aws-sdk-cognitoidentityprovider 1.153.0 → 1.155.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f2d8e69826a921806c9f32d3f91cf185d90bf22fa6b2dd477232f8b9f1ce5226
-  data.tar.gz: 939e7fdec1b0bd1276a771ab50b027c804491e939d4ecf352fd3ae8bddf6f84e
+  metadata.gz: a908c923924f15c17c6515fe7e58d1f92b3734c6fe21456e2d614a6258fd6c64
+  data.tar.gz: e53679cee16d1087089e086cf3e78be8356c6119fa878bd97c60e71a7f06128b
 SHA512:
-  metadata.gz: 4ac162517b646d5f5c75c8c28b888f548e656ea2bf6750b6db17631451f0fd3325d1f2bfa78ff1054193206b4f1202d85cb165bcd158cc511cf5db669f920906
-  data.tar.gz: aaaf50b049e9793cc75565ce4f9a7666d2d389d99ec81137393b4b9eed45cbdb31604e088df17a2fb0984e4739cbdbed546463d64ab0ac5af0577c6e197ad1f4
+  metadata.gz: eb2307a53e26b1588114988c855058b9a73f96f7c9317f0706159765f886dd88b02d3b68e8d0b8b984db0c7f0532d22acc936eb3f5fb8f55ea1830287fe3e0b8
+  data.tar.gz: 7664f7451ba763fb9206e97f101b12b78676edab081a0cb3fa02211e7a78d305d5ec2070330d9d96415c171c45c9f982eea9c603b7cf8c62295a3edf3ea7a04c

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.155.0 (2026-10-19)
+------------------
+
+* Feature - Code Generated Changes, see `./build_tools` or `aws-sdk-core`'s CHANGELOG.md for details.
+
+1.154.0 (2026-10-02)
+------------------
+
+* Feature - Amazon Cognito User Pools now supports the OIDC-standard authentication context class reference (ACR) and authentication methods reference (AMR) claims on issued access and Id tokens. Amazon Cognito User Pools also now supports step-up authentication via our existing authentication APIs.
+
 1.153.0 (2026-09-11)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.153.0
+1.155.0

data/lib/aws-sdk-cognitoidentityprovider/client.rb

@@ -1841,6 +1841,37 @@ module Aws::CognitoIdentityProvider
     #       `AvailableChallenges` parameter that specifies the available
     #       sign-in methods.
     #
+    #     * `TARGET_ACR_VALUES`. An optional, space-separated list of the
+    #       authentication context class reference (ACR) level URIs that you
+    #       want the user to reach. List the levels in priority order, from
+    #       highest to lowest. Amazon Cognito attempts the highest-priority
+    #       level that the user can satisfy, and falls back through the list.
+    #       Amazon Cognito ignores any value that it doesn't recognize. If
+    #       none of the requested values are valid, Amazon Cognito returns an
+    #       error.
+    #
+    #       Requesting step-up authentication with this parameter requires the
+    #       Essentials or Plus feature plan. On a lower feature plan,
+    #       AdminInitiateAuth returns a FeatureUnavailableInTierException.
+    #       `USERNAME` is required. When you provide an `ACCESS_TOKEN`, you
+    #       must also provide `TARGET_ACR_VALUES`. Amazon Cognito returns an
+    #       error if you provide an `ACCESS_TOKEN` without
+    #       `TARGET_ACR_VALUES`. The `USERNAME` that you provide must match
+    #       the user that the `ACCESS_TOKEN` was issued for.
+    #
+    #       For more information about step-up authentication and how Amazon
+    #       Cognito handles multi-factor authentication requirements, see
+    #       [Step-up authentication with ACR and AMR][1] in the *Amazon
+    #       Cognito Developer Guide*.
+    #
+    #     * `MAX_AGE`. An optional integer that sets the maximum number of
+    #       seconds allowed since the user last authenticated. If the user's
+    #       most recent authentication is older than this value, Amazon
+    #       Cognito discards the authentication-methods credit from any access
+    #       token that you provide and processes the request as a fresh
+    #       authentication toward the target level. The access token itself
+    #       remains valid.
+    #
     #   USER\_SRP\_AUTH
     #   : * `USERNAME` (required)
     #
@@ -1866,13 +1897,14 @@ module Aws::CognitoIdentityProvider
     #       with SRP authentication)
     #
     #   For more information about `SECRET_HASH`, see [Computing secret hash
-    #   values][1]. For information about `DEVICE_KEY`, see [Working with user
-    #   devices in your user pool][2].
+    #   values][2]. For information about `DEVICE_KEY`, see [Working with user
+    #   devices in your user pool][3].
     #
     #
     #
-    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
-    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-step-up-authentication.html
+    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
+    #   [3]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
     #
     # @option params [Hash<String,String>] :client_metadata
     #   A map of custom key-value pairs that you can provide as input for any
@@ -2957,6 +2989,7 @@ module Aws::CognitoIdentityProvider
     #   * {Types::AdminRespondToAuthChallengeResponse#session #session} => String
     #   * {Types::AdminRespondToAuthChallengeResponse#challenge_parameters #challenge_parameters} => Hash&lt;String,String&gt;
     #   * {Types::AdminRespondToAuthChallengeResponse#authentication_result #authentication_result} => Types::AuthenticationResultType
+    #   * {Types::AdminRespondToAuthChallengeResponse#available_challenges #available_challenges} => Array&lt;String&gt;
     #
     # @example Request syntax with placeholder values
     #
@@ -3001,6 +3034,8 @@ module Aws::CognitoIdentityProvider
     #   resp.authentication_result.id_token #=> String
     #   resp.authentication_result.new_device_metadata.device_key #=> String
     #   resp.authentication_result.new_device_metadata.device_group_key #=> String
+    #   resp.available_challenges #=> Array
+    #   resp.available_challenges[0] #=> String, one of "SMS_MFA", "EMAIL_OTP", "SOFTWARE_TOKEN_MFA", "SELECT_MFA_TYPE", "MFA_SETUP", "PASSWORD_VERIFIER", "CUSTOM_CHALLENGE", "SELECT_CHALLENGE", "DEVICE_SRP_AUTH", "DEVICE_PASSWORD_VERIFIER", "ADMIN_NO_SRP_AUTH", "NEW_PASSWORD_REQUIRED", "SMS_OTP", "PASSWORD", "WEB_AUTHN", "PASSWORD_SRP"
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/AdminRespondToAuthChallenge AWS API Documentation
     #
@@ -4432,6 +4467,21 @@ module Aws::CognitoIdentityProvider
     #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
     #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managing-saml-idp-naming.html
     #
+    # @option params [Hash<String,String>] :acr_mapping
+    #   A mapping between the authentication context class reference (ACR)
+    #   levels of your user pool and the ACR values of the external OpenID
+    #   Connect (OIDC) identity provider (IdP). The map is keyed by level,
+    #   from `Level1` through `Level4`, and each value is the ACR value that
+    #   the IdP uses for the corresponding level. Amazon Cognito uses this
+    #   mapping to translate a requested user pool ACR level to the value that
+    #   the IdP expects, and to map an ACR value that the IdP returns back to
+    #   a user pool level. When the IdP returns an ACR value that isn't
+    #   mapped, Amazon Cognito resolves it to the lowest level. Only OIDC IdPs
+    #   support ACR mapping.
+    #
+    #   Setting `AcrMapping` is available in all feature plans. It isn't
+    #   restricted to the Essentials or Plus feature plan.
+    #
     # @return [Types::CreateIdentityProviderResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::CreateIdentityProviderResponse#identity_provider #identity_provider} => Types::IdentityProviderType
@@ -4449,6 +4499,9 @@ module Aws::CognitoIdentityProvider
     #       "AttributeMappingKeyType" => "StringType",
     #     },
     #     idp_identifiers: ["IdpIdentifierType"],
+    #     acr_mapping: {
+    #       "AcrMappingKeyType" => "AcrValueType",
+    #     },
     #   })
     #
     # @example Response structure
@@ -4462,6 +4515,8 @@ module Aws::CognitoIdentityProvider
     #   resp.identity_provider.attribute_mapping["AttributeMappingKeyType"] #=> String
     #   resp.identity_provider.idp_identifiers #=> Array
     #   resp.identity_provider.idp_identifiers[0] #=> String
+    #   resp.identity_provider.acr_mapping #=> Hash
+    #   resp.identity_provider.acr_mapping["AcrMappingKeyType"] #=> String
     #   resp.identity_provider.last_modified_date #=> Time
     #   resp.identity_provider.creation_date #=> Time
     #
@@ -5158,6 +5213,30 @@ module Aws::CognitoIdentityProvider
     #   The issuer configuration for the user pool. Specifies the issuer type
     #   for token generation.
     #
+    # @option params [Hash<String,Types::AcrLevelConfigType>] :acr_configuration
+    #   The custom names for the authentication context class reference (ACR)
+    #   levels in your user pool. Amazon Cognito defines four fixed ACR levels
+    #   that represent increasing authentication assurance. The combination of
+    #   authentication factors that satisfies each level is fixed and you
+    #   can't change it. With this configuration, you customize only the URI
+    #   name that Amazon Cognito reports for each level in the `acr` token
+    #   claim.
+    #
+    #   You can override a subset of the levels. By default, the levels are
+    #   named `urn:cognito:loa:1` through `urn:cognito:loa:4`, and Amazon
+    #   Cognito applies the default name to any level that you don't specify.
+    #   Each name must be unique across all four levels, including any default
+    #   names that apply to levels you don't override. A name can contain any
+    #   character that is valid in a URL or a URN.
+    #
+    #   Configuring custom ACR level names requires the Essentials or Plus
+    #   feature plan. To activate this setting, your user pool must be in the
+    #   [ Essentials tier][1] or higher.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html
+    #
     # @return [Types::CreateUserPoolResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::CreateUserPoolResponse#user_pool #user_pool} => Types::UserPoolType
@@ -5772,6 +5851,11 @@ module Aws::CognitoIdentityProvider
     #     issuer_configuration: {
     #       type: "ORIGINAL", # accepts ORIGINAL, UPDATED
     #     },
+    #     acr_configuration: {
+    #       "AcrLevelKeyType" => {
+    #         acr_value: "AcrValueType", # required
+    #       },
+    #     },
     #   })
     #
     # @example Response structure
@@ -5879,6 +5963,8 @@ module Aws::CognitoIdentityProvider
     #   resp.user_pool.key_configuration.key_type #=> String, one of "AWS_OWNED_KEY", "CUSTOMER_MANAGED_KEY"
     #   resp.user_pool.key_configuration.kms_key_arn #=> String
     #   resp.user_pool.issuer_configuration.type #=> String, one of "ORIGINAL", "UPDATED"
+    #   resp.user_pool.acr_configuration #=> Hash
+    #   resp.user_pool.acr_configuration["AcrLevelKeyType"].acr_value #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/CreateUserPool AWS API Documentation
     #
@@ -7332,6 +7418,8 @@ module Aws::CognitoIdentityProvider
     #   resp.identity_provider.attribute_mapping["AttributeMappingKeyType"] #=> String
     #   resp.identity_provider.idp_identifiers #=> Array
     #   resp.identity_provider.idp_identifiers[0] #=> String
+    #   resp.identity_provider.acr_mapping #=> Hash
+    #   resp.identity_provider.acr_mapping["AcrMappingKeyType"] #=> String
     #   resp.identity_provider.last_modified_date #=> Time
     #   resp.identity_provider.creation_date #=> Time
     #
@@ -7640,10 +7728,9 @@ module Aws::CognitoIdentityProvider
     #
     # To call `DescribeTermsByClient`, you must have the
     # `cognito-idp:DescribeTermsByClient` Identity and Access Management
-    # (IAM) permission. This operation additionally validates your
-    # permission for `cognito-idp:DescribeTerms`, the action for . As a
-    # result, an IAM policy that denies `cognito-idp:DescribeTerms` also
-    # denies requests to `DescribeTermsByClient`.
+    # (IAM) permission. An IAM policy that denies
+    # `cognito-idp:DescribeTerms` also denies requests to
+    # `DescribeTermsByClient`.
     #
     # <note markdown="1"> Amazon Cognito evaluates Identity and Access Management (IAM) policies
     # in requests for this API operation. For this operation, you must use
@@ -7898,6 +7985,8 @@ module Aws::CognitoIdentityProvider
     #   resp.user_pool.key_configuration.key_type #=> String, one of "AWS_OWNED_KEY", "CUSTOMER_MANAGED_KEY"
     #   resp.user_pool.key_configuration.kms_key_arn #=> String
     #   resp.user_pool.issuer_configuration.type #=> String, one of "ORIGINAL", "UPDATED"
+    #   resp.user_pool.acr_configuration #=> Hash
+    #   resp.user_pool.acr_configuration["AcrLevelKeyType"].acr_value #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/DescribeUserPool AWS API Documentation
     #
@@ -8339,9 +8428,6 @@ module Aws::CognitoIdentityProvider
     # Issues an access token for machine-to-machine (M2M) authorization.
     # Your app client provides its client ID and secret, and receives an
     # access token that authorizes requests to your resource servers.
-    # `GetClientToken` provides the same functionality as the OAuth2
-    # client-credentials grant; both authorize an application rather than a
-    # user.
     #
     # To use this operation, you must configure the app client with a client
     # secret and enable the `ALLOW_CLIENT_TOKEN_AUTH` authentication flow.
@@ -8629,6 +8715,8 @@ module Aws::CognitoIdentityProvider
     #   resp.identity_provider.attribute_mapping["AttributeMappingKeyType"] #=> String
     #   resp.identity_provider.idp_identifiers #=> Array
     #   resp.identity_provider.idp_identifiers[0] #=> String
+    #   resp.identity_provider.acr_mapping #=> Hash
+    #   resp.identity_provider.acr_mapping["AcrMappingKeyType"] #=> String
     #   resp.identity_provider.last_modified_date #=> Time
     #   resp.identity_provider.creation_date #=> Time
     #
@@ -9491,6 +9579,37 @@ module Aws::CognitoIdentityProvider
     #       `AvailableChallenges` parameter that specifies the available
     #       sign-in methods.
     #
+    #     * `TARGET_ACR_VALUES`. An optional, space-separated list of the
+    #       authentication context class reference (ACR) level URIs that you
+    #       want the user to reach. List the levels in priority order, from
+    #       highest to lowest. Amazon Cognito attempts the highest-priority
+    #       level that the user can satisfy, and falls back through the list.
+    #       Amazon Cognito ignores any value that it doesn't recognize. If
+    #       none of the requested values are valid, Amazon Cognito returns an
+    #       error.
+    #
+    #       Requesting step-up authentication with this parameter requires the
+    #       Essentials or Plus feature plan. On a lower feature plan,
+    #       InitiateAuth returns a FeatureUnavailableInTierException.
+    #       `USERNAME` is required. When you provide an `ACCESS_TOKEN`, you
+    #       must also provide `TARGET_ACR_VALUES`. Amazon Cognito returns an
+    #       error if you provide an `ACCESS_TOKEN` without
+    #       `TARGET_ACR_VALUES`. The `USERNAME` that you provide must match
+    #       the user that the `ACCESS_TOKEN` was issued for.
+    #
+    #       For more information about step-up authentication and how Amazon
+    #       Cognito handles multi-factor authentication requirements, see
+    #       [Step-up authentication with ACR and AMR][1] in the *Amazon
+    #       Cognito Developer Guide*.
+    #
+    #     * `MAX_AGE`. An optional integer that sets the maximum number of
+    #       seconds allowed since the user last authenticated. If the user's
+    #       most recent authentication is older than this value, Amazon
+    #       Cognito discards the authentication-methods credit from any access
+    #       token that you provide and processes the request as a fresh
+    #       authentication toward the target level. The access token itself
+    #       remains valid.
+    #
     #   USER\_SRP\_AUTH
     #   : * `USERNAME` (required)
     #
@@ -9516,13 +9635,14 @@ module Aws::CognitoIdentityProvider
     #       custom challenges)
     #
     #   For more information about `SECRET_HASH`, see [Computing secret hash
-    #   values][1]. For information about `DEVICE_KEY`, see [Working with user
-    #   devices in your user pool][2].
+    #   values][2]. For information about `DEVICE_KEY`, see [Working with user
+    #   devices in your user pool][3].
     #
     #
     #
-    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
-    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-step-up-authentication.html
+    #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/signing-up-users-in-your-app.html#cognito-user-pools-computing-secret-hash
+    #   [3]: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-device-tracking.html
     #
     # @option params [Hash<String,String>] :client_metadata
     #   A map of custom key-value pairs that you can provide as input for any
@@ -11398,6 +11518,7 @@ module Aws::CognitoIdentityProvider
     #   * {Types::RespondToAuthChallengeResponse#session #session} => String
     #   * {Types::RespondToAuthChallengeResponse#challenge_parameters #challenge_parameters} => Hash&lt;String,String&gt;
     #   * {Types::RespondToAuthChallengeResponse#authentication_result #authentication_result} => Types::AuthenticationResultType
+    #   * {Types::RespondToAuthChallengeResponse#available_challenges #available_challenges} => Array&lt;String&gt;
     #
     # @example Request syntax with placeholder values
     #
@@ -11433,6 +11554,8 @@ module Aws::CognitoIdentityProvider
     #   resp.authentication_result.id_token #=> String
     #   resp.authentication_result.new_device_metadata.device_key #=> String
     #   resp.authentication_result.new_device_metadata.device_group_key #=> String
+    #   resp.available_challenges #=> Array
+    #   resp.available_challenges[0] #=> String, one of "SMS_MFA", "EMAIL_OTP", "SOFTWARE_TOKEN_MFA", "SELECT_MFA_TYPE", "MFA_SETUP", "PASSWORD_VERIFIER", "CUSTOM_CHALLENGE", "SELECT_CHALLENGE", "DEVICE_SRP_AUTH", "DEVICE_PASSWORD_VERIFIER", "ADMIN_NO_SRP_AUTH", "NEW_PASSWORD_REQUIRED", "SMS_OTP", "PASSWORD", "WEB_AUTHN", "PASSWORD_SRP"
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/RespondToAuthChallenge AWS API Documentation
     #
@@ -12914,6 +13037,16 @@ module Aws::CognitoIdentityProvider
     #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/authorization-endpoint.html
     #   [2]: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-managing-saml-idp-naming.html
     #
+    # @option params [Hash<String,String>] :acr_mapping
+    #   A mapping between the authentication context class reference (ACR)
+    #   levels of your user pool and the ACR values of the external OpenID
+    #   Connect (OIDC) identity provider (IdP). This mapping has the same
+    #   behavior as it does when you create an identity provider. Only OIDC
+    #   IdPs support ACR mapping.
+    #
+    #   Setting `AcrMapping` is available in all feature plans. It isn't
+    #   restricted to the Essentials or Plus feature plan.
+    #
     # @return [Types::UpdateIdentityProviderResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::UpdateIdentityProviderResponse#identity_provider #identity_provider} => Types::IdentityProviderType
@@ -12930,6 +13063,9 @@ module Aws::CognitoIdentityProvider
     #       "AttributeMappingKeyType" => "StringType",
     #     },
     #     idp_identifiers: ["IdpIdentifierType"],
+    #     acr_mapping: {
+    #       "AcrMappingKeyType" => "AcrValueType",
+    #     },
     #   })
     #
     # @example Response structure
@@ -12943,6 +13079,8 @@ module Aws::CognitoIdentityProvider
     #   resp.identity_provider.attribute_mapping["AttributeMappingKeyType"] #=> String
     #   resp.identity_provider.idp_identifiers #=> Array
     #   resp.identity_provider.idp_identifiers[0] #=> String
+    #   resp.identity_provider.acr_mapping #=> Hash
+    #   resp.identity_provider.acr_mapping["AcrMappingKeyType"] #=> String
     #   resp.identity_provider.last_modified_date #=> Time
     #   resp.identity_provider.creation_date #=> Time
     #
@@ -13731,6 +13869,22 @@ module Aws::CognitoIdentityProvider
     #   parameter must match the existing configuration and cannot be
     #   modified.
     #
+    # @option params [Hash<String,Types::AcrLevelConfigType>] :acr_configuration
+    #   The custom names for the authentication context class reference (ACR)
+    #   levels in your user pool. This configuration has the same behavior as
+    #   it does when you create a user pool: you customize only the URI name
+    #   that Amazon Cognito reports for each of the four fixed ACR levels, and
+    #   any level that you don't specify keeps its default name. Each name
+    #   must be unique across all four levels, including default names.
+    #
+    #   Configuring custom ACR level names requires the Essentials or Plus
+    #   feature plan. To activate this setting, your user pool must be in the
+    #   [ Essentials tier][1] or higher.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html
+    #
     # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
     #
     # @example Request syntax with placeholder values
@@ -13858,6 +14012,11 @@ module Aws::CognitoIdentityProvider
     #     issuer_configuration: {
     #       type: "ORIGINAL", # accepts ORIGINAL, UPDATED
     #     },
+    #     acr_configuration: {
+    #       "AcrLevelKeyType" => {
+    #         acr_value: "AcrValueType", # required
+    #       },
+    #     },
     #   })
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/cognito-idp-2016-04-18/UpdateUserPool AWS API Documentation
@@ -14682,7 +14841,7 @@ module Aws::CognitoIdentityProvider
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-cognitoidentityprovider'
-      context[:gem_version] = '1.153.0'
+      context[:gem_version] = '1.155.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-cognitoidentityprovider/client_api.rb

@@ -23,6 +23,12 @@ module Aws::CognitoIdentityProvider
     AccountTakeoverActionsType = Shapes::StructureShape.new(name: 'AccountTakeoverActionsType')
     AccountTakeoverEventActionType = Shapes::StringShape.new(name: 'AccountTakeoverEventActionType')
     AccountTakeoverRiskConfigurationType = Shapes::StructureShape.new(name: 'AccountTakeoverRiskConfigurationType')
+    AcrConfigurationType = Shapes::MapShape.new(name: 'AcrConfigurationType')
+    AcrLevelConfigType = Shapes::StructureShape.new(name: 'AcrLevelConfigType')
+    AcrLevelKeyType = Shapes::StringShape.new(name: 'AcrLevelKeyType')
+    AcrMappingKeyType = Shapes::StringShape.new(name: 'AcrMappingKeyType')
+    AcrMappingType = Shapes::MapShape.new(name: 'AcrMappingType')
+    AcrValueType = Shapes::StringShape.new(name: 'AcrValueType')
     AddCustomAttributesRequest = Shapes::StructureShape.new(name: 'AddCustomAttributesRequest')
     AddCustomAttributesResponse = Shapes::StructureShape.new(name: 'AddCustomAttributesResponse')
     AddUserPoolClientSecretRequest = Shapes::StructureShape.new(name: 'AddUserPoolClientSecretRequest')
@@ -670,6 +676,15 @@ module Aws::CognitoIdentityProvider
     AccountTakeoverRiskConfigurationType.add_member(:actions, Shapes::ShapeRef.new(shape: AccountTakeoverActionsType, required: true, location_name: "Actions"))
     AccountTakeoverRiskConfigurationType.struct_class = Types::AccountTakeoverRiskConfigurationType
 
+    AcrConfigurationType.key = Shapes::ShapeRef.new(shape: AcrLevelKeyType)
+    AcrConfigurationType.value = Shapes::ShapeRef.new(shape: AcrLevelConfigType)
+
+    AcrLevelConfigType.add_member(:acr_value, Shapes::ShapeRef.new(shape: AcrValueType, required: true, location_name: "AcrValue"))
+    AcrLevelConfigType.struct_class = Types::AcrLevelConfigType
+
+    AcrMappingType.key = Shapes::ShapeRef.new(shape: AcrMappingKeyType)
+    AcrMappingType.value = Shapes::ShapeRef.new(shape: AcrValueType)
+
     AddCustomAttributesRequest.add_member(:user_pool_id, Shapes::ShapeRef.new(shape: UserPoolIdType, required: true, location_name: "UserPoolId"))
     AddCustomAttributesRequest.add_member(:custom_attributes, Shapes::ShapeRef.new(shape: CustomAttributesListType, required: true, location_name: "CustomAttributes"))
     AddCustomAttributesRequest.struct_class = Types::AddCustomAttributesRequest
@@ -868,6 +883,7 @@ module Aws::CognitoIdentityProvider
     AdminRespondToAuthChallengeResponse.add_member(:session, Shapes::ShapeRef.new(shape: SessionType, location_name: "Session"))
     AdminRespondToAuthChallengeResponse.add_member(:challenge_parameters, Shapes::ShapeRef.new(shape: ChallengeParametersType, location_name: "ChallengeParameters"))
     AdminRespondToAuthChallengeResponse.add_member(:authentication_result, Shapes::ShapeRef.new(shape: AuthenticationResultType, location_name: "AuthenticationResult"))
+    AdminRespondToAuthChallengeResponse.add_member(:available_challenges, Shapes::ShapeRef.new(shape: AvailableChallengeListType, location_name: "AvailableChallenges"))
     AdminRespondToAuthChallengeResponse.struct_class = Types::AdminRespondToAuthChallengeResponse
 
     AdminSetUserMFAPreferenceRequest.add_member(:sms_mfa_settings, Shapes::ShapeRef.new(shape: SMSMfaSettingsType, location_name: "SMSMfaSettings"))
@@ -1132,6 +1148,7 @@ module Aws::CognitoIdentityProvider
     CreateIdentityProviderRequest.add_member(:provider_details, Shapes::ShapeRef.new(shape: ProviderDetailsType, required: true, location_name: "ProviderDetails"))
     CreateIdentityProviderRequest.add_member(:attribute_mapping, Shapes::ShapeRef.new(shape: AttributeMappingType, location_name: "AttributeMapping"))
     CreateIdentityProviderRequest.add_member(:idp_identifiers, Shapes::ShapeRef.new(shape: IdpIdentifiersListType, location_name: "IdpIdentifiers"))
+    CreateIdentityProviderRequest.add_member(:acr_mapping, Shapes::ShapeRef.new(shape: AcrMappingType, location_name: "AcrMapping"))
     CreateIdentityProviderRequest.struct_class = Types::CreateIdentityProviderRequest
 
     CreateIdentityProviderResponse.add_member(:identity_provider, Shapes::ShapeRef.new(shape: IdentityProviderType, required: true, location_name: "IdentityProvider"))
@@ -1251,6 +1268,7 @@ module Aws::CognitoIdentityProvider
     CreateUserPoolRequest.add_member(:user_pool_tier, Shapes::ShapeRef.new(shape: UserPoolTierType, location_name: "UserPoolTier"))
     CreateUserPoolRequest.add_member(:key_configuration, Shapes::ShapeRef.new(shape: KeyConfigurationType, location_name: "KeyConfiguration"))
     CreateUserPoolRequest.add_member(:issuer_configuration, Shapes::ShapeRef.new(shape: IssuerConfigurationType, location_name: "IssuerConfiguration"))
+    CreateUserPoolRequest.add_member(:acr_configuration, Shapes::ShapeRef.new(shape: AcrConfigurationType, location_name: "AcrConfiguration"))
     CreateUserPoolRequest.struct_class = Types::CreateUserPoolRequest
 
     CreateUserPoolResponse.add_member(:user_pool, Shapes::ShapeRef.new(shape: UserPoolType, location_name: "UserPool"))
@@ -1666,6 +1684,7 @@ module Aws::CognitoIdentityProvider
     IdentityProviderType.add_member(:provider_details, Shapes::ShapeRef.new(shape: ProviderDetailsType, location_name: "ProviderDetails"))
     IdentityProviderType.add_member(:attribute_mapping, Shapes::ShapeRef.new(shape: AttributeMappingType, location_name: "AttributeMapping"))
     IdentityProviderType.add_member(:idp_identifiers, Shapes::ShapeRef.new(shape: IdpIdentifiersListType, location_name: "IdpIdentifiers"))
+    IdentityProviderType.add_member(:acr_mapping, Shapes::ShapeRef.new(shape: AcrMappingType, location_name: "AcrMapping"))
     IdentityProviderType.add_member(:last_modified_date, Shapes::ShapeRef.new(shape: DateType, location_name: "LastModifiedDate"))
     IdentityProviderType.add_member(:creation_date, Shapes::ShapeRef.new(shape: DateType, location_name: "CreationDate"))
     IdentityProviderType.struct_class = Types::IdentityProviderType
@@ -2052,6 +2071,7 @@ module Aws::CognitoIdentityProvider
     RespondToAuthChallengeResponse.add_member(:session, Shapes::ShapeRef.new(shape: SessionType, location_name: "Session"))
     RespondToAuthChallengeResponse.add_member(:challenge_parameters, Shapes::ShapeRef.new(shape: ChallengeParametersType, location_name: "ChallengeParameters"))
     RespondToAuthChallengeResponse.add_member(:authentication_result, Shapes::ShapeRef.new(shape: AuthenticationResultType, location_name: "AuthenticationResult"))
+    RespondToAuthChallengeResponse.add_member(:available_challenges, Shapes::ShapeRef.new(shape: AvailableChallengeListType, location_name: "AvailableChallenges"))
     RespondToAuthChallengeResponse.struct_class = Types::RespondToAuthChallengeResponse
 
     RevokeTokenRequest.add_member(:token, Shapes::ShapeRef.new(shape: TokenModelType, required: true, location_name: "Token"))
@@ -2338,6 +2358,7 @@ module Aws::CognitoIdentityProvider
     UpdateIdentityProviderRequest.add_member(:provider_details, Shapes::ShapeRef.new(shape: ProviderDetailsType, location_name: "ProviderDetails"))
     UpdateIdentityProviderRequest.add_member(:attribute_mapping, Shapes::ShapeRef.new(shape: AttributeMappingType, location_name: "AttributeMapping"))
     UpdateIdentityProviderRequest.add_member(:idp_identifiers, Shapes::ShapeRef.new(shape: IdpIdentifiersListType, location_name: "IdpIdentifiers"))
+    UpdateIdentityProviderRequest.add_member(:acr_mapping, Shapes::ShapeRef.new(shape: AcrMappingType, location_name: "AcrMapping"))
     UpdateIdentityProviderRequest.struct_class = Types::UpdateIdentityProviderRequest
 
     UpdateIdentityProviderResponse.add_member(:identity_provider, Shapes::ShapeRef.new(shape: IdentityProviderType, required: true, location_name: "IdentityProvider"))
@@ -2459,6 +2480,7 @@ module Aws::CognitoIdentityProvider
     UpdateUserPoolRequest.add_member(:user_pool_tier, Shapes::ShapeRef.new(shape: UserPoolTierType, location_name: "UserPoolTier"))
     UpdateUserPoolRequest.add_member(:key_configuration, Shapes::ShapeRef.new(shape: KeyConfigurationType, location_name: "KeyConfiguration"))
     UpdateUserPoolRequest.add_member(:issuer_configuration, Shapes::ShapeRef.new(shape: IssuerConfigurationType, location_name: "IssuerConfiguration"))
+    UpdateUserPoolRequest.add_member(:acr_configuration, Shapes::ShapeRef.new(shape: AcrConfigurationType, location_name: "AcrConfiguration"))
     UpdateUserPoolRequest.struct_class = Types::UpdateUserPoolRequest
 
     UpdateUserPoolResponse.struct_class = Types::UpdateUserPoolResponse
@@ -2611,6 +2633,7 @@ module Aws::CognitoIdentityProvider
     UserPoolType.add_member(:user_pool_tier, Shapes::ShapeRef.new(shape: UserPoolTierType, location_name: "UserPoolTier"))
     UserPoolType.add_member(:key_configuration, Shapes::ShapeRef.new(shape: KeyConfigurationType, location_name: "KeyConfiguration"))
     UserPoolType.add_member(:issuer_configuration, Shapes::ShapeRef.new(shape: IssuerConfigurationType, location_name: "IssuerConfiguration"))
+    UserPoolType.add_member(:acr_configuration, Shapes::ShapeRef.new(shape: AcrConfigurationType, location_name: "AcrConfiguration"))
     UserPoolType.struct_class = Types::UserPoolType
 
     UserType.add_member(:username, Shapes::ShapeRef.new(shape: UsernameType, location_name: "Username"))
@@ -2986,6 +3009,7 @@ module Aws::CognitoIdentityProvider
         o.errors << Shapes::ShapeRef.new(shape: UserNotFoundException)
         o.errors << Shapes::ShapeRef.new(shape: UserNotConfirmedException)
         o.errors << Shapes::ShapeRef.new(shape: OperationNotEnabledException)
+        o.errors << Shapes::ShapeRef.new(shape: FeatureUnavailableInTierException)
       end)
 
       api.add_operation(:admin_link_provider_for_user, Seahorse::Model::Operation.new.tap do |o|
@@ -4237,6 +4261,7 @@ module Aws::CognitoIdentityProvider
         o.errors << Shapes::ShapeRef.new(shape: InvalidEmailRoleAccessPolicyException)
         o.errors << Shapes::ShapeRef.new(shape: InvalidSmsRoleTrustRelationshipException)
         o.errors << Shapes::ShapeRef.new(shape: OperationNotEnabledException)
+        o.errors << Shapes::ShapeRef.new(shape: FeatureUnavailableInTierException)
         o.errors << Shapes::ShapeRef.new(shape: ForbiddenException)
       end)