@aws-sdk/client-cognito-identity-provider 3.193.0 → 3.196.0

package/dist-types/models/models_0.d.ts

@@ -1744,7 +1744,9 @@ export interface AdminListUserAuthEventsRequest {
      */
     Username: string | undefined;
     /**
-     * <p>The maximum number of authentication events to return.</p>
+     * <p>The maximum number of authentication events to return. Returns 60 events if you set
+     *                 <code>MaxResults</code> to 0, or if you don't include a <code>MaxResults</code>
+     *             parameter.</p>
      */
     MaxResults?: number;
     /**
@@ -3381,6 +3383,10 @@ export interface CreateUserImportJobResponse {
      */
     UserImportJob?: UserImportJobType;
 }
+export declare enum DeletionProtectionType {
+    ACTIVE = "ACTIVE",
+    INACTIVE = "INACTIVE"
+}
 /**
  * <p>The device-remembering configuration for a user pool. A <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPool.html">
  *                 DescribeUserPool</a> request returns a null value for this object when the user
@@ -3478,7 +3484,7 @@ export interface EmailConfigurationType {
      *                         default email limit is less than the required delivery volume. To achieve a
      *                         higher delivery volume, specify DEVELOPER to use your Amazon SES email
      *                         configuration.</p>
-     *                     <p>To look up the email delivery limit for the default option, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html">Limits in </a> in the <i> Developer Guide</i>.</p>
+     *                     <p>To look up the email delivery limit for the default option, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html">Limits</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
      *                     <p>The default FROM address is <code>no-reply@verificationemail.com</code>.
      *                         To customize the FROM address, provide the Amazon Resource Name (ARN) of an
      *                         Amazon SES verified email address for the <code>SourceArn</code>
@@ -3496,8 +3502,8 @@ export interface EmailConfigurationType {
      *                     <p>Before Amazon Cognito can email your users, it requires additional permissions to
      *                         call Amazon SES on your behalf. When you update your user pool with this option,
      *                         Amazon Cognito creates a <i>service-linked role</i>, which is a type of
-     *                         role, in your Amazon Web Services account. This role contains the permissions
-     *                         that allow to access Amazon SES and send email messages with your address. For
+     *                         role in your Amazon Web Services account. This role contains the permissions
+     *                         that allow you to access Amazon SES and send email messages from your email address. For
      *                         more information about the service-linked role that Amazon Cognito creates, see
      *                             <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/using-service-linked-roles.html">Using Service-Linked Roles for Amazon Cognito</a> in the
      *                             <i>Amazon Cognito Developer Guide</i>.</p>
@@ -3841,6 +3847,16 @@ export interface CreateUserPoolRequest {
      * <p>The policies associated with the new user pool.</p>
      */
     Policies?: UserPoolPolicyType;
+    /**
+     * <p>When active, <code>DeletionProtection</code> prevents accidental deletion of your user
+     *         pool. Before you can delete a user pool that you have protected against deletion, you
+     *         must deactivate this feature.</p>
+     *         <p>When you try to delete a protected user pool in a <code>DeleteUserPool</code> API request,
+     *         Amazon Cognito returns an <code>InvalidParameterException</code> error. To delete a protected user pool,
+     *         send a new <code>DeleteUserPool</code> request after you deactivate deletion protection in an
+     *         <code>UpdateUserPool</code> API request.</p>
+     */
+    DeletionProtection?: DeletionProtectionType | string;
     /**
      * <p>The Lambda trigger configuration information for the new user pool.</p>
      *         <note>
@@ -3978,6 +3994,16 @@ export interface UserPoolType {
      * <p>The policies associated with the user pool.</p>
      */
     Policies?: UserPoolPolicyType;
+    /**
+     * <p>When active, <code>DeletionProtection</code> prevents accidental deletion of your user
+     *         pool. Before you can delete a user pool that you have protected against deletion, you
+     *         must deactivate this feature.</p>
+     *         <p>When you try to delete a protected user pool in a <code>DeleteUserPool</code> API request,
+     *         Amazon Cognito returns an <code>InvalidParameterException</code> error. To delete a protected user pool,
+     *         send a new <code>DeleteUserPool</code> request after you deactivate deletion protection in an
+     *         <code>UpdateUserPool</code> API request.</p>
+     */
+    DeletionProtection?: DeletionProtectionType | string;
     /**
      * <p>The Lambda triggers associated with the user pool.</p>
      */
@@ -4256,6 +4282,8 @@ export interface CreateUserPoolClientRequest {
      *         You can't set <code>RefreshTokenValidity</code> to 0. If you do, Amazon Cognito overrides the
      *         value with the default value of 30 days. <i>Valid range</i> is displayed below
      *         in seconds.</p>
+     *         <p>If you don't specify otherwise in the configuration of your app client, your refresh
+     *         tokens are valid for 30 days.</p>
      */
     RefreshTokenValidity?: number;
     /**
@@ -4268,6 +4296,8 @@ export interface CreateUserPoolClientRequest {
      *         their access token for 10 hours.</p>
      *         <p>The default time unit for <code>AccessTokenValidity</code> in an API request is hours.
      *         <i>Valid range</i> is displayed below in seconds.</p>
+     *         <p>If you don't specify otherwise in the configuration of your app client, your access
+     *         tokens are valid for one hour.</p>
      */
     AccessTokenValidity?: number;
     /**
@@ -4280,6 +4310,8 @@ export interface CreateUserPoolClientRequest {
      *         session with their ID token for 10 hours.</p>
      *         <p>The default time unit for <code>AccessTokenValidity</code> in an API request is hours.
      *         <i>Valid range</i> is displayed below in seconds.</p>
+     *         <p>If you don't specify otherwise in the configuration of your app client, your ID
+     *         tokens are valid for one hour.</p>
      */
     IdTokenValidity?: number;
     /**
@@ -4302,44 +4334,46 @@ export interface CreateUserPoolClientRequest {
      */
     WriteAttributes?: string[];
     /**
-     * <p>The authentication flows that are supported by the user pool clients. Flow names
-     *             without the <code>ALLOW_</code> prefix are no longer supported, in favor of new names
-     *             with the <code>ALLOW_</code> prefix.</p>
-     *         <note>
-     *             <p>Values with <code>ALLOW_</code> prefix must be used only along with the
-     *                     <code>ALLOW_</code> prefix.</p>
-     *         </note>
-     *         <p>Valid values include:</p>
-     *         <dl>
-     *             <dt>ALLOW_ADMIN_USER_PASSWORD_AUTH</dt>
-     *             <dd>
-     *                <p>Enable admin based user password
-     *                     authentication flow <code>ADMIN_USER_PASSWORD_AUTH</code>. This setting replaces
-     *                     the <code>ADMIN_NO_SRP_AUTH</code> setting. With this authentication flow, Amazon Cognito
-     *                     receives the password in the request instead of using the Secure Remote Password
-     *                     (SRP) protocol to verify passwords.</p>
-     *             </dd>
-     *             <dt>ALLOW_CUSTOM_AUTH</dt>
-     *             <dd>
-     *                <p>Enable Lambda trigger based authentication.</p>
-     *             </dd>
-     *             <dt>ALLOW_USER_PASSWORD_AUTH</dt>
-     *             <dd>
-     *                <p>Enable user password-based
-     *                     authentication. In this flow, Amazon Cognito receives the password in the request instead
-     *                     of using the SRP protocol to verify passwords.</p>
-     *             </dd>
-     *             <dt>ALLOW_USER_SRP_AUTH</dt>
-     *             <dd>
-     *                <p>Enable SRP-based authentication.</p>
-     *             </dd>
-     *             <dt>ALLOW_REFRESH_TOKEN_AUTH</dt>
-     *             <dd>
-     *                <p>Enable the authflow that refreshes tokens.</p>
-     *             </dd>
-     *          </dl>
-     *         <p>If you don't specify a value for <code>ExplicitAuthFlows</code>, your user client
-     *             supports <code>ALLOW_USER_SRP_AUTH</code> and <code>ALLOW_CUSTOM_AUTH</code>.</p>
+     * <p>The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in
+     * your users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and
+     * password, or a custom authentication process that you define with Lambda functions.</p>
+     *          <note>
+     *             <p>If you don't specify a value for <code>ExplicitAuthFlows</code>, your user client supports <code>ALLOW_REFRESH_TOKEN_AUTH</code>, <code>ALLOW_USER_SRP_AUTH</code>, and <code>ALLOW_CUSTOM_AUTH</code>.</p>
+     *          </note>
+     *          <p>Valid values include:</p>
+     *          <ul>
+     *             <li>
+     *                <p>
+     *                   <code>ALLOW_ADMIN_USER_PASSWORD_AUTH</code>: Enable admin based user password
+     *             authentication flow <code>ADMIN_USER_PASSWORD_AUTH</code>. This setting replaces
+     *             the <code>ADMIN_NO_SRP_AUTH</code> setting. With this authentication flow, your app
+     *             passes a user name and password to Amazon Cognito in the request, instead of using the Secure
+     *             Remote Password (SRP) protocol to securely transmit the password.</p>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <code>ALLOW_CUSTOM_AUTH</code>: Enable Lambda trigger based
+     *             authentication.</p>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <code>ALLOW_USER_PASSWORD_AUTH</code>: Enable user password-based
+     *             authentication. In this flow, Amazon Cognito receives the password in the request instead
+     *             of using the SRP protocol to verify passwords.</p>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <code>ALLOW_USER_SRP_AUTH</code>: Enable SRP-based authentication.</p>
+     *             </li>
+     *             <li>
+     *                <p>
+     *                   <code>ALLOW_REFRESH_TOKEN_AUTH</code>: Enable authflow to refresh
+     *             tokens.</p>
+     *             </li>
+     *          </ul>
+     *          <p>In some environments, you will see the values <code>ADMIN_NO_SRP_AUTH</code>, <code>CUSTOM_AUTH_FLOW_ONLY</code>, or <code>USER_PASSWORD_AUTH</code>.
+     * You can't assign these legacy <code>ExplicitAuthFlows</code> values to user pool clients at the same time as values that begin with <code>ALLOW_</code>,
+     * like <code>ALLOW_USER_SRP_AUTH</code>.</p>
      */
     ExplicitAuthFlows?: (ExplicitAuthFlowsType | string)[];
     /**
@@ -4527,6 +4561,8 @@ export interface UserPoolClientType {
      *         You can't set <code>RefreshTokenValidity</code> to 0. If you do, Amazon Cognito overrides the
      *         value with the default value of 30 days. <i>Valid range</i> is displayed below
      *         in seconds.</p>
+     *         <p>If you don't specify otherwise in the configuration of your app client, your refresh
+     *         tokens are valid for 30 days.</p>
      */
     RefreshTokenValidity?: number;
     /**
@@ -4539,6 +4575,8 @@ export interface UserPoolClientType {
      *         their access token for 10 hours.</p>
      *         <p>The default time unit for <code>AccessTokenValidity</code> in an API request is hours.
      *         <i>Valid range</i> is displayed below in seconds.</p>
+     *         <p>If you don't specify otherwise in the configuration of your app client, your access
+     *         tokens are valid for one hour.</p>
      */
     AccessTokenValidity?: number;
     /**
@@ -4551,6 +4589,8 @@ export interface UserPoolClientType {
      *         session with their ID token for 10 hours.</p>
      *         <p>The default time unit for <code>AccessTokenValidity</code> in an API request is hours.
      *         <i>Valid range</i> is displayed below in seconds.</p>
+     *         <p>If you don't specify otherwise in the configuration of your app client, your ID
+     *         tokens are valid for one hour.</p>
      */
     IdTokenValidity?: number;
     /**
@@ -4567,41 +4607,46 @@ export interface UserPoolClientType {
      */
     WriteAttributes?: string[];
     /**
-     * <p>The authentication flows that are supported by the user pool clients. Flow names
-     *             without the <code>ALLOW_</code> prefix are no longer supported in favor of new names
-     *             with the <code>ALLOW_</code> prefix. Note that values with <code>ALLOW_</code> prefix
-     *             must be used only along with values including the <code>ALLOW_</code> prefix.</p>
-     *         <p>Valid values include:</p>
-     *         <ul>
+     * <p>The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in
+     * your users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and
+     * password, or a custom authentication process that you define with Lambda functions.</p>
+     *          <note>
+     *             <p>If you don't specify a value for <code>ExplicitAuthFlows</code>, your user client supports <code>ALLOW_REFRESH_TOKEN_AUTH</code>, <code>ALLOW_USER_SRP_AUTH</code>, and <code>ALLOW_CUSTOM_AUTH</code>.</p>
+     *          </note>
+     *          <p>Valid values include:</p>
+     *          <ul>
      *             <li>
-     *                 <p>
+     *                <p>
      *                   <code>ALLOW_ADMIN_USER_PASSWORD_AUTH</code>: Enable admin based user password
-     *                     authentication flow <code>ADMIN_USER_PASSWORD_AUTH</code>. This setting replaces
-     *                     the <code>ADMIN_NO_SRP_AUTH</code> setting. With this authentication flow, Amazon Cognito
-     *                     receives the password in the request instead of using the Secure Remote Password
-     *                     (SRP) protocol to verify passwords.</p>
+     *             authentication flow <code>ADMIN_USER_PASSWORD_AUTH</code>. This setting replaces
+     *             the <code>ADMIN_NO_SRP_AUTH</code> setting. With this authentication flow, your app
+     *             passes a user name and password to Amazon Cognito in the request, instead of using the Secure
+     *             Remote Password (SRP) protocol to securely transmit the password.</p>
      *             </li>
      *             <li>
-     *                 <p>
+     *                <p>
      *                   <code>ALLOW_CUSTOM_AUTH</code>: Enable Lambda trigger based
-     *                     authentication.</p>
+     *             authentication.</p>
      *             </li>
      *             <li>
-     *                 <p>
+     *                <p>
      *                   <code>ALLOW_USER_PASSWORD_AUTH</code>: Enable user password-based
-     *                     authentication. In this flow, Amazon Cognito receives the password in the request instead
-     *                     of using the SRP protocol to verify passwords.</p>
+     *             authentication. In this flow, Amazon Cognito receives the password in the request instead
+     *             of using the SRP protocol to verify passwords.</p>
      *             </li>
      *             <li>
-     *                 <p>
+     *                <p>
      *                   <code>ALLOW_USER_SRP_AUTH</code>: Enable SRP-based authentication.</p>
      *             </li>
      *             <li>
-     *                 <p>
+     *                <p>
      *                   <code>ALLOW_REFRESH_TOKEN_AUTH</code>: Enable authflow to refresh
-     *                     tokens.</p>
+     *             tokens.</p>
      *             </li>
      *          </ul>
+     *          <p>In some environments, you will see the values <code>ADMIN_NO_SRP_AUTH</code>, <code>CUSTOM_AUTH_FLOW_ONLY</code>, or <code>USER_PASSWORD_AUTH</code>.
+     * You can't assign these legacy <code>ExplicitAuthFlows</code> values to user pool clients at the same time as values that begin with <code>ALLOW_</code>,
+     * like <code>ALLOW_USER_SRP_AUTH</code>.</p>
      */
     ExplicitAuthFlows?: (ExplicitAuthFlowsType | string)[];
     /**
@@ -4944,7 +4989,7 @@ export interface DescribeIdentityProviderRequest {
 }
 export interface DescribeIdentityProviderResponse {
     /**
-     * <p>The IdP that was deleted.</p>
+     * <p>The identity provider details.</p>
      */
     IdentityProvider: IdentityProviderType | undefined;
 }
@@ -5370,7 +5415,7 @@ export interface GetIdentityProviderByIdentifierRequest {
 }
 export interface GetIdentityProviderByIdentifierResponse {
     /**
-     * <p>The IdP object.</p>
+     * <p>The identity provider details.</p>
      */
     IdentityProvider: IdentityProviderType | undefined;
 }
@@ -6716,7 +6761,7 @@ export interface SetUserPoolMfaConfigRequest {
     SoftwareTokenMfaConfiguration?: SoftwareTokenMfaConfigType;
     /**
      * <p>The MFA configuration. If you set the MfaConfiguration value to ‘ON’, only users who
-     *             have set up an MFA factor can sign in. To learn more, see <a href="cognito/latest/developerguide/user-pool-settings-mfa.html">Adding Multi-Factor
+     *             have set up an MFA factor can sign in. To learn more, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa.html">Adding Multi-Factor
      *                 Authentication (MFA) to a user pool</a>. Valid values include:</p>
      *         <ul>
      *             <li>
@@ -6785,86 +6830,6 @@ export interface SetUserSettingsRequest {
  */
 export interface SetUserSettingsResponse {
 }
-/**
- * <p>Represents the request to register a user.</p>
- */
-export interface SignUpRequest {
-    /**
-     * <p>The ID of the client associated with the user pool.</p>
-     */
-    ClientId: string | undefined;
-    /**
-     * <p>A keyed-hash message authentication code (HMAC) calculated using the secret key of a
-     *             user pool client and username plus the client ID in the message.</p>
-     */
-    SecretHash?: string;
-    /**
-     * <p>The user name of the user you want to register.</p>
-     */
-    Username: string | undefined;
-    /**
-     * <p>The password of the user you want to register.</p>
-     */
-    Password: string | undefined;
-    /**
-     * <p>An array of name-value pairs representing user attributes.</p>
-     *         <p>For custom attributes, you must prepend the <code>custom:</code> prefix to the
-     *             attribute name.</p>
-     */
-    UserAttributes?: AttributeType[];
-    /**
-     * <p>The validation data in the request to register a user.</p>
-     */
-    ValidationData?: AttributeType[];
-    /**
-     * <p>The Amazon Pinpoint analytics metadata that contributes to your metrics for
-     *                 <code>SignUp</code> calls.</p>
-     */
-    AnalyticsMetadata?: AnalyticsMetadataType;
-    /**
-     * <p>Contextual data about your user session, such as the device fingerprint, IP address, or location. Amazon Cognito advanced
-     * security evaluates the risk of an authentication event based on the context that your app generates and passes to Amazon Cognito
-     * when it makes API requests.</p>
-     */
-    UserContextData?: UserContextDataType;
-    /**
-     * <p>A map of custom key-value pairs that you can provide as input for any custom workflows
-     *             that this action triggers.</p>
-     *         <p>You create custom workflows by assigning Lambda functions to user pool triggers.
-     *             When you use the SignUp API action, Amazon Cognito invokes any functions that are assigned to the
-     *             following triggers: <i>pre sign-up</i>, <i>custom
-     *                 message</i>, and <i>post confirmation</i>. When Amazon Cognito invokes
-     *             any of these functions, it passes a JSON payload, which the function receives as input.
-     *             This payload contains a <code>clientMetadata</code> attribute, which provides the data
-     *             that you assigned to the ClientMetadata parameter in your SignUp request. In your
-     *             function code in Lambda, you can process the <code>clientMetadata</code> value to enhance
-     *             your workflow for your specific needs.</p>
-     *
-     *          <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
-     * Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
-     *
-     *         <note>
-     *             <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
-     *                 following:</p>
-     *             <ul>
-     *                <li>
-     *                     <p>Store the ClientMetadata value. This data is available only to Lambda
-     *                         triggers that are assigned to a user pool to support custom workflows. If
-     *                         your user pool configuration doesn't include triggers, the ClientMetadata
-     *                         parameter serves no purpose.</p>
-     *                 </li>
-     *                <li>
-     *                     <p>Validate the ClientMetadata value.</p>
-     *                 </li>
-     *                <li>
-     *                     <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
-     *                         information.</p>
-     *                 </li>
-     *             </ul>
-     *         </note>
-     */
-    ClientMetadata?: Record<string, string>;
-}
 /**
  * @internal
  */
@@ -7761,7 +7726,3 @@ export declare const SetUserSettingsRequestFilterSensitiveLog: (obj: SetUserSett
  * @internal
  */
 export declare const SetUserSettingsResponseFilterSensitiveLog: (obj: SetUserSettingsResponse) => any;
-/**
- * @internal
- */
-export declare const SignUpRequestFilterSensitiveLog: (obj: SignUpRequest) => any;

package/dist-types/models/models_1.d.ts

@@ -1,6 +1,86 @@
 import { ExceptionOptionType as __ExceptionOptionType } from "@aws-sdk/smithy-client";
 import { CognitoIdentityProviderServiceException as __BaseException } from "./CognitoIdentityProviderServiceException";
-import { AccountRecoverySettingType, AdminCreateUserConfigType, AnalyticsConfigurationType, AttributeType, CodeDeliveryDetailsType, CustomDomainConfigType, DeviceConfigurationType, DeviceRememberedStatusType, EmailConfigurationType, ExplicitAuthFlowsType, FeedbackValueType, GroupType, IdentityProviderType, LambdaConfigType, OAuthFlowType, PreventUserExistenceErrorTypes, ResourceServerScopeType, ResourceServerType, SmsConfigurationType, TokenValidityUnitsType, UserAttributeUpdateSettingsType, UserImportJobType, UserPoolAddOnsType, UserPoolClientType, UserPoolMfaType, UserPoolPolicyType, VerificationMessageTemplateType, VerifiedAttributeType } from "./models_0";
+import { AccountRecoverySettingType, AdminCreateUserConfigType, AnalyticsConfigurationType, AnalyticsMetadataType, AttributeType, CodeDeliveryDetailsType, CustomDomainConfigType, DeletionProtectionType, DeviceConfigurationType, DeviceRememberedStatusType, EmailConfigurationType, ExplicitAuthFlowsType, FeedbackValueType, GroupType, IdentityProviderType, LambdaConfigType, OAuthFlowType, PreventUserExistenceErrorTypes, ResourceServerScopeType, ResourceServerType, SmsConfigurationType, TokenValidityUnitsType, UserAttributeUpdateSettingsType, UserContextDataType, UserImportJobType, UserPoolAddOnsType, UserPoolClientType, UserPoolMfaType, UserPoolPolicyType, VerificationMessageTemplateType, VerifiedAttributeType } from "./models_0";
+/**
+ * <p>Represents the request to register a user.</p>
+ */
+export interface SignUpRequest {
+    /**
+     * <p>The ID of the client associated with the user pool.</p>
+     */
+    ClientId: string | undefined;
+    /**
+     * <p>A keyed-hash message authentication code (HMAC) calculated using the secret key of a
+     *             user pool client and username plus the client ID in the message.</p>
+     */
+    SecretHash?: string;
+    /**
+     * <p>The user name of the user you want to register.</p>
+     */
+    Username: string | undefined;
+    /**
+     * <p>The password of the user you want to register.</p>
+     */
+    Password: string | undefined;
+    /**
+     * <p>An array of name-value pairs representing user attributes.</p>
+     *         <p>For custom attributes, you must prepend the <code>custom:</code> prefix to the
+     *             attribute name.</p>
+     */
+    UserAttributes?: AttributeType[];
+    /**
+     * <p>The validation data in the request to register a user.</p>
+     */
+    ValidationData?: AttributeType[];
+    /**
+     * <p>The Amazon Pinpoint analytics metadata that contributes to your metrics for
+     *                 <code>SignUp</code> calls.</p>
+     */
+    AnalyticsMetadata?: AnalyticsMetadataType;
+    /**
+     * <p>Contextual data about your user session, such as the device fingerprint, IP address, or location. Amazon Cognito advanced
+     * security evaluates the risk of an authentication event based on the context that your app generates and passes to Amazon Cognito
+     * when it makes API requests.</p>
+     */
+    UserContextData?: UserContextDataType;
+    /**
+     * <p>A map of custom key-value pairs that you can provide as input for any custom workflows
+     *             that this action triggers.</p>
+     *         <p>You create custom workflows by assigning Lambda functions to user pool triggers.
+     *             When you use the SignUp API action, Amazon Cognito invokes any functions that are assigned to the
+     *             following triggers: <i>pre sign-up</i>, <i>custom
+     *                 message</i>, and <i>post confirmation</i>. When Amazon Cognito invokes
+     *             any of these functions, it passes a JSON payload, which the function receives as input.
+     *             This payload contains a <code>clientMetadata</code> attribute, which provides the data
+     *             that you assigned to the ClientMetadata parameter in your SignUp request. In your
+     *             function code in Lambda, you can process the <code>clientMetadata</code> value to enhance
+     *             your workflow for your specific needs.</p>
+     *
+     *          <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
+     * Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
+     *
+     *         <note>
+     *             <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
+     *                 following:</p>
+     *             <ul>
+     *                <li>
+     *                     <p>Store the ClientMetadata value. This data is available only to Lambda
+     *                         triggers that are assigned to a user pool to support custom workflows. If
+     *                         your user pool configuration doesn't include triggers, the ClientMetadata
+     *                         parameter serves no purpose.</p>
+     *                 </li>
+     *                <li>
+     *                     <p>Validate the ClientMetadata value.</p>
+     *                 </li>
+     *                <li>
+     *                     <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
+     *                         information.</p>
+     *                 </li>
+     *             </ul>
+     *         </note>
+     */
+    ClientMetadata?: Record<string, string>;
+}
 /**
  * <p>The response from the server for a registration request.</p>
  */
@@ -194,7 +274,7 @@ export interface UpdateIdentityProviderRequest {
 }
 export interface UpdateIdentityProviderResponse {
     /**
-     * <p>The IdP object.</p>
+     * <p>The identity provider details.</p>
      */
     IdentityProvider: IdentityProviderType | undefined;
 }
@@ -302,6 +382,16 @@ export interface UpdateUserPoolRequest {
      * <p>A container with the policies you want to update in a user pool.</p>
      */
     Policies?: UserPoolPolicyType;
+    /**
+     * <p>When active, <code>DeletionProtection</code> prevents accidental deletion of your user
+     *         pool. Before you can delete a user pool that you have protected against deletion, you
+     *         must deactivate this feature.</p>
+     *         <p>When you try to delete a protected user pool in a <code>DeleteUserPool</code> API request,
+     *         Amazon Cognito returns an <code>InvalidParameterException</code> error. To delete a protected user pool,
+     *         send a new <code>DeleteUserPool</code> request after you deactivate deletion protection in an
+     *         <code>UpdateUserPool</code> API request.</p>
+     */
+    DeletionProtection?: DeletionProtectionType | string;
     /**
      * <p>The Lambda configuration information from the request to update the user pool.</p>
      */
@@ -441,6 +531,8 @@ export interface UpdateUserPoolClientRequest {
      *         You can't set <code>RefreshTokenValidity</code> to 0. If you do, Amazon Cognito overrides the
      *         value with the default value of 30 days. <i>Valid range</i> is displayed below
      *         in seconds.</p>
+     *         <p>If you don't specify otherwise in the configuration of your app client, your refresh
+     *         tokens are valid for 30 days.</p>
      */
     RefreshTokenValidity?: number;
     /**
@@ -453,6 +545,8 @@ export interface UpdateUserPoolClientRequest {
      *         their access token for 10 hours.</p>
      *         <p>The default time unit for <code>AccessTokenValidity</code> in an API request is hours.
      *         <i>Valid range</i> is displayed below in seconds.</p>
+     *         <p>If you don't specify otherwise in the configuration of your app client, your access
+     *         tokens are valid for one hour.</p>
      */
     AccessTokenValidity?: number;
     /**
@@ -465,6 +559,8 @@ export interface UpdateUserPoolClientRequest {
      *         session with their ID token for 10 hours.</p>
      *         <p>The default time unit for <code>AccessTokenValidity</code> in an API request is hours.
      *         <i>Valid range</i> is displayed below in seconds.</p>
+     *         <p>If you don't specify otherwise in the configuration of your app client, your ID
+     *         tokens are valid for one hour.</p>
      */
     IdTokenValidity?: number;
     /**
@@ -481,41 +577,46 @@ export interface UpdateUserPoolClientRequest {
      */
     WriteAttributes?: string[];
     /**
-     * <p>The authentication flows that are supported by the user pool clients. Flow names
-     *             without the <code>ALLOW_</code> prefix are no longer supported in favor of new names
-     *             with the <code>ALLOW_</code> prefix. Note that values with <code>ALLOW_</code> prefix
-     *             must be used only along with values with the <code>ALLOW_</code> prefix.</p>
-     *         <p>Valid values include:</p>
-     *         <ul>
+     * <p>The authentication flows that you want your user pool client to support. For each app client in your user pool, you can sign in
+     * your users with any combination of one or more flows, including with a user name and Secure Remote Password (SRP), a user name and
+     * password, or a custom authentication process that you define with Lambda functions.</p>
+     *          <note>
+     *             <p>If you don't specify a value for <code>ExplicitAuthFlows</code>, your user client supports <code>ALLOW_REFRESH_TOKEN_AUTH</code>, <code>ALLOW_USER_SRP_AUTH</code>, and <code>ALLOW_CUSTOM_AUTH</code>.</p>
+     *          </note>
+     *          <p>Valid values include:</p>
+     *          <ul>
      *             <li>
-     *                 <p>
+     *                <p>
      *                   <code>ALLOW_ADMIN_USER_PASSWORD_AUTH</code>: Enable admin based user password
-     *                     authentication flow <code>ADMIN_USER_PASSWORD_AUTH</code>. This setting replaces
-     *                     the <code>ADMIN_NO_SRP_AUTH</code> setting. With this authentication flow, Amazon Cognito
-     *                     receives the password in the request instead of using the Secure Remote Password
-     *                     (SRP) protocol to verify passwords.</p>
+     *             authentication flow <code>ADMIN_USER_PASSWORD_AUTH</code>. This setting replaces
+     *             the <code>ADMIN_NO_SRP_AUTH</code> setting. With this authentication flow, your app
+     *             passes a user name and password to Amazon Cognito in the request, instead of using the Secure
+     *             Remote Password (SRP) protocol to securely transmit the password.</p>
      *             </li>
      *             <li>
-     *                 <p>
+     *                <p>
      *                   <code>ALLOW_CUSTOM_AUTH</code>: Enable Lambda trigger based
-     *                     authentication.</p>
+     *             authentication.</p>
      *             </li>
      *             <li>
-     *                 <p>
+     *                <p>
      *                   <code>ALLOW_USER_PASSWORD_AUTH</code>: Enable user password-based
-     *                     authentication. In this flow, Amazon Cognito receives the password in the request instead
-     *                     of using the SRP protocol to verify passwords.</p>
+     *             authentication. In this flow, Amazon Cognito receives the password in the request instead
+     *             of using the SRP protocol to verify passwords.</p>
      *             </li>
      *             <li>
-     *                 <p>
+     *                <p>
      *                   <code>ALLOW_USER_SRP_AUTH</code>: Enable SRP-based authentication.</p>
      *             </li>
      *             <li>
-     *                 <p>
+     *                <p>
      *                   <code>ALLOW_REFRESH_TOKEN_AUTH</code>: Enable authflow to refresh
-     *                     tokens.</p>
+     *             tokens.</p>
      *             </li>
      *          </ul>
+     *          <p>In some environments, you will see the values <code>ADMIN_NO_SRP_AUTH</code>, <code>CUSTOM_AUTH_FLOW_ONLY</code>, or <code>USER_PASSWORD_AUTH</code>.
+     * You can't assign these legacy <code>ExplicitAuthFlows</code> values to user pool clients at the same time as values that begin with <code>ALLOW_</code>,
+     * like <code>ALLOW_USER_SRP_AUTH</code>.</p>
      */
     ExplicitAuthFlows?: (ExplicitAuthFlowsType | string)[];
     /**
@@ -773,6 +874,10 @@ export interface VerifyUserAttributeRequest {
  */
 export interface VerifyUserAttributeResponse {
 }
+/**
+ * @internal
+ */
+export declare const SignUpRequestFilterSensitiveLog: (obj: SignUpRequest) => any;
 /**
  * @internal
  */

package/dist-types/runtimeConfig.browser.d.ts

@@ -26,8 +26,10 @@ export declare const getRuntimeConfig: (config: CognitoIdentityProviderClientCon
     disableHostPrefix: boolean;
     logger: import("@aws-sdk/types").Logger;
     serviceId: string;
-    regionInfoProvider: import("@aws-sdk/types").RegionInfoProvider;
-    endpoint?: string | import("@aws-sdk/types").Endpoint | import("@aws-sdk/types").Provider<import("@aws-sdk/types").Endpoint> | undefined;
+    endpoint?: ((string | import("@aws-sdk/types").Endpoint | import("@aws-sdk/types").Provider<import("@aws-sdk/types").Endpoint> | import("@aws-sdk/types").EndpointV2 | import("@aws-sdk/types").Provider<import("@aws-sdk/types").EndpointV2>) & (string | import("@aws-sdk/types").Provider<string>)) | undefined;
+    endpointProvider: (endpointParams: import("./endpoint/EndpointParameters").EndpointParameters, context?: {
+        logger?: import("@aws-sdk/types").Logger | undefined;
+    }) => import("@aws-sdk/types").EndpointV2;
     tls?: boolean | undefined;
     retryStrategy?: import("@aws-sdk/types").RetryStrategy | undefined;
     credentials?: import("@aws-sdk/types").Credentials | import("@aws-sdk/types").Provider<import("@aws-sdk/types").Credentials> | undefined;