [:session]
     end
 
@@ -2263,6 +2273,7 @@ module Aws::CognitoIdentityProvider
       attr_accessor provider_details: ::Hash[::String, ::String]
       attr_accessor attribute_mapping: ::Hash[::String, ::String]
       attr_accessor idp_identifiers: ::Array[::String]
+      attr_accessor acr_mapping: ::Hash[::String, ::String]
       SENSITIVE: []
     end
 
@@ -2420,6 +2431,7 @@ module Aws::CognitoIdentityProvider
       attr_accessor user_pool_tier: ("LITE" | "ESSENTIALS" | "PLUS")
       attr_accessor key_configuration: Types::KeyConfigurationType
       attr_accessor issuer_configuration: Types::IssuerConfigurationType
+      attr_accessor acr_configuration: ::Hash[::String, Types::AcrLevelConfigType]
       SENSITIVE: []
     end
 
@@ -2590,6 +2602,7 @@ module Aws::CognitoIdentityProvider
       attr_accessor user_pool_tier: ("LITE" | "ESSENTIALS" | "PLUS")
       attr_accessor key_configuration: Types::KeyConfigurationType
       attr_accessor issuer_configuration: Types::IssuerConfigurationType
+      attr_accessor acr_configuration: ::Hash[::String, Types::AcrLevelConfigType]
       SENSITIVE: []
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-cognitoidentityprovider
 version: !ruby/object:Gem::Version
-  version: 1.153.0
+  version: 1.154.0
 platform: ruby
 authors:
 - Amazon Web Services