@aws-sdk/client-cognito-identity-provider 3.363.0 → 3.370.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist-cjs/commands/VerifySoftwareTokenCommand.js +1 -1
- package/dist-cjs/endpoint/ruleset.js +3 -3
- package/dist-cjs/models/models_0.js +22 -2
- package/dist-cjs/models/models_1.js +9 -1
- package/dist-es/commands/VerifySoftwareTokenCommand.js +2 -2
- package/dist-es/endpoint/ruleset.js +3 -3
- package/dist-es/models/models_0.js +19 -0
- package/dist-es/models/models_1.js +7 -0
- package/dist-types/CognitoIdentityProvider.d.ts +2 -2
- package/dist-types/CognitoIdentityProviderClient.d.ts +2 -2
- package/dist-types/commands/AdminAddUserToGroupCommand.d.ts +1 -1
- package/dist-types/commands/AdminConfirmSignUpCommand.d.ts +1 -1
- package/dist-types/commands/AdminCreateUserCommand.d.ts +5 -7
- package/dist-types/commands/AdminDeleteUserAttributesCommand.d.ts +1 -1
- package/dist-types/commands/AdminDeleteUserCommand.d.ts +1 -1
- package/dist-types/commands/AdminDisableProviderForUserCommand.d.ts +5 -5
- package/dist-types/commands/AdminDisableUserCommand.d.ts +1 -1
- package/dist-types/commands/AdminEnableUserCommand.d.ts +1 -1
- package/dist-types/commands/AdminForgetDeviceCommand.d.ts +1 -1
- package/dist-types/commands/AdminGetDeviceCommand.d.ts +1 -1
- package/dist-types/commands/AdminGetUserCommand.d.ts +1 -1
- package/dist-types/commands/AdminInitiateAuthCommand.d.ts +1 -3
- package/dist-types/commands/AdminLinkProviderForUserCommand.d.ts +6 -7
- package/dist-types/commands/AdminListDevicesCommand.d.ts +1 -1
- package/dist-types/commands/AdminListGroupsForUserCommand.d.ts +1 -1
- package/dist-types/commands/AdminRemoveUserFromGroupCommand.d.ts +1 -1
- package/dist-types/commands/AdminResetUserPasswordCommand.d.ts +2 -4
- package/dist-types/commands/AdminRespondToAuthChallengeCommand.d.ts +1 -3
- package/dist-types/commands/AdminSetUserPasswordCommand.d.ts +2 -2
- package/dist-types/commands/AdminUpdateDeviceStatusCommand.d.ts +1 -1
- package/dist-types/commands/AdminUpdateUserAttributesCommand.d.ts +3 -5
- package/dist-types/commands/AdminUserGlobalSignOutCommand.d.ts +1 -1
- package/dist-types/commands/AssociateSoftwareTokenCommand.d.ts +2 -2
- package/dist-types/commands/CreateGroupCommand.d.ts +1 -1
- package/dist-types/commands/CreateUserPoolClientCommand.d.ts +1 -1
- package/dist-types/commands/CreateUserPoolCommand.d.ts +0 -1
- package/dist-types/commands/DeleteGroupCommand.d.ts +1 -1
- package/dist-types/commands/ForgotPasswordCommand.d.ts +0 -1
- package/dist-types/commands/GetGroupCommand.d.ts +1 -1
- package/dist-types/commands/GetSigningCertificateCommand.d.ts +1 -1
- package/dist-types/commands/GetUserAttributeVerificationCodeCommand.d.ts +0 -1
- package/dist-types/commands/InitiateAuthCommand.d.ts +0 -1
- package/dist-types/commands/ListGroupsCommand.d.ts +1 -1
- package/dist-types/commands/ListTagsForResourceCommand.d.ts +2 -2
- package/dist-types/commands/ListUsersInGroupCommand.d.ts +1 -1
- package/dist-types/commands/ResendConfirmationCodeCommand.d.ts +0 -1
- package/dist-types/commands/RespondToAuthChallengeCommand.d.ts +0 -1
- package/dist-types/commands/SetRiskConfigurationCommand.d.ts +1 -1
- package/dist-types/commands/SetUICustomizationCommand.d.ts +3 -3
- package/dist-types/commands/SetUserPoolMfaConfigCommand.d.ts +0 -1
- package/dist-types/commands/SignUpCommand.d.ts +0 -1
- package/dist-types/commands/TagResourceCommand.d.ts +3 -3
- package/dist-types/commands/UpdateGroupCommand.d.ts +1 -1
- package/dist-types/commands/UpdateResourceServerCommand.d.ts +2 -2
- package/dist-types/commands/UpdateUserAttributesCommand.d.ts +0 -1
- package/dist-types/commands/UpdateUserPoolClientCommand.d.ts +3 -3
- package/dist-types/commands/UpdateUserPoolCommand.d.ts +0 -1
- package/dist-types/commands/UpdateUserPoolDomainCommand.d.ts +7 -7
- package/dist-types/commands/VerifyUserAttributeCommand.d.ts +1 -1
- package/dist-types/index.d.ts +2 -2
- package/dist-types/models/models_0.d.ts +627 -658
- package/dist-types/models/models_1.d.ts +74 -74
- package/dist-types/ts3.4/models/models_0.d.ts +3 -0
- package/dist-types/ts3.4/models/models_1.d.ts +3 -0
- package/package.json +17 -18
|
@@ -64,23 +64,23 @@ export interface AccountTakeoverActionType {
|
|
|
64
64
|
/**
|
|
65
65
|
* <p>The action to take in response to the account takeover action. Valid values are as
|
|
66
66
|
* follows:</p>
|
|
67
|
-
*
|
|
67
|
+
* <ul>
|
|
68
68
|
* <li>
|
|
69
|
-
*
|
|
69
|
+
* <p>
|
|
70
70
|
* <code>BLOCK</code> Choosing this action will block the request.</p>
|
|
71
71
|
* </li>
|
|
72
72
|
* <li>
|
|
73
|
-
*
|
|
73
|
+
* <p>
|
|
74
74
|
* <code>MFA_IF_CONFIGURED</code> Present an MFA challenge if user has configured
|
|
75
75
|
* it, else allow the request.</p>
|
|
76
76
|
* </li>
|
|
77
77
|
* <li>
|
|
78
|
-
*
|
|
78
|
+
* <p>
|
|
79
79
|
* <code>MFA_REQUIRED</code> Present an MFA challenge if user has configured it,
|
|
80
80
|
* else block the request.</p>
|
|
81
81
|
* </li>
|
|
82
82
|
* <li>
|
|
83
|
-
*
|
|
83
|
+
* <p>
|
|
84
84
|
* <code>NO_ACTION</code> Allow the user to sign in.</p>
|
|
85
85
|
* </li>
|
|
86
86
|
* </ul>
|
|
@@ -232,8 +232,8 @@ export interface SchemaAttributeType {
|
|
|
232
232
|
* <p>You should use <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UserPoolClientType.html#CognitoUserPools-Type-UserPoolClientType-WriteAttributes">WriteAttributes</a> in the user pool client to control how attributes can
|
|
233
233
|
* be mutated for new use cases instead of using
|
|
234
234
|
* <code>DeveloperOnlyAttribute</code>.</p>
|
|
235
|
-
*
|
|
236
|
-
*
|
|
235
|
+
* </note>
|
|
236
|
+
* <p>Specifies whether the attribute type is developer only. This attribute can only be
|
|
237
237
|
* modified by an administrator. Users won't be able to modify this attribute using their
|
|
238
238
|
* access token. For example, <code>DeveloperOnlyAttribute</code> can be modified using
|
|
239
239
|
* AdminUpdateUserAttributes but can't be updated using UpdateUserAttributes.</p>
|
|
@@ -241,7 +241,7 @@ export interface SchemaAttributeType {
|
|
|
241
241
|
DeveloperOnlyAttribute?: boolean;
|
|
242
242
|
/**
|
|
243
243
|
* <p>Specifies whether the value of the attribute can be changed.</p>
|
|
244
|
-
*
|
|
244
|
+
* <p>For any user pool attribute that is mapped to an IdP attribute, you must set this
|
|
245
245
|
* parameter to <code>true</code>. Amazon Cognito updates mapped attributes when users sign in to
|
|
246
246
|
* your application through an IdP. If an attribute is immutable, Amazon Cognito throws an error
|
|
247
247
|
* when it attempts to update the attribute. For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-specifying-attribute-mapping.html">Specifying Identity Provider Attribute Mappings for Your User
|
|
@@ -404,7 +404,7 @@ export interface AdminConfirmSignUpRequest {
|
|
|
404
404
|
/**
|
|
405
405
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
406
406
|
* that this action triggers.</p>
|
|
407
|
-
*
|
|
407
|
+
* <p>If your user pool configuration includes triggers, the AdminConfirmSignUp API action
|
|
408
408
|
* invokes the Lambda function that is specified for the <i>post
|
|
409
409
|
* confirmation</i> trigger. When Amazon Cognito invokes this function, it passes a JSON
|
|
410
410
|
* payload, which the function receives as input. In this payload, the
|
|
@@ -412,29 +412,27 @@ export interface AdminConfirmSignUpRequest {
|
|
|
412
412
|
* ClientMetadata parameter in your AdminConfirmSignUp request. In your function code in
|
|
413
413
|
* Lambda, you can process the ClientMetadata value to enhance your workflow for your
|
|
414
414
|
* specific needs.</p>
|
|
415
|
-
*
|
|
416
415
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
417
416
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
418
|
-
*
|
|
419
|
-
* <note>
|
|
417
|
+
* <note>
|
|
420
418
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
421
419
|
* following:</p>
|
|
422
420
|
* <ul>
|
|
423
421
|
* <li>
|
|
424
|
-
*
|
|
422
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
425
423
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
426
424
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
427
425
|
* parameter serves no purpose.</p>
|
|
428
|
-
*
|
|
426
|
+
* </li>
|
|
429
427
|
* <li>
|
|
430
|
-
*
|
|
431
|
-
*
|
|
428
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
429
|
+
* </li>
|
|
432
430
|
* <li>
|
|
433
|
-
*
|
|
431
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
434
432
|
* information.</p>
|
|
435
|
-
*
|
|
433
|
+
* </li>
|
|
436
434
|
* </ul>
|
|
437
|
-
*
|
|
435
|
+
* </note>
|
|
438
436
|
*/
|
|
439
437
|
ClientMetadata?: Record<string, string>;
|
|
440
438
|
}
|
|
@@ -569,19 +567,19 @@ export interface AdminCreateUserRequest {
|
|
|
569
567
|
* (when creating a user pool or in the <b>Attributes</b> tab of
|
|
570
568
|
* the console) either you should supply (in your call to <code>AdminCreateUser</code>) or
|
|
571
569
|
* the user should supply (when they sign up in response to your welcome message).</p>
|
|
572
|
-
*
|
|
570
|
+
* <p>For custom attributes, you must prepend the <code>custom:</code> prefix to the
|
|
573
571
|
* attribute name.</p>
|
|
574
|
-
*
|
|
572
|
+
* <p>To send a message inviting the user to sign up, you must specify the user's email
|
|
575
573
|
* address or phone number. You can do this in your call to AdminCreateUser or in the
|
|
576
574
|
* <b>Users</b> tab of the Amazon Cognito console for managing your
|
|
577
575
|
* user pools.</p>
|
|
578
|
-
*
|
|
576
|
+
* <p>In your call to <code>AdminCreateUser</code>, you can set the
|
|
579
577
|
* <code>email_verified</code> attribute to <code>True</code>, and you can set the
|
|
580
578
|
* <code>phone_number_verified</code> attribute to <code>True</code>. You can also do
|
|
581
579
|
* this by calling <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateUserAttributes.html">AdminUpdateUserAttributes</a>.</p>
|
|
582
|
-
*
|
|
580
|
+
* <ul>
|
|
583
581
|
* <li>
|
|
584
|
-
*
|
|
582
|
+
* <p>
|
|
585
583
|
* <b>email</b>: The email address of the user to whom
|
|
586
584
|
* the message that contains the code and username will be sent. Required if the
|
|
587
585
|
* <code>email_verified</code> attribute is set to <code>True</code>, or if
|
|
@@ -589,7 +587,7 @@ export interface AdminCreateUserRequest {
|
|
|
589
587
|
* parameter.</p>
|
|
590
588
|
* </li>
|
|
591
589
|
* <li>
|
|
592
|
-
*
|
|
590
|
+
* <p>
|
|
593
591
|
* <b>phone_number</b>: The phone number of the user to
|
|
594
592
|
* whom the message that contains the code and username will be sent. Required if
|
|
595
593
|
* the <code>phone_number_verified</code> attribute is set to <code>True</code>, or
|
|
@@ -604,21 +602,21 @@ export interface AdminCreateUserRequest {
|
|
|
604
602
|
* attributes and attribute values that you can use for custom validation, such as
|
|
605
603
|
* restricting the types of user accounts that can be registered. For example, you might
|
|
606
604
|
* choose to allow or disallow user sign-up based on the user's domain.</p>
|
|
607
|
-
*
|
|
605
|
+
* <p>To configure custom validation, you must create a Pre Sign-up Lambda trigger for
|
|
608
606
|
* the user pool as described in the Amazon Cognito Developer Guide. The Lambda trigger receives the
|
|
609
607
|
* validation data and uses it in the validation process.</p>
|
|
610
|
-
*
|
|
608
|
+
* <p>The user's validation data isn't persisted.</p>
|
|
611
609
|
*/
|
|
612
610
|
ValidationData?: AttributeType[];
|
|
613
611
|
/**
|
|
614
612
|
* <p>The user's temporary password. This password must conform to the password policy that
|
|
615
613
|
* you specified when you created the user pool.</p>
|
|
616
|
-
*
|
|
614
|
+
* <p>The temporary password is valid only once. To complete the Admin Create User flow, the
|
|
617
615
|
* user must enter the temporary password in the sign-in page, along with a new password to
|
|
618
616
|
* be used in all future sign-ins.</p>
|
|
619
|
-
*
|
|
617
|
+
* <p>This parameter isn't required. If you don't specify a value, Amazon Cognito generates one for
|
|
620
618
|
* you.</p>
|
|
621
|
-
*
|
|
619
|
+
* <p>The temporary password can only be used until the user account expiration limit that
|
|
622
620
|
* you specified when you created the user pool. To reset the account after that time
|
|
623
621
|
* limit, you must call <code>AdminCreateUser</code> again, specifying
|
|
624
622
|
* <code>"RESEND"</code> for the <code>MessageAction</code> parameter.</p>
|
|
@@ -628,11 +626,11 @@ export interface AdminCreateUserRequest {
|
|
|
628
626
|
* <p>This parameter is used only if the <code>phone_number_verified</code> or
|
|
629
627
|
* <code>email_verified</code> attribute is set to <code>True</code>. Otherwise, it is
|
|
630
628
|
* ignored.</p>
|
|
631
|
-
*
|
|
629
|
+
* <p>If this parameter is set to <code>True</code> and the phone number or email address
|
|
632
630
|
* specified in the UserAttributes parameter already exists as an alias with a different
|
|
633
631
|
* user, the API call will migrate the alias from the previous user to the newly created
|
|
634
632
|
* user. The previous user will no longer be able to log in using that alias.</p>
|
|
635
|
-
*
|
|
633
|
+
* <p>If this parameter is set to <code>False</code>, the API throws an
|
|
636
634
|
* <code>AliasExistsException</code> error if the alias already exists. The default
|
|
637
635
|
* value is <code>False</code>.</p>
|
|
638
636
|
*/
|
|
@@ -653,7 +651,7 @@ export interface AdminCreateUserRequest {
|
|
|
653
651
|
/**
|
|
654
652
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
655
653
|
* that this action triggers.</p>
|
|
656
|
-
*
|
|
654
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool triggers.
|
|
657
655
|
* When you use the AdminCreateUser API action, Amazon Cognito invokes the function that is assigned
|
|
658
656
|
* to the <i>pre sign-up</i> trigger. When Amazon Cognito invokes this function, it
|
|
659
657
|
* passes a JSON payload, which the function receives as input. This payload contains a
|
|
@@ -661,29 +659,27 @@ export interface AdminCreateUserRequest {
|
|
|
661
659
|
* the ClientMetadata parameter in your AdminCreateUser request. In your function code in
|
|
662
660
|
* Lambda, you can process the <code>clientMetadata</code> value to enhance your
|
|
663
661
|
* workflow for your specific needs.</p>
|
|
664
|
-
*
|
|
665
662
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
666
663
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
667
|
-
*
|
|
668
|
-
* <note>
|
|
664
|
+
* <note>
|
|
669
665
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
670
666
|
* following:</p>
|
|
671
667
|
* <ul>
|
|
672
668
|
* <li>
|
|
673
|
-
*
|
|
669
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
674
670
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
675
671
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
676
672
|
* parameter serves no purpose.</p>
|
|
677
|
-
*
|
|
673
|
+
* </li>
|
|
678
674
|
* <li>
|
|
679
|
-
*
|
|
680
|
-
*
|
|
675
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
676
|
+
* </li>
|
|
681
677
|
* <li>
|
|
682
|
-
*
|
|
678
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
683
679
|
* information.</p>
|
|
684
|
-
*
|
|
680
|
+
* </li>
|
|
685
681
|
* </ul>
|
|
686
|
-
*
|
|
682
|
+
* </note>
|
|
687
683
|
*/
|
|
688
684
|
ClientMetadata?: Record<string, string>;
|
|
689
685
|
}
|
|
@@ -750,28 +746,28 @@ export interface UserType {
|
|
|
750
746
|
Enabled?: boolean;
|
|
751
747
|
/**
|
|
752
748
|
* <p>The user status. This can be one of the following:</p>
|
|
753
|
-
*
|
|
749
|
+
* <ul>
|
|
754
750
|
* <li>
|
|
755
|
-
*
|
|
751
|
+
* <p>UNCONFIRMED - User has been created but not confirmed.</p>
|
|
756
752
|
* </li>
|
|
757
753
|
* <li>
|
|
758
|
-
*
|
|
754
|
+
* <p>CONFIRMED - User has been confirmed.</p>
|
|
759
755
|
* </li>
|
|
760
756
|
* <li>
|
|
761
|
-
*
|
|
757
|
+
* <p>EXTERNAL_PROVIDER - User signed in with a third-party IdP.</p>
|
|
762
758
|
* </li>
|
|
763
759
|
* <li>
|
|
764
|
-
*
|
|
760
|
+
* <p>ARCHIVED - User is no longer active.</p>
|
|
765
761
|
* </li>
|
|
766
762
|
* <li>
|
|
767
|
-
*
|
|
763
|
+
* <p>UNKNOWN - User status isn't known.</p>
|
|
768
764
|
* </li>
|
|
769
765
|
* <li>
|
|
770
|
-
*
|
|
766
|
+
* <p>RESET_REQUIRED - User is confirmed, but the user must request a code and reset
|
|
771
767
|
* their password before they can sign in.</p>
|
|
772
768
|
* </li>
|
|
773
769
|
* <li>
|
|
774
|
-
*
|
|
770
|
+
* <p>FORCE_CHANGE_PASSWORD - The user is confirmed and the user can sign in using a
|
|
775
771
|
* temporary password, but on first sign-in, the user must change their password to
|
|
776
772
|
* a new value before doing anything else. </p>
|
|
777
773
|
* </li>
|
|
@@ -916,17 +912,17 @@ export interface AdminCreateUserConfigType {
|
|
|
916
912
|
* signed in is no longer usable. To reset the account after that time limit, you must call
|
|
917
913
|
* <code>AdminCreateUser</code> again, specifying <code>"RESEND"</code> for the
|
|
918
914
|
* <code>MessageAction</code> parameter. The default value for this parameter is 7. </p>
|
|
919
|
-
*
|
|
915
|
+
* <note>
|
|
920
916
|
* <p>If you set a value for <code>TemporaryPasswordValidityDays</code> in
|
|
921
917
|
* <code>PasswordPolicy</code>, that value will be used, and
|
|
922
918
|
* <code>UnusedAccountValidityDays</code> will be no longer be an available
|
|
923
919
|
* parameter for that user pool.</p>
|
|
924
|
-
*
|
|
920
|
+
* </note>
|
|
925
921
|
*/
|
|
926
922
|
UnusedAccountValidityDays?: number;
|
|
927
923
|
/**
|
|
928
924
|
* <p>The message template to be used for the welcome message to new users.</p>
|
|
929
|
-
*
|
|
925
|
+
* <p>See also <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-message-customizations.html#cognito-user-pool-settings-user-invitation-message-customization">Customizing User Invitation Messages</a>.</p>
|
|
930
926
|
*/
|
|
931
927
|
InviteMessageTemplate?: MessageTemplateType;
|
|
932
928
|
}
|
|
@@ -959,7 +955,7 @@ export interface AdminDeleteUserAttributesRequest {
|
|
|
959
955
|
Username: string | undefined;
|
|
960
956
|
/**
|
|
961
957
|
* <p>An array of strings representing the user attribute names you want to delete.</p>
|
|
962
|
-
*
|
|
958
|
+
* <p>For custom attributes, you must prepend the <code>custom:</code> prefix to the
|
|
963
959
|
* attribute name.</p>
|
|
964
960
|
*/
|
|
965
961
|
UserAttributeNames: string[] | undefined;
|
|
@@ -1193,25 +1189,25 @@ export interface AdminGetUserResponse {
|
|
|
1193
1189
|
Enabled?: boolean;
|
|
1194
1190
|
/**
|
|
1195
1191
|
* <p>The user status. Can be one of the following:</p>
|
|
1196
|
-
*
|
|
1192
|
+
* <ul>
|
|
1197
1193
|
* <li>
|
|
1198
|
-
*
|
|
1194
|
+
* <p>UNCONFIRMED - User has been created but not confirmed.</p>
|
|
1199
1195
|
* </li>
|
|
1200
1196
|
* <li>
|
|
1201
|
-
*
|
|
1197
|
+
* <p>CONFIRMED - User has been confirmed.</p>
|
|
1202
1198
|
* </li>
|
|
1203
1199
|
* <li>
|
|
1204
|
-
*
|
|
1200
|
+
* <p>ARCHIVED - User is no longer active.</p>
|
|
1205
1201
|
* </li>
|
|
1206
1202
|
* <li>
|
|
1207
|
-
*
|
|
1203
|
+
* <p>UNKNOWN - User status isn't known.</p>
|
|
1208
1204
|
* </li>
|
|
1209
1205
|
* <li>
|
|
1210
|
-
*
|
|
1206
|
+
* <p>RESET_REQUIRED - User is confirmed, but the user must request a code and reset
|
|
1211
1207
|
* their password before they can sign in.</p>
|
|
1212
1208
|
* </li>
|
|
1213
1209
|
* <li>
|
|
1214
|
-
*
|
|
1210
|
+
* <p>FORCE_CHANGE_PASSWORD - The user is confirmed and the user can sign in using a
|
|
1215
1211
|
* temporary password, but on first sign-in, the user must change their password to
|
|
1216
1212
|
* a new value before doing anything else. </p>
|
|
1217
1213
|
* </li>
|
|
@@ -1240,7 +1236,7 @@ export interface AdminGetUserResponse {
|
|
|
1240
1236
|
/**
|
|
1241
1237
|
* @public
|
|
1242
1238
|
* <p>An Amazon Pinpoint analytics endpoint.</p>
|
|
1243
|
-
*
|
|
1239
|
+
* <p>An endpoint uniquely identifies a mobile device, email address, or phone number that
|
|
1244
1240
|
* can receive messages from Amazon Pinpoint analytics. For more information about Amazon Web Services Regions that
|
|
1245
1241
|
* can contain Amazon Pinpoint resources for use with Amazon Cognito user pools, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-pinpoint-integration.html">Using Amazon Pinpoint analytics with Amazon Cognito user pools</a>.</p>
|
|
1246
1242
|
*/
|
|
@@ -1325,49 +1321,49 @@ export interface AdminInitiateAuthRequest {
|
|
|
1325
1321
|
/**
|
|
1326
1322
|
* <p>The authentication flow for this call to run. The API action will depend on this
|
|
1327
1323
|
* value. For example:</p>
|
|
1328
|
-
*
|
|
1324
|
+
* <ul>
|
|
1329
1325
|
* <li>
|
|
1330
|
-
*
|
|
1326
|
+
* <p>
|
|
1331
1327
|
* <code>REFRESH_TOKEN_AUTH</code> will take in a valid refresh token and return
|
|
1332
1328
|
* new tokens.</p>
|
|
1333
1329
|
* </li>
|
|
1334
1330
|
* <li>
|
|
1335
|
-
*
|
|
1331
|
+
* <p>
|
|
1336
1332
|
* <code>USER_SRP_AUTH</code> will take in <code>USERNAME</code> and
|
|
1337
1333
|
* <code>SRP_A</code> and return the Secure Remote Password (SRP) protocol
|
|
1338
1334
|
* variables to be used for next challenge execution.</p>
|
|
1339
1335
|
* </li>
|
|
1340
1336
|
* <li>
|
|
1341
|
-
*
|
|
1337
|
+
* <p>
|
|
1342
1338
|
* <code>ADMIN_USER_PASSWORD_AUTH</code> will take in <code>USERNAME</code> and
|
|
1343
1339
|
* <code>PASSWORD</code> and return the next challenge or tokens.</p>
|
|
1344
1340
|
* </li>
|
|
1345
1341
|
* </ul>
|
|
1346
|
-
*
|
|
1347
|
-
*
|
|
1342
|
+
* <p>Valid values include:</p>
|
|
1343
|
+
* <ul>
|
|
1348
1344
|
* <li>
|
|
1349
|
-
*
|
|
1345
|
+
* <p>
|
|
1350
1346
|
* <code>USER_SRP_AUTH</code>: Authentication flow for the Secure Remote Password
|
|
1351
1347
|
* (SRP) protocol.</p>
|
|
1352
1348
|
* </li>
|
|
1353
1349
|
* <li>
|
|
1354
|
-
*
|
|
1350
|
+
* <p>
|
|
1355
1351
|
* <code>REFRESH_TOKEN_AUTH</code>/<code>REFRESH_TOKEN</code>: Authentication
|
|
1356
1352
|
* flow for refreshing the access token and ID token by supplying a valid refresh
|
|
1357
1353
|
* token.</p>
|
|
1358
1354
|
* </li>
|
|
1359
1355
|
* <li>
|
|
1360
|
-
*
|
|
1356
|
+
* <p>
|
|
1361
1357
|
* <code>CUSTOM_AUTH</code>: Custom authentication flow.</p>
|
|
1362
1358
|
* </li>
|
|
1363
1359
|
* <li>
|
|
1364
|
-
*
|
|
1360
|
+
* <p>
|
|
1365
1361
|
* <code>ADMIN_NO_SRP_AUTH</code>: Non-SRP authentication flow; you can pass in
|
|
1366
1362
|
* the USERNAME and PASSWORD directly if the flow is enabled for calling the app
|
|
1367
1363
|
* client.</p>
|
|
1368
1364
|
* </li>
|
|
1369
1365
|
* <li>
|
|
1370
|
-
*
|
|
1366
|
+
* <p>
|
|
1371
1367
|
* <code>ADMIN_USER_PASSWORD_AUTH</code>: Admin-based user password
|
|
1372
1368
|
* authentication. This replaces the <code>ADMIN_NO_SRP_AUTH</code> authentication
|
|
1373
1369
|
* flow. In this flow, Amazon Cognito receives the password in the request instead of using
|
|
@@ -1380,24 +1376,24 @@ export interface AdminInitiateAuthRequest {
|
|
|
1380
1376
|
* <p>The authentication parameters. These are inputs corresponding to the
|
|
1381
1377
|
* <code>AuthFlow</code> that you're invoking. The required values depend on the value
|
|
1382
1378
|
* of <code>AuthFlow</code>:</p>
|
|
1383
|
-
*
|
|
1379
|
+
* <ul>
|
|
1384
1380
|
* <li>
|
|
1385
|
-
*
|
|
1381
|
+
* <p>For <code>USER_SRP_AUTH</code>: <code>USERNAME</code> (required),
|
|
1386
1382
|
* <code>SRP_A</code> (required), <code>SECRET_HASH</code> (required if the app
|
|
1387
1383
|
* client is configured with a client secret), <code>DEVICE_KEY</code>.</p>
|
|
1388
1384
|
* </li>
|
|
1389
1385
|
* <li>
|
|
1390
|
-
*
|
|
1386
|
+
* <p>For <code>REFRESH_TOKEN_AUTH/REFRESH_TOKEN</code>: <code>REFRESH_TOKEN</code>
|
|
1391
1387
|
* (required), <code>SECRET_HASH</code> (required if the app client is configured
|
|
1392
1388
|
* with a client secret), <code>DEVICE_KEY</code>.</p>
|
|
1393
1389
|
* </li>
|
|
1394
1390
|
* <li>
|
|
1395
|
-
*
|
|
1391
|
+
* <p>For <code>ADMIN_NO_SRP_AUTH</code>: <code>USERNAME</code> (required),
|
|
1396
1392
|
* <code>SECRET_HASH</code> (if app client is configured with client secret),
|
|
1397
1393
|
* <code>PASSWORD</code> (required), <code>DEVICE_KEY</code>.</p>
|
|
1398
1394
|
* </li>
|
|
1399
1395
|
* <li>
|
|
1400
|
-
*
|
|
1396
|
+
* <p>For <code>CUSTOM_AUTH</code>: <code>USERNAME</code> (required),
|
|
1401
1397
|
* <code>SECRET_HASH</code> (if app client is configured with client secret),
|
|
1402
1398
|
* <code>DEVICE_KEY</code>. To start the authentication flow with password
|
|
1403
1399
|
* verification, include <code>ChallengeName: SRP_A</code> and <code>SRP_A: (The
|
|
@@ -1409,72 +1405,70 @@ export interface AdminInitiateAuthRequest {
|
|
|
1409
1405
|
/**
|
|
1410
1406
|
* <p>A map of custom key-value pairs that you can provide as input for certain custom
|
|
1411
1407
|
* workflows that this action triggers.</p>
|
|
1412
|
-
*
|
|
1408
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool triggers.
|
|
1413
1409
|
* When you use the AdminInitiateAuth API action, Amazon Cognito invokes the Lambda functions that
|
|
1414
1410
|
* are specified for various triggers. The ClientMetadata value is passed as input to the
|
|
1415
1411
|
* functions for only the following triggers:</p>
|
|
1416
|
-
*
|
|
1412
|
+
* <ul>
|
|
1417
1413
|
* <li>
|
|
1418
|
-
*
|
|
1414
|
+
* <p>Pre signup</p>
|
|
1419
1415
|
* </li>
|
|
1420
1416
|
* <li>
|
|
1421
|
-
*
|
|
1417
|
+
* <p>Pre authentication</p>
|
|
1422
1418
|
* </li>
|
|
1423
1419
|
* <li>
|
|
1424
|
-
*
|
|
1420
|
+
* <p>User migration</p>
|
|
1425
1421
|
* </li>
|
|
1426
1422
|
* </ul>
|
|
1427
|
-
*
|
|
1423
|
+
* <p>When Amazon Cognito invokes the functions for these triggers, it passes a JSON payload, which
|
|
1428
1424
|
* the function receives as input. This payload contains a <code>validationData</code>
|
|
1429
1425
|
* attribute, which provides the data that you assigned to the ClientMetadata parameter in
|
|
1430
1426
|
* your AdminInitiateAuth request. In your function code in Lambda, you can process the
|
|
1431
1427
|
* <code>validationData</code> value to enhance your workflow for your specific
|
|
1432
1428
|
* needs.</p>
|
|
1433
|
-
*
|
|
1429
|
+
* <p>When you use the AdminInitiateAuth API action, Amazon Cognito also invokes the functions for
|
|
1434
1430
|
* the following triggers, but it doesn't provide the ClientMetadata value as input:</p>
|
|
1435
|
-
*
|
|
1431
|
+
* <ul>
|
|
1436
1432
|
* <li>
|
|
1437
|
-
*
|
|
1433
|
+
* <p>Post authentication</p>
|
|
1438
1434
|
* </li>
|
|
1439
1435
|
* <li>
|
|
1440
|
-
*
|
|
1436
|
+
* <p>Custom message</p>
|
|
1441
1437
|
* </li>
|
|
1442
1438
|
* <li>
|
|
1443
|
-
*
|
|
1439
|
+
* <p>Pre token generation</p>
|
|
1444
1440
|
* </li>
|
|
1445
1441
|
* <li>
|
|
1446
|
-
*
|
|
1442
|
+
* <p>Create auth challenge</p>
|
|
1447
1443
|
* </li>
|
|
1448
1444
|
* <li>
|
|
1449
|
-
*
|
|
1445
|
+
* <p>Define auth challenge</p>
|
|
1450
1446
|
* </li>
|
|
1451
1447
|
* <li>
|
|
1452
|
-
*
|
|
1448
|
+
* <p>Verify auth challenge</p>
|
|
1453
1449
|
* </li>
|
|
1454
1450
|
* </ul>
|
|
1455
|
-
*
|
|
1456
1451
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
1457
1452
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
1458
|
-
*
|
|
1459
|
-
* <note>
|
|
1453
|
+
* <note>
|
|
1460
1454
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
1461
1455
|
* following:</p>
|
|
1462
1456
|
* <ul>
|
|
1463
1457
|
* <li>
|
|
1464
|
-
*
|
|
1458
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
1465
1459
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
1466
1460
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
1467
1461
|
* parameter serves no purpose.</p>
|
|
1468
|
-
*
|
|
1462
|
+
* </li>
|
|
1469
1463
|
* <li>
|
|
1470
|
-
*
|
|
1471
|
-
*
|
|
1464
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
1465
|
+
* </li>
|
|
1472
1466
|
* <li>
|
|
1473
|
-
*
|
|
1467
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
1474
1468
|
* information.</p>
|
|
1475
|
-
*
|
|
1469
|
+
* </li>
|
|
1476
1470
|
* </ul>
|
|
1477
|
-
*
|
|
1471
|
+
* </note>
|
|
1478
1472
|
*/
|
|
1479
1473
|
ClientMetadata?: Record<string, string>;
|
|
1480
1474
|
/**
|
|
@@ -1563,77 +1557,75 @@ export interface AdminInitiateAuthResponse {
|
|
|
1563
1557
|
* <p>The name of the challenge that you're responding to with this call. This is returned
|
|
1564
1558
|
* in the <code>AdminInitiateAuth</code> response if you must pass another
|
|
1565
1559
|
* challenge.</p>
|
|
1566
|
-
*
|
|
1560
|
+
* <ul>
|
|
1567
1561
|
* <li>
|
|
1568
|
-
*
|
|
1562
|
+
* <p>
|
|
1569
1563
|
* <code>MFA_SETUP</code>: If MFA is required, users who don't have at least one
|
|
1570
1564
|
* of the MFA methods set up are presented with an <code>MFA_SETUP</code>
|
|
1571
1565
|
* challenge. The user must set up at least one MFA type to continue to
|
|
1572
1566
|
* authenticate.</p>
|
|
1573
1567
|
* </li>
|
|
1574
1568
|
* <li>
|
|
1575
|
-
*
|
|
1569
|
+
* <p>
|
|
1576
1570
|
* <code>SELECT_MFA_TYPE</code>: Selects the MFA type. Valid MFA options are
|
|
1577
1571
|
* <code>SMS_MFA</code> for text SMS MFA, and <code>SOFTWARE_TOKEN_MFA</code>
|
|
1578
1572
|
* for time-based one-time password (TOTP) software token MFA.</p>
|
|
1579
1573
|
* </li>
|
|
1580
1574
|
* <li>
|
|
1581
|
-
*
|
|
1575
|
+
* <p>
|
|
1582
1576
|
* <code>SMS_MFA</code>: Next challenge is to supply an
|
|
1583
1577
|
* <code>SMS_MFA_CODE</code>, delivered via SMS.</p>
|
|
1584
1578
|
* </li>
|
|
1585
1579
|
* <li>
|
|
1586
|
-
*
|
|
1580
|
+
* <p>
|
|
1587
1581
|
* <code>PASSWORD_VERIFIER</code>: Next challenge is to supply
|
|
1588
1582
|
* <code>PASSWORD_CLAIM_SIGNATURE</code>,
|
|
1589
1583
|
* <code>PASSWORD_CLAIM_SECRET_BLOCK</code>, and <code>TIMESTAMP</code> after
|
|
1590
1584
|
* the client-side SRP calculations.</p>
|
|
1591
1585
|
* </li>
|
|
1592
1586
|
* <li>
|
|
1593
|
-
*
|
|
1587
|
+
* <p>
|
|
1594
1588
|
* <code>CUSTOM_CHALLENGE</code>: This is returned if your custom authentication
|
|
1595
1589
|
* flow determines that the user should pass another challenge before tokens are
|
|
1596
1590
|
* issued.</p>
|
|
1597
1591
|
* </li>
|
|
1598
1592
|
* <li>
|
|
1599
|
-
*
|
|
1593
|
+
* <p>
|
|
1600
1594
|
* <code>DEVICE_SRP_AUTH</code>: If device tracking was activated in your user
|
|
1601
1595
|
* pool and the previous challenges were passed, this challenge is returned so that
|
|
1602
1596
|
* Amazon Cognito can start tracking this device.</p>
|
|
1603
1597
|
* </li>
|
|
1604
1598
|
* <li>
|
|
1605
|
-
*
|
|
1599
|
+
* <p>
|
|
1606
1600
|
* <code>DEVICE_PASSWORD_VERIFIER</code>: Similar to
|
|
1607
1601
|
* <code>PASSWORD_VERIFIER</code>, but for devices only.</p>
|
|
1608
1602
|
* </li>
|
|
1609
1603
|
* <li>
|
|
1610
|
-
*
|
|
1604
|
+
* <p>
|
|
1611
1605
|
* <code>ADMIN_NO_SRP_AUTH</code>: This is returned if you must authenticate with
|
|
1612
1606
|
* <code>USERNAME</code> and <code>PASSWORD</code> directly. An app client must
|
|
1613
1607
|
* be enabled to use this flow.</p>
|
|
1614
1608
|
* </li>
|
|
1615
1609
|
* <li>
|
|
1616
|
-
*
|
|
1610
|
+
* <p>
|
|
1617
1611
|
* <code>NEW_PASSWORD_REQUIRED</code>: For users who are required to change their
|
|
1618
1612
|
* passwords after successful first login. Respond to this challenge with
|
|
1619
1613
|
* <code>NEW_PASSWORD</code> and any required attributes that Amazon Cognito returned in
|
|
1620
1614
|
* the <code>requiredAttributes</code> parameter. You can also set values for
|
|
1621
1615
|
* attributes that aren't required by your user pool and that your app client can
|
|
1622
1616
|
* write. For more information, see <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRespondToAuthChallenge.html">AdminRespondToAuthChallenge</a>.</p>
|
|
1623
|
-
*
|
|
1624
1617
|
* <note>
|
|
1625
1618
|
* <p>In a <code>NEW_PASSWORD_REQUIRED</code> challenge response, you can't modify a required attribute that already has a value.
|
|
1626
1619
|
* In <code>AdminRespondToAuthChallenge</code>, set a value for any keys that Amazon Cognito returned in the <code>requiredAttributes</code> parameter,
|
|
1627
1620
|
* then use the <code>AdminUpdateUserAttributes</code> API operation to modify the value of any additional attributes.</p>
|
|
1628
1621
|
* </note>
|
|
1629
|
-
*
|
|
1630
1622
|
* </li>
|
|
1631
1623
|
* <li>
|
|
1632
|
-
*
|
|
1624
|
+
* <p>
|
|
1633
1625
|
* <code>MFA_SETUP</code>: For users who are required to set up an MFA factor
|
|
1634
1626
|
* before they can sign in. The MFA types activated for the user pool will be
|
|
1635
1627
|
* listed in the challenge parameters <code>MFA_CAN_SETUP</code> value. </p>
|
|
1636
|
-
*
|
|
1628
|
+
* <p> To set up software token MFA, use the session returned here from
|
|
1637
1629
|
* <code>InitiateAuth</code> as an input to
|
|
1638
1630
|
* <code>AssociateSoftwareToken</code>, and use the session returned by
|
|
1639
1631
|
* <code>VerifySoftwareToken</code> as an input to
|
|
@@ -1658,9 +1650,9 @@ export interface AdminInitiateAuthResponse {
|
|
|
1658
1650
|
* <code>AdminInitiateAuth</code> response if you must pass another challenge. The
|
|
1659
1651
|
* responses in this parameter should be used to compute inputs to the next call
|
|
1660
1652
|
* (<code>AdminRespondToAuthChallenge</code>).</p>
|
|
1661
|
-
*
|
|
1653
|
+
* <p>All challenges require <code>USERNAME</code> and <code>SECRET_HASH</code> (if
|
|
1662
1654
|
* applicable).</p>
|
|
1663
|
-
*
|
|
1655
|
+
* <p>The value of the <code>USER_ID_FOR_SRP</code> attribute is the user's actual username,
|
|
1664
1656
|
* not an alias (such as email address or phone number), even if you specified an alias in
|
|
1665
1657
|
* your call to <code>AdminInitiateAuth</code>. This happens because, in the
|
|
1666
1658
|
* <code>AdminRespondToAuthChallenge</code> API <code>ChallengeResponses</code>, the
|
|
@@ -1726,25 +1718,25 @@ export interface AdminLinkProviderForUserRequest {
|
|
|
1726
1718
|
* federated user (for example, a SAML or Facebook user). If the user doesn't exist, Amazon Cognito
|
|
1727
1719
|
* generates an exception. Amazon Cognito returns this user when the new user (with the linked IdP
|
|
1728
1720
|
* attribute) signs in.</p>
|
|
1729
|
-
*
|
|
1721
|
+
* <p>For a native username + password user, the <code>ProviderAttributeValue</code> for the
|
|
1730
1722
|
* <code>DestinationUser</code> should be the username in the user pool. For a
|
|
1731
1723
|
* federated user, it should be the provider-specific <code>user_id</code>.</p>
|
|
1732
|
-
*
|
|
1724
|
+
* <p>The <code>ProviderAttributeName</code> of the <code>DestinationUser</code> is
|
|
1733
1725
|
* ignored.</p>
|
|
1734
|
-
*
|
|
1726
|
+
* <p>The <code>ProviderName</code> should be set to <code>Cognito</code> for users in
|
|
1735
1727
|
* Cognito user pools.</p>
|
|
1736
|
-
*
|
|
1728
|
+
* <important>
|
|
1737
1729
|
* <p>All attributes in the DestinationUser profile must be mutable. If you have
|
|
1738
1730
|
* assigned the user any immutable custom attributes, the operation won't
|
|
1739
1731
|
* succeed.</p>
|
|
1740
|
-
*
|
|
1732
|
+
* </important>
|
|
1741
1733
|
*/
|
|
1742
1734
|
DestinationUser: ProviderUserIdentifierType | undefined;
|
|
1743
1735
|
/**
|
|
1744
1736
|
* <p>An external IdP account for a user who doesn't exist yet in the user pool. This user
|
|
1745
1737
|
* must be a federated user (for example, a SAML or Facebook user), not another native
|
|
1746
1738
|
* user.</p>
|
|
1747
|
-
*
|
|
1739
|
+
* <p>If the <code>SourceUser</code> is using a federated social IdP, such as Facebook,
|
|
1748
1740
|
* Google, or Login with Amazon, you must set the <code>ProviderAttributeName</code> to
|
|
1749
1741
|
* <code>Cognito_Subject</code>. For social IdPs, the <code>ProviderName</code> will be
|
|
1750
1742
|
* <code>Facebook</code>, <code>Google</code>, or <code>LoginWithAmazon</code>, and
|
|
@@ -1753,8 +1745,8 @@ export interface AdminLinkProviderForUserRequest {
|
|
|
1753
1745
|
* <code>ProviderAttributeValue</code> for the user must be the same value as the
|
|
1754
1746
|
* <code>id</code>, <code>sub</code>, or <code>user_id</code> value found in the social
|
|
1755
1747
|
* IdP token.</p>
|
|
1756
|
-
*
|
|
1757
|
-
*
|
|
1748
|
+
* <p></p>
|
|
1749
|
+
* <p>For SAML, the <code>ProviderAttributeName</code> can be any value that matches a claim
|
|
1758
1750
|
* in the SAML assertion. If you want to link SAML users based on the subject of the SAML
|
|
1759
1751
|
* assertion, you should map the subject to a claim through the SAML IdP and submit that
|
|
1760
1752
|
* claim name as the <code>ProviderAttributeName</code>. If you set
|
|
@@ -1856,13 +1848,13 @@ export interface GroupType {
|
|
|
1856
1848
|
* more groups, it is the group with the lowest precedence value whose role ARN is given in
|
|
1857
1849
|
* the user's tokens for the <code>cognito:roles</code> and
|
|
1858
1850
|
* <code>cognito:preferred_role</code> claims.</p>
|
|
1859
|
-
*
|
|
1851
|
+
* <p>Two groups can have the same <code>Precedence</code> value. If this happens, neither
|
|
1860
1852
|
* group takes precedence over the other. If two groups with the same
|
|
1861
1853
|
* <code>Precedence</code> have the same role ARN, that role is used in the
|
|
1862
1854
|
* <code>cognito:preferred_role</code> claim in tokens for users in each group. If the
|
|
1863
1855
|
* two groups have different role ARNs, the <code>cognito:preferred_role</code> claim isn't
|
|
1864
1856
|
* set in users' tokens.</p>
|
|
1865
|
-
*
|
|
1857
|
+
* <p>The default <code>Precedence</code> value is null.</p>
|
|
1866
1858
|
*/
|
|
1867
1859
|
Precedence?: number;
|
|
1868
1860
|
/**
|
|
@@ -2178,7 +2170,7 @@ export interface AdminResetUserPasswordRequest {
|
|
|
2178
2170
|
/**
|
|
2179
2171
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
2180
2172
|
* that this action triggers.</p>
|
|
2181
|
-
*
|
|
2173
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool
|
|
2182
2174
|
* triggers. When you use the AdminResetUserPassword API action, Amazon Cognito invokes the function
|
|
2183
2175
|
* that is assigned to the <i>custom message</i> trigger. When Amazon Cognito invokes
|
|
2184
2176
|
* this function, it passes a JSON payload, which the function receives as input. This
|
|
@@ -2186,29 +2178,27 @@ export interface AdminResetUserPasswordRequest {
|
|
|
2186
2178
|
* you assigned to the ClientMetadata parameter in your AdminResetUserPassword request. In
|
|
2187
2179
|
* your function code in Lambda, you can process the
|
|
2188
2180
|
* <code>clientMetadata</code> value to enhance your workflow for your specific needs. </p>
|
|
2189
|
-
*
|
|
2190
2181
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
2191
2182
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
2192
|
-
*
|
|
2193
|
-
* <note>
|
|
2183
|
+
* <note>
|
|
2194
2184
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
2195
2185
|
* following:</p>
|
|
2196
2186
|
* <ul>
|
|
2197
2187
|
* <li>
|
|
2198
|
-
*
|
|
2188
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
2199
2189
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
2200
2190
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
2201
2191
|
* parameter serves no purpose.</p>
|
|
2202
|
-
*
|
|
2192
|
+
* </li>
|
|
2203
2193
|
* <li>
|
|
2204
|
-
*
|
|
2205
|
-
*
|
|
2194
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
2195
|
+
* </li>
|
|
2206
2196
|
* <li>
|
|
2207
|
-
*
|
|
2197
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
2208
2198
|
* information.</p>
|
|
2209
|
-
*
|
|
2199
|
+
* </li>
|
|
2210
2200
|
* </ul>
|
|
2211
|
-
*
|
|
2201
|
+
* </note>
|
|
2212
2202
|
*/
|
|
2213
2203
|
ClientMetadata?: Record<string, string>;
|
|
2214
2204
|
}
|
|
@@ -2252,34 +2242,34 @@ export interface AdminRespondToAuthChallengeRequest {
|
|
|
2252
2242
|
/**
|
|
2253
2243
|
* <p>The challenge responses. These are inputs corresponding to the value of
|
|
2254
2244
|
* <code>ChallengeName</code>, for example:</p>
|
|
2255
|
-
*
|
|
2245
|
+
* <ul>
|
|
2256
2246
|
* <li>
|
|
2257
|
-
*
|
|
2247
|
+
* <p>
|
|
2258
2248
|
* <code>SMS_MFA</code>: <code>SMS_MFA_CODE</code>, <code>USERNAME</code>,
|
|
2259
2249
|
* <code>SECRET_HASH</code> (if app client is configured with client
|
|
2260
2250
|
* secret).</p>
|
|
2261
2251
|
* </li>
|
|
2262
2252
|
* <li>
|
|
2263
|
-
*
|
|
2253
|
+
* <p>
|
|
2264
2254
|
* <code>PASSWORD_VERIFIER</code>: <code>PASSWORD_CLAIM_SIGNATURE</code>,
|
|
2265
2255
|
* <code>PASSWORD_CLAIM_SECRET_BLOCK</code>, <code>TIMESTAMP</code>,
|
|
2266
2256
|
* <code>USERNAME</code>, <code>SECRET_HASH</code> (if app client is configured
|
|
2267
2257
|
* with client secret).</p>
|
|
2268
|
-
*
|
|
2269
|
-
*
|
|
2258
|
+
* <note>
|
|
2259
|
+
* <p>
|
|
2270
2260
|
* <code>PASSWORD_VERIFIER</code> requires <code>DEVICE_KEY</code> when
|
|
2271
2261
|
* signing in with a remembered device.</p>
|
|
2272
|
-
*
|
|
2262
|
+
* </note>
|
|
2273
2263
|
* </li>
|
|
2274
2264
|
* <li>
|
|
2275
|
-
*
|
|
2276
|
-
*
|
|
2265
|
+
* <p>
|
|
2266
|
+
* <code>ADMIN_NO_SRP_AUTH</code>: <code>PASSWORD</code>, <code>USERNAME</code>,
|
|
2277
2267
|
* <code>SECRET_HASH</code> (if app client is configured with client secret).
|
|
2278
2268
|
* </p>
|
|
2279
2269
|
* </li>
|
|
2280
2270
|
* <li>
|
|
2281
|
-
*
|
|
2282
|
-
*
|
|
2271
|
+
* <p>
|
|
2272
|
+
* <code>NEW_PASSWORD_REQUIRED</code>: <code>NEW_PASSWORD</code>,
|
|
2283
2273
|
* <code>USERNAME</code>, <code>SECRET_HASH</code> (if app client is configured
|
|
2284
2274
|
* with client secret). To set any required attributes that Amazon Cognito returned as
|
|
2285
2275
|
* <code>requiredAttributes</code> in the <code>AdminInitiateAuth</code>
|
|
@@ -2287,22 +2277,20 @@ export interface AdminRespondToAuthChallengeRequest {
|
|
|
2287
2277
|
* </code>
|
|
2288
2278
|
* parameter. This parameter can also set values for writable attributes that
|
|
2289
2279
|
* aren't required by your user pool.</p>
|
|
2290
|
-
*
|
|
2291
2280
|
* <note>
|
|
2292
2281
|
* <p>In a <code>NEW_PASSWORD_REQUIRED</code> challenge response, you can't modify a required attribute that already has a value.
|
|
2293
2282
|
* In <code>AdminRespondToAuthChallenge</code>, set a value for any keys that Amazon Cognito returned in the <code>requiredAttributes</code> parameter,
|
|
2294
2283
|
* then use the <code>AdminUpdateUserAttributes</code> API operation to modify the value of any additional attributes.</p>
|
|
2295
2284
|
* </note>
|
|
2296
|
-
*
|
|
2297
2285
|
* </li>
|
|
2298
2286
|
* <li>
|
|
2299
|
-
*
|
|
2287
|
+
* <p>
|
|
2300
2288
|
* <code>MFA_SETUP</code> requires <code>USERNAME</code>, plus you must use the
|
|
2301
2289
|
* session value returned by <code>VerifySoftwareToken</code> in the
|
|
2302
2290
|
* <code>Session</code> parameter.</p>
|
|
2303
2291
|
* </li>
|
|
2304
2292
|
* </ul>
|
|
2305
|
-
*
|
|
2293
|
+
* <p>The value of the <code>USERNAME</code> attribute must be the user's actual username,
|
|
2306
2294
|
* not an alias (such as an email address or phone number). To make this simpler, the
|
|
2307
2295
|
* <code>AdminInitiateAuth</code> response includes the actual username value in the
|
|
2308
2296
|
* <code>USERNAMEUSER_ID_FOR_SRP</code> attribute. This happens even if you specified
|
|
@@ -2331,64 +2319,62 @@ export interface AdminRespondToAuthChallengeRequest {
|
|
|
2331
2319
|
/**
|
|
2332
2320
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
2333
2321
|
* that this action triggers.</p>
|
|
2334
|
-
*
|
|
2322
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool triggers.
|
|
2335
2323
|
* When you use the AdminRespondToAuthChallenge API action, Amazon Cognito invokes any functions
|
|
2336
2324
|
* that you have assigned to the following triggers: </p>
|
|
2337
|
-
*
|
|
2325
|
+
* <ul>
|
|
2338
2326
|
* <li>
|
|
2339
|
-
*
|
|
2327
|
+
* <p>pre sign-up</p>
|
|
2340
2328
|
* </li>
|
|
2341
2329
|
* <li>
|
|
2342
|
-
*
|
|
2330
|
+
* <p>custom message</p>
|
|
2343
2331
|
* </li>
|
|
2344
2332
|
* <li>
|
|
2345
|
-
*
|
|
2333
|
+
* <p>post authentication</p>
|
|
2346
2334
|
* </li>
|
|
2347
2335
|
* <li>
|
|
2348
|
-
*
|
|
2336
|
+
* <p>user migration</p>
|
|
2349
2337
|
* </li>
|
|
2350
2338
|
* <li>
|
|
2351
|
-
*
|
|
2339
|
+
* <p>pre token generation</p>
|
|
2352
2340
|
* </li>
|
|
2353
2341
|
* <li>
|
|
2354
|
-
*
|
|
2342
|
+
* <p>define auth challenge</p>
|
|
2355
2343
|
* </li>
|
|
2356
2344
|
* <li>
|
|
2357
|
-
*
|
|
2345
|
+
* <p>create auth challenge</p>
|
|
2358
2346
|
* </li>
|
|
2359
2347
|
* <li>
|
|
2360
|
-
*
|
|
2348
|
+
* <p>verify auth challenge response</p>
|
|
2361
2349
|
* </li>
|
|
2362
2350
|
* </ul>
|
|
2363
|
-
*
|
|
2351
|
+
* <p>When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the
|
|
2364
2352
|
* function receives as input. This payload contains a <code>clientMetadata</code>
|
|
2365
2353
|
* attribute that provides the data that you assigned to the ClientMetadata parameter in
|
|
2366
2354
|
* your AdminRespondToAuthChallenge request. In your function code in Lambda, you can
|
|
2367
2355
|
* process the <code>clientMetadata</code> value to enhance your workflow for your specific
|
|
2368
2356
|
* needs.</p>
|
|
2369
|
-
*
|
|
2370
2357
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
2371
2358
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
2372
|
-
*
|
|
2373
|
-
* <note>
|
|
2359
|
+
* <note>
|
|
2374
2360
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
2375
2361
|
* following:</p>
|
|
2376
2362
|
* <ul>
|
|
2377
2363
|
* <li>
|
|
2378
|
-
*
|
|
2364
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
2379
2365
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
2380
2366
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
2381
2367
|
* parameter serves no purpose.</p>
|
|
2382
|
-
*
|
|
2368
|
+
* </li>
|
|
2383
2369
|
* <li>
|
|
2384
|
-
*
|
|
2385
|
-
*
|
|
2370
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
2371
|
+
* </li>
|
|
2386
2372
|
* <li>
|
|
2387
|
-
*
|
|
2373
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
2388
2374
|
* information.</p>
|
|
2389
|
-
*
|
|
2375
|
+
* </li>
|
|
2390
2376
|
* </ul>
|
|
2391
|
-
*
|
|
2377
|
+
* </note>
|
|
2392
2378
|
*/
|
|
2393
2379
|
ClientMetadata?: Record<string, string>;
|
|
2394
2380
|
}
|
|
@@ -2658,14 +2644,14 @@ export interface AdminUpdateUserAttributesRequest {
|
|
|
2658
2644
|
Username: string | undefined;
|
|
2659
2645
|
/**
|
|
2660
2646
|
* <p>An array of name-value pairs representing user attributes.</p>
|
|
2661
|
-
*
|
|
2647
|
+
* <p>For custom attributes, you must prepend the <code>custom:</code> prefix to the
|
|
2662
2648
|
* attribute name.</p>
|
|
2663
|
-
*
|
|
2649
|
+
* <p>If your user pool requires verification before Amazon Cognito updates an attribute value that
|
|
2664
2650
|
* you specify in this request, Amazon Cognito doesn’t immediately update the value of that
|
|
2665
2651
|
* attribute. After your user receives and responds to a verification message to verify the
|
|
2666
2652
|
* new value, Amazon Cognito updates the attribute value. Your user can sign in and receive messages
|
|
2667
2653
|
* with the original attribute value until they verify the new value.</p>
|
|
2668
|
-
*
|
|
2654
|
+
* <p>To update the value of an attribute that requires verification in the same API
|
|
2669
2655
|
* request, include the <code>email_verified</code> or <code>phone_number_verified</code>
|
|
2670
2656
|
* attribute, with a value of <code>true</code>. If you set the <code>email_verified</code>
|
|
2671
2657
|
* or <code>phone_number_verified</code> value for an <code>email</code> or
|
|
@@ -2676,7 +2662,7 @@ export interface AdminUpdateUserAttributesRequest {
|
|
|
2676
2662
|
/**
|
|
2677
2663
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
2678
2664
|
* that this action triggers.</p>
|
|
2679
|
-
*
|
|
2665
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool
|
|
2680
2666
|
* triggers. When you use the AdminUpdateUserAttributes API action, Amazon Cognito invokes the
|
|
2681
2667
|
* function that is assigned to the <i>custom message</i> trigger. When Amazon Cognito
|
|
2682
2668
|
* invokes this function, it passes a JSON payload, which the function receives as input.
|
|
@@ -2685,29 +2671,27 @@ export interface AdminUpdateUserAttributesRequest {
|
|
|
2685
2671
|
* request. In your function code in Lambda, you can process the
|
|
2686
2672
|
* <code>clientMetadata</code> value to enhance your workflow for your specific
|
|
2687
2673
|
* needs.</p>
|
|
2688
|
-
*
|
|
2689
2674
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
2690
2675
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
2691
|
-
*
|
|
2692
|
-
* <note>
|
|
2676
|
+
* <note>
|
|
2693
2677
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
2694
2678
|
* following:</p>
|
|
2695
2679
|
* <ul>
|
|
2696
2680
|
* <li>
|
|
2697
|
-
*
|
|
2681
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
2698
2682
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
2699
2683
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
2700
2684
|
* parameter serves no purpose.</p>
|
|
2701
|
-
*
|
|
2685
|
+
* </li>
|
|
2702
2686
|
* <li>
|
|
2703
|
-
*
|
|
2704
|
-
*
|
|
2687
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
2688
|
+
* </li>
|
|
2705
2689
|
* <li>
|
|
2706
|
-
*
|
|
2690
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
2707
2691
|
* information.</p>
|
|
2708
|
-
*
|
|
2692
|
+
* </li>
|
|
2709
2693
|
* </ul>
|
|
2710
|
-
*
|
|
2694
|
+
* </note>
|
|
2711
2695
|
*/
|
|
2712
2696
|
ClientMetadata?: Record<string, string>;
|
|
2713
2697
|
}
|
|
@@ -2768,11 +2752,11 @@ export type AliasAttributeType = (typeof AliasAttributeType)[keyof typeof AliasA
|
|
|
2768
2752
|
* @public
|
|
2769
2753
|
* <p>The Amazon Pinpoint analytics configuration necessary to collect metrics for a user
|
|
2770
2754
|
* pool.</p>
|
|
2771
|
-
*
|
|
2755
|
+
* <note>
|
|
2772
2756
|
* <p>In Regions where Amazon Pinpointisn't available, user pools only support sending events to
|
|
2773
2757
|
* Amazon Pinpoint projects in us-east-1. In Regions where Amazon Pinpoint is available, user pools
|
|
2774
2758
|
* support sending events to Amazon Pinpoint projects within that same Region.</p>
|
|
2775
|
-
*
|
|
2759
|
+
* </note>
|
|
2776
2760
|
*/
|
|
2777
2761
|
export interface AnalyticsConfigurationType {
|
|
2778
2762
|
/**
|
|
@@ -2999,7 +2983,7 @@ export interface ConfirmForgotPasswordRequest {
|
|
|
2999
2983
|
/**
|
|
3000
2984
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
3001
2985
|
* that this action triggers.</p>
|
|
3002
|
-
*
|
|
2986
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool triggers.
|
|
3003
2987
|
* When you use the ConfirmForgotPassword API action, Amazon Cognito invokes the function that is
|
|
3004
2988
|
* assigned to the <i>post confirmation</i> trigger. When Amazon Cognito invokes this
|
|
3005
2989
|
* function, it passes a JSON payload, which the function receives as input. This payload
|
|
@@ -3007,29 +2991,27 @@ export interface ConfirmForgotPasswordRequest {
|
|
|
3007
2991
|
* assigned to the ClientMetadata parameter in your ConfirmForgotPassword request. In your
|
|
3008
2992
|
* function code in Lambda, you can process the <code>clientMetadata</code> value to
|
|
3009
2993
|
* enhance your workflow for your specific needs.</p>
|
|
3010
|
-
*
|
|
3011
2994
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
3012
2995
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
3013
|
-
*
|
|
3014
|
-
* <note>
|
|
2996
|
+
* <note>
|
|
3015
2997
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
3016
2998
|
* following:</p>
|
|
3017
2999
|
* <ul>
|
|
3018
3000
|
* <li>
|
|
3019
|
-
*
|
|
3001
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
3020
3002
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
3021
3003
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
3022
3004
|
* parameter serves no purpose.</p>
|
|
3023
|
-
*
|
|
3005
|
+
* </li>
|
|
3024
3006
|
* <li>
|
|
3025
|
-
*
|
|
3026
|
-
*
|
|
3007
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
3008
|
+
* </li>
|
|
3027
3009
|
* <li>
|
|
3028
|
-
*
|
|
3010
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
3029
3011
|
* information.</p>
|
|
3030
|
-
*
|
|
3012
|
+
* </li>
|
|
3031
3013
|
* </ul>
|
|
3032
|
-
*
|
|
3014
|
+
* </note>
|
|
3033
3015
|
*/
|
|
3034
3016
|
ClientMetadata?: Record<string, string>;
|
|
3035
3017
|
}
|
|
@@ -3085,7 +3067,7 @@ export interface ConfirmSignUpRequest {
|
|
|
3085
3067
|
/**
|
|
3086
3068
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
3087
3069
|
* that this action triggers.</p>
|
|
3088
|
-
*
|
|
3070
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool
|
|
3089
3071
|
* triggers. When you use the ConfirmSignUp API action, Amazon Cognito invokes the function that is
|
|
3090
3072
|
* assigned to the <i>post confirmation</i> trigger. When Amazon Cognito invokes this
|
|
3091
3073
|
* function, it passes a JSON payload, which the function receives as input. This payload
|
|
@@ -3093,29 +3075,27 @@ export interface ConfirmSignUpRequest {
|
|
|
3093
3075
|
* assigned to the ClientMetadata parameter in your ConfirmSignUp request. In your function
|
|
3094
3076
|
* code in Lambda, you can process the <code>clientMetadata</code> value to
|
|
3095
3077
|
* enhance your workflow for your specific needs.</p>
|
|
3096
|
-
*
|
|
3097
3078
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
3098
3079
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
3099
|
-
*
|
|
3100
|
-
* <note>
|
|
3080
|
+
* <note>
|
|
3101
3081
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
3102
3082
|
* following:</p>
|
|
3103
3083
|
* <ul>
|
|
3104
3084
|
* <li>
|
|
3105
|
-
*
|
|
3085
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
3106
3086
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
3107
3087
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
3108
3088
|
* parameter serves no purpose.</p>
|
|
3109
|
-
*
|
|
3089
|
+
* </li>
|
|
3110
3090
|
* <li>
|
|
3111
|
-
*
|
|
3112
|
-
*
|
|
3091
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
3092
|
+
* </li>
|
|
3113
3093
|
* <li>
|
|
3114
|
-
*
|
|
3094
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
3115
3095
|
* information.</p>
|
|
3116
|
-
*
|
|
3096
|
+
* </li>
|
|
3117
3097
|
* </ul>
|
|
3118
|
-
*
|
|
3098
|
+
* </note>
|
|
3119
3099
|
*/
|
|
3120
3100
|
ClientMetadata?: Record<string, string>;
|
|
3121
3101
|
}
|
|
@@ -3153,13 +3133,13 @@ export interface CreateGroupRequest {
|
|
|
3153
3133
|
* more groups, it is the group with the lowest precedence value whose role ARN is given in
|
|
3154
3134
|
* the user's tokens for the <code>cognito:roles</code> and
|
|
3155
3135
|
* <code>cognito:preferred_role</code> claims.</p>
|
|
3156
|
-
*
|
|
3136
|
+
* <p>Two groups can have the same <code>Precedence</code> value. If this happens, neither
|
|
3157
3137
|
* group takes precedence over the other. If two groups with the same
|
|
3158
3138
|
* <code>Precedence</code> have the same role ARN, that role is used in the
|
|
3159
3139
|
* <code>cognito:preferred_role</code> claim in tokens for users in each group. If the
|
|
3160
3140
|
* two groups have different role ARNs, the <code>cognito:preferred_role</code> claim isn't
|
|
3161
3141
|
* set in users' tokens.</p>
|
|
3162
|
-
*
|
|
3142
|
+
* <p>The default <code>Precedence</code> value is null. The maximum <code>Precedence</code>
|
|
3163
3143
|
* value is <code>2^31-1</code>.</p>
|
|
3164
3144
|
*/
|
|
3165
3145
|
Precedence?: number;
|
|
@@ -3221,115 +3201,115 @@ export interface CreateIdentityProviderRequest {
|
|
|
3221
3201
|
/**
|
|
3222
3202
|
* <p>The IdP details. The following list describes the provider detail keys for each IdP
|
|
3223
3203
|
* type.</p>
|
|
3224
|
-
*
|
|
3204
|
+
* <ul>
|
|
3225
3205
|
* <li>
|
|
3226
|
-
*
|
|
3227
|
-
*
|
|
3206
|
+
* <p>For Google and Login with Amazon:</p>
|
|
3207
|
+
* <ul>
|
|
3228
3208
|
* <li>
|
|
3229
|
-
*
|
|
3230
|
-
*
|
|
3209
|
+
* <p>client_id</p>
|
|
3210
|
+
* </li>
|
|
3231
3211
|
* <li>
|
|
3232
|
-
*
|
|
3233
|
-
*
|
|
3212
|
+
* <p>client_secret</p>
|
|
3213
|
+
* </li>
|
|
3234
3214
|
* <li>
|
|
3235
|
-
*
|
|
3236
|
-
*
|
|
3215
|
+
* <p>authorize_scopes</p>
|
|
3216
|
+
* </li>
|
|
3237
3217
|
* </ul>
|
|
3238
3218
|
* </li>
|
|
3239
3219
|
* <li>
|
|
3240
|
-
*
|
|
3241
|
-
*
|
|
3220
|
+
* <p>For Facebook:</p>
|
|
3221
|
+
* <ul>
|
|
3242
3222
|
* <li>
|
|
3243
|
-
*
|
|
3244
|
-
*
|
|
3223
|
+
* <p>client_id</p>
|
|
3224
|
+
* </li>
|
|
3245
3225
|
* <li>
|
|
3246
|
-
*
|
|
3247
|
-
*
|
|
3226
|
+
* <p>client_secret</p>
|
|
3227
|
+
* </li>
|
|
3248
3228
|
* <li>
|
|
3249
|
-
*
|
|
3250
|
-
*
|
|
3229
|
+
* <p>authorize_scopes</p>
|
|
3230
|
+
* </li>
|
|
3251
3231
|
* <li>
|
|
3252
|
-
*
|
|
3253
|
-
*
|
|
3232
|
+
* <p>api_version</p>
|
|
3233
|
+
* </li>
|
|
3254
3234
|
* </ul>
|
|
3255
3235
|
* </li>
|
|
3256
3236
|
* <li>
|
|
3257
|
-
*
|
|
3258
|
-
*
|
|
3237
|
+
* <p>For Sign in with Apple:</p>
|
|
3238
|
+
* <ul>
|
|
3259
3239
|
* <li>
|
|
3260
|
-
*
|
|
3261
|
-
*
|
|
3240
|
+
* <p>client_id</p>
|
|
3241
|
+
* </li>
|
|
3262
3242
|
* <li>
|
|
3263
|
-
*
|
|
3264
|
-
*
|
|
3243
|
+
* <p>team_id</p>
|
|
3244
|
+
* </li>
|
|
3265
3245
|
* <li>
|
|
3266
|
-
*
|
|
3267
|
-
*
|
|
3246
|
+
* <p>key_id</p>
|
|
3247
|
+
* </li>
|
|
3268
3248
|
* <li>
|
|
3269
|
-
*
|
|
3270
|
-
*
|
|
3249
|
+
* <p>private_key</p>
|
|
3250
|
+
* </li>
|
|
3271
3251
|
* <li>
|
|
3272
|
-
*
|
|
3273
|
-
*
|
|
3252
|
+
* <p>authorize_scopes</p>
|
|
3253
|
+
* </li>
|
|
3274
3254
|
* </ul>
|
|
3275
3255
|
* </li>
|
|
3276
3256
|
* <li>
|
|
3277
|
-
*
|
|
3278
|
-
*
|
|
3257
|
+
* <p>For OpenID Connect (OIDC) providers:</p>
|
|
3258
|
+
* <ul>
|
|
3279
3259
|
* <li>
|
|
3280
|
-
*
|
|
3281
|
-
*
|
|
3260
|
+
* <p>client_id</p>
|
|
3261
|
+
* </li>
|
|
3282
3262
|
* <li>
|
|
3283
|
-
*
|
|
3284
|
-
*
|
|
3263
|
+
* <p>client_secret</p>
|
|
3264
|
+
* </li>
|
|
3285
3265
|
* <li>
|
|
3286
|
-
*
|
|
3287
|
-
*
|
|
3266
|
+
* <p>attributes_request_method</p>
|
|
3267
|
+
* </li>
|
|
3288
3268
|
* <li>
|
|
3289
|
-
*
|
|
3290
|
-
*
|
|
3269
|
+
* <p>oidc_issuer</p>
|
|
3270
|
+
* </li>
|
|
3291
3271
|
* <li>
|
|
3292
|
-
*
|
|
3293
|
-
*
|
|
3272
|
+
* <p>authorize_scopes</p>
|
|
3273
|
+
* </li>
|
|
3294
3274
|
* <li>
|
|
3295
|
-
*
|
|
3275
|
+
* <p>The following keys are only present if Amazon Cognito didn't discover them at
|
|
3296
3276
|
* the <code>oidc_issuer</code> URL.</p>
|
|
3297
|
-
*
|
|
3277
|
+
* <ul>
|
|
3298
3278
|
* <li>
|
|
3299
|
-
*
|
|
3300
|
-
*
|
|
3279
|
+
* <p>authorize_url </p>
|
|
3280
|
+
* </li>
|
|
3301
3281
|
* <li>
|
|
3302
|
-
*
|
|
3303
|
-
*
|
|
3282
|
+
* <p>token_url </p>
|
|
3283
|
+
* </li>
|
|
3304
3284
|
* <li>
|
|
3305
|
-
*
|
|
3306
|
-
*
|
|
3285
|
+
* <p>attributes_url </p>
|
|
3286
|
+
* </li>
|
|
3307
3287
|
* <li>
|
|
3308
|
-
*
|
|
3309
|
-
*
|
|
3288
|
+
* <p>jwks_uri </p>
|
|
3289
|
+
* </li>
|
|
3310
3290
|
* </ul>
|
|
3311
|
-
*
|
|
3291
|
+
* </li>
|
|
3312
3292
|
* <li>
|
|
3313
|
-
*
|
|
3293
|
+
* <p>Amazon Cognito sets the value of the following keys automatically. They are
|
|
3314
3294
|
* read-only.</p>
|
|
3315
|
-
*
|
|
3295
|
+
* <ul>
|
|
3316
3296
|
* <li>
|
|
3317
|
-
*
|
|
3318
|
-
*
|
|
3297
|
+
* <p>attributes_url_add_attributes </p>
|
|
3298
|
+
* </li>
|
|
3319
3299
|
* </ul>
|
|
3320
|
-
*
|
|
3300
|
+
* </li>
|
|
3321
3301
|
* </ul>
|
|
3322
3302
|
* </li>
|
|
3323
3303
|
* <li>
|
|
3324
|
-
*
|
|
3325
|
-
*
|
|
3304
|
+
* <p>For SAML providers:</p>
|
|
3305
|
+
* <ul>
|
|
3326
3306
|
* <li>
|
|
3327
|
-
*
|
|
3328
|
-
*
|
|
3307
|
+
* <p>MetadataFile or MetadataURL</p>
|
|
3308
|
+
* </li>
|
|
3329
3309
|
* <li>
|
|
3330
|
-
*
|
|
3310
|
+
* <p>IDPSignout <i>optional</i>
|
|
3331
3311
|
* </p>
|
|
3332
|
-
*
|
|
3312
|
+
* </li>
|
|
3333
3313
|
* </ul>
|
|
3334
3314
|
* </li>
|
|
3335
3315
|
* </ul>
|
|
@@ -3364,119 +3344,119 @@ export interface IdentityProviderType {
|
|
|
3364
3344
|
/**
|
|
3365
3345
|
* <p>The IdP details. The following list describes the provider detail keys for each IdP
|
|
3366
3346
|
* type.</p>
|
|
3367
|
-
*
|
|
3347
|
+
* <ul>
|
|
3368
3348
|
* <li>
|
|
3369
|
-
*
|
|
3370
|
-
*
|
|
3349
|
+
* <p>For Google and Login with Amazon:</p>
|
|
3350
|
+
* <ul>
|
|
3371
3351
|
* <li>
|
|
3372
|
-
*
|
|
3373
|
-
*
|
|
3352
|
+
* <p>client_id</p>
|
|
3353
|
+
* </li>
|
|
3374
3354
|
* <li>
|
|
3375
|
-
*
|
|
3376
|
-
*
|
|
3355
|
+
* <p>client_secret</p>
|
|
3356
|
+
* </li>
|
|
3377
3357
|
* <li>
|
|
3378
|
-
*
|
|
3379
|
-
*
|
|
3358
|
+
* <p>authorize_scopes</p>
|
|
3359
|
+
* </li>
|
|
3380
3360
|
* </ul>
|
|
3381
3361
|
* </li>
|
|
3382
3362
|
* <li>
|
|
3383
|
-
*
|
|
3384
|
-
*
|
|
3363
|
+
* <p>For Facebook:</p>
|
|
3364
|
+
* <ul>
|
|
3385
3365
|
* <li>
|
|
3386
|
-
*
|
|
3387
|
-
*
|
|
3366
|
+
* <p>client_id</p>
|
|
3367
|
+
* </li>
|
|
3388
3368
|
* <li>
|
|
3389
|
-
*
|
|
3390
|
-
*
|
|
3369
|
+
* <p>client_secret</p>
|
|
3370
|
+
* </li>
|
|
3391
3371
|
* <li>
|
|
3392
|
-
*
|
|
3393
|
-
*
|
|
3372
|
+
* <p>authorize_scopes</p>
|
|
3373
|
+
* </li>
|
|
3394
3374
|
* <li>
|
|
3395
|
-
*
|
|
3396
|
-
*
|
|
3375
|
+
* <p>api_version</p>
|
|
3376
|
+
* </li>
|
|
3397
3377
|
* </ul>
|
|
3398
3378
|
* </li>
|
|
3399
3379
|
* <li>
|
|
3400
|
-
*
|
|
3401
|
-
*
|
|
3380
|
+
* <p>For Sign in with Apple:</p>
|
|
3381
|
+
* <ul>
|
|
3402
3382
|
* <li>
|
|
3403
|
-
*
|
|
3404
|
-
*
|
|
3383
|
+
* <p>client_id</p>
|
|
3384
|
+
* </li>
|
|
3405
3385
|
* <li>
|
|
3406
|
-
*
|
|
3407
|
-
*
|
|
3386
|
+
* <p>team_id</p>
|
|
3387
|
+
* </li>
|
|
3408
3388
|
* <li>
|
|
3409
|
-
*
|
|
3410
|
-
*
|
|
3389
|
+
* <p>key_id</p>
|
|
3390
|
+
* </li>
|
|
3411
3391
|
* <li>
|
|
3412
|
-
*
|
|
3413
|
-
*
|
|
3392
|
+
* <p>private_key</p>
|
|
3393
|
+
* <p>
|
|
3414
3394
|
* <i>You can submit a private_key when you add or update an IdP.
|
|
3415
3395
|
* Describe operations don't return the private key.</i>
|
|
3416
3396
|
* </p>
|
|
3417
|
-
*
|
|
3397
|
+
* </li>
|
|
3418
3398
|
* <li>
|
|
3419
|
-
*
|
|
3420
|
-
*
|
|
3399
|
+
* <p>authorize_scopes</p>
|
|
3400
|
+
* </li>
|
|
3421
3401
|
* </ul>
|
|
3422
3402
|
* </li>
|
|
3423
3403
|
* <li>
|
|
3424
|
-
*
|
|
3425
|
-
*
|
|
3404
|
+
* <p>For OIDC providers:</p>
|
|
3405
|
+
* <ul>
|
|
3426
3406
|
* <li>
|
|
3427
|
-
*
|
|
3428
|
-
*
|
|
3407
|
+
* <p>client_id</p>
|
|
3408
|
+
* </li>
|
|
3429
3409
|
* <li>
|
|
3430
|
-
*
|
|
3431
|
-
*
|
|
3410
|
+
* <p>client_secret</p>
|
|
3411
|
+
* </li>
|
|
3432
3412
|
* <li>
|
|
3433
|
-
*
|
|
3434
|
-
*
|
|
3413
|
+
* <p>attributes_request_method</p>
|
|
3414
|
+
* </li>
|
|
3435
3415
|
* <li>
|
|
3436
|
-
*
|
|
3437
|
-
*
|
|
3416
|
+
* <p>oidc_issuer</p>
|
|
3417
|
+
* </li>
|
|
3438
3418
|
* <li>
|
|
3439
|
-
*
|
|
3440
|
-
*
|
|
3419
|
+
* <p>authorize_scopes</p>
|
|
3420
|
+
* </li>
|
|
3441
3421
|
* <li>
|
|
3442
|
-
*
|
|
3422
|
+
* <p>The following keys are only present if Amazon Cognito didn't discover them at
|
|
3443
3423
|
* the <code>oidc_issuer</code> URL.</p>
|
|
3444
|
-
*
|
|
3424
|
+
* <ul>
|
|
3445
3425
|
* <li>
|
|
3446
|
-
*
|
|
3447
|
-
*
|
|
3426
|
+
* <p>authorize_url </p>
|
|
3427
|
+
* </li>
|
|
3448
3428
|
* <li>
|
|
3449
|
-
*
|
|
3450
|
-
*
|
|
3429
|
+
* <p>token_url </p>
|
|
3430
|
+
* </li>
|
|
3451
3431
|
* <li>
|
|
3452
|
-
*
|
|
3453
|
-
*
|
|
3432
|
+
* <p>attributes_url </p>
|
|
3433
|
+
* </li>
|
|
3454
3434
|
* <li>
|
|
3455
|
-
*
|
|
3456
|
-
*
|
|
3435
|
+
* <p>jwks_uri </p>
|
|
3436
|
+
* </li>
|
|
3457
3437
|
* </ul>
|
|
3458
|
-
*
|
|
3438
|
+
* </li>
|
|
3459
3439
|
* <li>
|
|
3460
|
-
*
|
|
3440
|
+
* <p>Amazon Cognito sets the value of the following keys automatically. They are
|
|
3461
3441
|
* read-only.</p>
|
|
3462
|
-
*
|
|
3442
|
+
* <ul>
|
|
3463
3443
|
* <li>
|
|
3464
|
-
*
|
|
3465
|
-
*
|
|
3444
|
+
* <p>attributes_url_add_attributes </p>
|
|
3445
|
+
* </li>
|
|
3466
3446
|
* </ul>
|
|
3467
|
-
*
|
|
3447
|
+
* </li>
|
|
3468
3448
|
* </ul>
|
|
3469
3449
|
* </li>
|
|
3470
3450
|
* <li>
|
|
3471
|
-
*
|
|
3472
|
-
*
|
|
3451
|
+
* <p>For SAML providers:</p>
|
|
3452
|
+
* <ul>
|
|
3473
3453
|
* <li>
|
|
3474
|
-
*
|
|
3475
|
-
*
|
|
3454
|
+
* <p>MetadataFile or MetadataURL</p>
|
|
3455
|
+
* </li>
|
|
3476
3456
|
* <li>
|
|
3477
|
-
*
|
|
3457
|
+
* <p>IDPSignout <i>optional</i>
|
|
3478
3458
|
* </p>
|
|
3479
|
-
*
|
|
3459
|
+
* </li>
|
|
3480
3460
|
* </ul>
|
|
3481
3461
|
* </li>
|
|
3482
3462
|
* </ul>
|
|
@@ -3661,41 +3641,41 @@ export interface UserImportJobType {
|
|
|
3661
3641
|
CompletionDate?: Date;
|
|
3662
3642
|
/**
|
|
3663
3643
|
* <p>The status of the user import job. One of the following:</p>
|
|
3664
|
-
*
|
|
3644
|
+
* <ul>
|
|
3665
3645
|
* <li>
|
|
3666
|
-
*
|
|
3646
|
+
* <p>
|
|
3667
3647
|
* <code>Created</code> - The job was created but not started.</p>
|
|
3668
3648
|
* </li>
|
|
3669
3649
|
* <li>
|
|
3670
|
-
*
|
|
3650
|
+
* <p>
|
|
3671
3651
|
* <code>Pending</code> - A transition state. You have started the job, but it
|
|
3672
3652
|
* has not begun importing users yet.</p>
|
|
3673
3653
|
* </li>
|
|
3674
3654
|
* <li>
|
|
3675
|
-
*
|
|
3655
|
+
* <p>
|
|
3676
3656
|
* <code>InProgress</code> - The job has started, and users are being
|
|
3677
3657
|
* imported.</p>
|
|
3678
3658
|
* </li>
|
|
3679
3659
|
* <li>
|
|
3680
|
-
*
|
|
3660
|
+
* <p>
|
|
3681
3661
|
* <code>Stopping</code> - You have stopped the job, but the job has not stopped
|
|
3682
3662
|
* importing users yet.</p>
|
|
3683
3663
|
* </li>
|
|
3684
3664
|
* <li>
|
|
3685
|
-
*
|
|
3665
|
+
* <p>
|
|
3686
3666
|
* <code>Stopped</code> - You have stopped the job, and the job has stopped
|
|
3687
3667
|
* importing users.</p>
|
|
3688
3668
|
* </li>
|
|
3689
3669
|
* <li>
|
|
3690
|
-
*
|
|
3670
|
+
* <p>
|
|
3691
3671
|
* <code>Succeeded</code> - The job has completed successfully.</p>
|
|
3692
3672
|
* </li>
|
|
3693
3673
|
* <li>
|
|
3694
|
-
*
|
|
3674
|
+
* <p>
|
|
3695
3675
|
* <code>Failed</code> - The job has stopped due to an error.</p>
|
|
3696
3676
|
* </li>
|
|
3697
3677
|
* <li>
|
|
3698
|
-
*
|
|
3678
|
+
* <p>
|
|
3699
3679
|
* <code>Expired</code> - You created a job, but did not start the job within
|
|
3700
3680
|
* 24-48 hours. All data associated with the job was deleted, and the job can't be
|
|
3701
3681
|
* started.</p>
|
|
@@ -3758,7 +3738,7 @@ export type DeletionProtectionType = (typeof DeletionProtectionType)[keyof typeo
|
|
|
3758
3738
|
* <code>DeviceOnlyRememberedOnUserPrompt</code> is <code>true</code>, you must follow
|
|
3759
3739
|
* <code>ConfirmDevice</code> with an <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateDeviceStatus.html">UpdateDeviceStatus</a> API request that sets the user's device to
|
|
3760
3740
|
* <code>remembered</code> or <code>not_remembered</code>.</p>
|
|
3761
|
-
*
|
|
3741
|
+
* <p>To sign in with a remembered device, include <code>DEVICE_KEY</code> in the
|
|
3762
3742
|
* authentication parameters in your user's <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html">
|
|
3763
3743
|
* InitiateAuth</a> request. If your app doesn't include a <code>DEVICE_KEY</code>
|
|
3764
3744
|
* parameter, the <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html#API_InitiateAuth_ResponseSyntax">response</a> from Amazon Cognito includes newly-generated <code>DEVICE_KEY</code> and
|
|
@@ -3788,7 +3768,7 @@ export interface DeviceConfigurationType {
|
|
|
3788
3768
|
* your user to choose whether they want to remember their device. Return the user's choice
|
|
3789
3769
|
* in an <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateDeviceStatus.html">
|
|
3790
3770
|
* UpdateDeviceStatus</a> API request.</p>
|
|
3791
|
-
*
|
|
3771
|
+
* <p>When <code>DeviceOnlyRememberedOnUserPrompt</code> is <code>false</code>, Amazon
|
|
3792
3772
|
* Cognito immediately remembers devices that you register in a <code>ConfirmDevice</code>
|
|
3793
3773
|
* API request.</p>
|
|
3794
3774
|
*/
|
|
@@ -3811,29 +3791,29 @@ export type EmailSendingAccountType = (typeof EmailSendingAccountType)[keyof typ
|
|
|
3811
3791
|
* <p>The email configuration of your user pool. The email configuration type sets your
|
|
3812
3792
|
* preferred sending method, Amazon Web Services Region, and sender for messages from your user
|
|
3813
3793
|
* pool.</p>
|
|
3814
|
-
*
|
|
3794
|
+
* <note>
|
|
3815
3795
|
* <p>Amazon Cognito can send email messages with Amazon Simple Email Service resources in the Amazon Web Services Region where
|
|
3816
3796
|
* you created your user pool, and in alternate Regions in some cases. For more
|
|
3817
3797
|
* information on the supported Regions, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-email.html">Email settings for Amazon Cognito user pools</a>.</p>
|
|
3818
|
-
*
|
|
3798
|
+
* </note>
|
|
3819
3799
|
*/
|
|
3820
3800
|
export interface EmailConfigurationType {
|
|
3821
3801
|
/**
|
|
3822
3802
|
* <p>The ARN of a verified email address in Amazon SES. Amazon Cognito uses this email address in one of
|
|
3823
3803
|
* the following ways, depending on the value that you specify for the
|
|
3824
3804
|
* <code>EmailSendingAccount</code> parameter:</p>
|
|
3825
|
-
*
|
|
3805
|
+
* <ul>
|
|
3826
3806
|
* <li>
|
|
3827
|
-
*
|
|
3807
|
+
* <p>If you specify <code>COGNITO_DEFAULT</code>, Amazon Cognito uses this address as the
|
|
3828
3808
|
* custom FROM address when it emails your users using its built-in email
|
|
3829
3809
|
* account.</p>
|
|
3830
3810
|
* </li>
|
|
3831
3811
|
* <li>
|
|
3832
|
-
*
|
|
3812
|
+
* <p>If you specify <code>DEVELOPER</code>, Amazon Cognito emails your users with this
|
|
3833
3813
|
* address by calling Amazon SES on your behalf.</p>
|
|
3834
3814
|
* </li>
|
|
3835
3815
|
* </ul>
|
|
3836
|
-
*
|
|
3816
|
+
* <p>The Region value of the <code>SourceArn</code> parameter must indicate a supported
|
|
3837
3817
|
* Amazon Web Services Region of your user pool. Typically, the Region in the <code>SourceArn</code> and
|
|
3838
3818
|
* the user pool Region are the same. For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-email.html#user-pool-email-developer-region-mapping">Amazon SES email configuration regions</a> in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools.html">Amazon Cognito Developer
|
|
3839
3819
|
* Guide</a>.</p>
|
|
@@ -3847,31 +3827,30 @@ export interface EmailConfigurationType {
|
|
|
3847
3827
|
* <p>Specifies whether Amazon Cognito uses its built-in functionality to send your users email
|
|
3848
3828
|
* messages, or uses your Amazon Simple Email Service email configuration. Specify one of the following
|
|
3849
3829
|
* values:</p>
|
|
3850
|
-
*
|
|
3830
|
+
* <dl>
|
|
3851
3831
|
* <dt>COGNITO_DEFAULT</dt>
|
|
3852
3832
|
* <dd>
|
|
3853
|
-
*
|
|
3833
|
+
* <p>When Amazon Cognito emails your users, it uses its built-in email functionality.
|
|
3854
3834
|
* When you use the default option, Amazon Cognito allows only a limited number of
|
|
3855
3835
|
* emails each day for your user pool. For typical production environments, the
|
|
3856
3836
|
* default email limit is less than the required delivery volume. To achieve a
|
|
3857
3837
|
* higher delivery volume, specify DEVELOPER to use your Amazon SES email
|
|
3858
3838
|
* configuration.</p>
|
|
3859
|
-
*
|
|
3860
|
-
*
|
|
3839
|
+
* <p>To look up the email delivery limit for the default option, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/limits.html">Limits</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
3840
|
+
* <p>The default FROM address is <code>no-reply@verificationemail.com</code>.
|
|
3861
3841
|
* To customize the FROM address, provide the Amazon Resource Name (ARN) of an
|
|
3862
3842
|
* Amazon SES verified email address for the <code>SourceArn</code>
|
|
3863
3843
|
* parameter.</p>
|
|
3864
|
-
*
|
|
3865
|
-
* </dd>
|
|
3844
|
+
* </dd>
|
|
3866
3845
|
* <dt>DEVELOPER</dt>
|
|
3867
3846
|
* <dd>
|
|
3868
|
-
*
|
|
3847
|
+
* <p>When Amazon Cognito emails your users, it uses your Amazon SES configuration. Amazon Cognito
|
|
3869
3848
|
* calls Amazon SES on your behalf to send email from your verified email address.
|
|
3870
3849
|
* When you use this option, the email delivery limits are the same limits that
|
|
3871
3850
|
* apply to your Amazon SES verified email address in your Amazon Web Services account.</p>
|
|
3872
|
-
*
|
|
3851
|
+
* <p>If you use this option, provide the ARN of an Amazon SES verified email address
|
|
3873
3852
|
* for the <code>SourceArn</code> parameter.</p>
|
|
3874
|
-
*
|
|
3853
|
+
* <p>Before Amazon Cognito can email your users, it requires additional permissions to
|
|
3875
3854
|
* call Amazon SES on your behalf. When you update your user pool with this option,
|
|
3876
3855
|
* Amazon Cognito creates a <i>service-linked role</i>, which is a type of
|
|
3877
3856
|
* role in your Amazon Web Services account. This role contains the permissions
|
|
@@ -3879,7 +3858,7 @@ export interface EmailConfigurationType {
|
|
|
3879
3858
|
* more information about the service-linked role that Amazon Cognito creates, see
|
|
3880
3859
|
* <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/using-service-linked-roles.html">Using Service-Linked Roles for Amazon Cognito</a> in the
|
|
3881
3860
|
* <i>Amazon Cognito Developer Guide</i>.</p>
|
|
3882
|
-
*
|
|
3861
|
+
* </dd>
|
|
3883
3862
|
* </dl>
|
|
3884
3863
|
*/
|
|
3885
3864
|
EmailSendingAccount?: EmailSendingAccountType | string;
|
|
@@ -3896,20 +3875,20 @@ export interface EmailConfigurationType {
|
|
|
3896
3875
|
* set in the headers of the email. Once applied, all of the rules in that configuration
|
|
3897
3876
|
* set are applied to the email. Configuration sets can be used to apply the following
|
|
3898
3877
|
* types of rules to emails: </p>
|
|
3899
|
-
*
|
|
3878
|
+
* <dl>
|
|
3900
3879
|
* <dt>Event publishing</dt>
|
|
3901
3880
|
* <dd>
|
|
3902
|
-
*
|
|
3881
|
+
* <p>Amazon Simple Email Service can track the number of send, delivery, open, click, bounce, and
|
|
3903
3882
|
* complaint events for each email sent. Use event publishing to send
|
|
3904
3883
|
* information about these events to other Amazon Web Services services such as and
|
|
3905
3884
|
* Amazon CloudWatch</p>
|
|
3906
|
-
*
|
|
3885
|
+
* </dd>
|
|
3907
3886
|
* <dt>IP pool management</dt>
|
|
3908
3887
|
* <dd>
|
|
3909
|
-
*
|
|
3888
|
+
* <p>When leasing dedicated IP addresses with Amazon Simple Email Service, you can create groups
|
|
3910
3889
|
* of IP addresses, called dedicated IP pools. You can then associate the
|
|
3911
3890
|
* dedicated IP pools with configuration sets.</p>
|
|
3912
|
-
*
|
|
3891
|
+
* </dd>
|
|
3913
3892
|
* </dl>
|
|
3914
3893
|
*/
|
|
3915
3894
|
ConfigurationSet?: string;
|
|
@@ -4074,11 +4053,11 @@ export interface PasswordPolicyType {
|
|
|
4074
4053
|
/**
|
|
4075
4054
|
* <p>The number of days a temporary password is valid in the password policy. If the user
|
|
4076
4055
|
* doesn't sign in during this time, an administrator must reset their password.</p>
|
|
4077
|
-
*
|
|
4056
|
+
* <note>
|
|
4078
4057
|
* <p>When you set <code>TemporaryPasswordValidityDays</code> for a user pool, you can
|
|
4079
4058
|
* no longer set a value for the legacy <code>UnusedAccountValidityDays</code>
|
|
4080
4059
|
* parameter in that user pool.</p>
|
|
4081
|
-
*
|
|
4060
|
+
* </note>
|
|
4082
4061
|
*/
|
|
4083
4062
|
TemporaryPasswordValidityDays?: number;
|
|
4084
4063
|
}
|
|
@@ -4116,7 +4095,7 @@ export interface SmsConfigurationType {
|
|
|
4116
4095
|
* for SMS multi-factor authentication (MFA), Amazon Cognito creates a role with the required
|
|
4117
4096
|
* permissions and a trust policy that demonstrates use of the
|
|
4118
4097
|
* <code>ExternalId</code>.</p>
|
|
4119
|
-
*
|
|
4098
|
+
* <p>For more information about the <code>ExternalId</code> of a role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html">How to use an
|
|
4120
4099
|
* external ID when granting access to your Amazon Web Services resources to a third
|
|
4121
4100
|
* party</a>
|
|
4122
4101
|
* </p>
|
|
@@ -4126,7 +4105,7 @@ export interface SmsConfigurationType {
|
|
|
4126
4105
|
* <p>The Amazon Web Services Region to use with Amazon SNS integration. You can choose the same Region as your
|
|
4127
4106
|
* user pool, or a supported <b>Legacy Amazon SNS alternate
|
|
4128
4107
|
* Region</b>. </p>
|
|
4129
|
-
*
|
|
4108
|
+
* <p>
|
|
4130
4109
|
* Amazon Cognito resources in the Asia Pacific (Seoul) Amazon Web Services Region must use your Amazon SNS
|
|
4131
4110
|
* configuration in the Asia Pacific (Tokyo) Region. For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html">SMS message settings for Amazon Cognito user pools</a>.</p>
|
|
4132
4111
|
*/
|
|
@@ -4146,9 +4125,9 @@ export interface UserAttributeUpdateSettingsType {
|
|
|
4146
4125
|
* this option activated, Amazon Cognito sends a verification message to the new phone number or
|
|
4147
4126
|
* email address. Amazon Cognito doesn’t change the value of the attribute until your user responds
|
|
4148
4127
|
* to the verification message and confirms the new value.</p>
|
|
4149
|
-
*
|
|
4128
|
+
* <p>You can verify an updated email address or phone number with a <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifyUserAttribute.html">VerifyUserAttribute</a> API request. You can also call the <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserAttributes.html">UpdateUserAttributes</a> or <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateUserAttributes.html">AdminUpdateUserAttributes</a> API and set <code>email_verified</code> or
|
|
4150
4129
|
* <code>phone_number_verified</code> to true.</p>
|
|
4151
|
-
*
|
|
4130
|
+
* <p>When <code>AttributesRequireVerificationBeforeUpdate</code> is false, your user pool
|
|
4152
4131
|
* doesn't require that your users verify attribute changes before Amazon Cognito updates them. In a
|
|
4153
4132
|
* user pool where <code>AttributesRequireVerificationBeforeUpdate</code> is false, API
|
|
4154
4133
|
* operations that change attribute values can immediately update a user’s
|
|
@@ -4176,22 +4155,22 @@ export interface UsernameConfigurationType {
|
|
|
4176
4155
|
/**
|
|
4177
4156
|
* <p>Specifies whether user name case sensitivity will be applied for all users in the user
|
|
4178
4157
|
* pool through Amazon Cognito APIs.</p>
|
|
4179
|
-
*
|
|
4180
|
-
*
|
|
4158
|
+
* <p>Valid values include:</p>
|
|
4159
|
+
* <dl>
|
|
4181
4160
|
* <dt>True</dt>
|
|
4182
4161
|
* <dd>
|
|
4183
|
-
*
|
|
4162
|
+
* <p>Enables case sensitivity for all username input. When this option is set
|
|
4184
4163
|
* to <code>True</code>, users must sign in using the exact capitalization of
|
|
4185
4164
|
* their given username, such as “UserName”. This is the default value.</p>
|
|
4186
|
-
*
|
|
4165
|
+
* </dd>
|
|
4187
4166
|
* <dt>False</dt>
|
|
4188
4167
|
* <dd>
|
|
4189
|
-
*
|
|
4168
|
+
* <p>Enables case insensitivity for all username input. For example, when this
|
|
4190
4169
|
* option is set to <code>False</code>, users can sign in using either
|
|
4191
4170
|
* "username" or "Username". This option also enables both
|
|
4192
4171
|
* <code>preferred_username</code> and <code>email</code> alias to be case
|
|
4193
4172
|
* insensitive, in addition to the <code>username</code> attribute.</p>
|
|
4194
|
-
*
|
|
4173
|
+
* </dd>
|
|
4195
4174
|
* </dl>
|
|
4196
4175
|
*/
|
|
4197
4176
|
CaseSensitive: boolean | undefined;
|
|
@@ -4274,7 +4253,7 @@ export interface CreateUserPoolRequest {
|
|
|
4274
4253
|
* <p>When active, <code>DeletionProtection</code> prevents accidental deletion of your user
|
|
4275
4254
|
* pool. Before you can delete a user pool that you have protected against deletion, you
|
|
4276
4255
|
* must deactivate this feature.</p>
|
|
4277
|
-
*
|
|
4256
|
+
* <p>When you try to delete a protected user pool in a <code>DeleteUserPool</code> API request,
|
|
4278
4257
|
* Amazon Cognito returns an <code>InvalidParameterException</code> error. To delete a protected user pool,
|
|
4279
4258
|
* send a new <code>DeleteUserPool</code> request after you deactivate deletion protection in an
|
|
4280
4259
|
* <code>UpdateUserPool</code> API request.</p>
|
|
@@ -4282,7 +4261,7 @@ export interface CreateUserPoolRequest {
|
|
|
4282
4261
|
DeletionProtection?: DeletionProtectionType | string;
|
|
4283
4262
|
/**
|
|
4284
4263
|
* <p>The Lambda trigger configuration information for the new user pool.</p>
|
|
4285
|
-
*
|
|
4264
|
+
* <note>
|
|
4286
4265
|
* <p>In a push model, event sources (such as Amazon S3 and custom applications) need
|
|
4287
4266
|
* permission to invoke a function. So you must make an extra call to add permission
|
|
4288
4267
|
* for these event sources to invoke your Lambda function.</p>
|
|
@@ -4291,7 +4270,7 @@ export interface CreateUserPoolRequest {
|
|
|
4291
4270
|
* AddPermission </a>. </p>
|
|
4292
4271
|
* <p>For adding permission using the CLI, see<a href="https://docs.aws.amazon.com/cli/latest/reference/lambda/add-permission.html"> add-permission
|
|
4293
4272
|
* </a>.</p>
|
|
4294
|
-
*
|
|
4273
|
+
* </note>
|
|
4295
4274
|
*/
|
|
4296
4275
|
LambdaConfig?: LambdaConfigType;
|
|
4297
4276
|
/**
|
|
@@ -4342,9 +4321,9 @@ export interface CreateUserPoolRequest {
|
|
|
4342
4321
|
UserAttributeUpdateSettings?: UserAttributeUpdateSettingsType;
|
|
4343
4322
|
/**
|
|
4344
4323
|
* <p>The device-remembering configuration for a user pool. A null value indicates that you have deactivated device remembering in your user pool.</p>
|
|
4345
|
-
*
|
|
4324
|
+
* <note>
|
|
4346
4325
|
* <p>When you provide a value for any <code>DeviceConfiguration</code> field, you activate the Amazon Cognito device-remembering feature.</p>
|
|
4347
|
-
*
|
|
4326
|
+
* </note>
|
|
4348
4327
|
*/
|
|
4349
4328
|
DeviceConfiguration?: DeviceConfigurationType;
|
|
4350
4329
|
/**
|
|
@@ -4430,7 +4409,7 @@ export interface UserPoolType {
|
|
|
4430
4409
|
* <p>When active, <code>DeletionProtection</code> prevents accidental deletion of your user
|
|
4431
4410
|
* pool. Before you can delete a user pool that you have protected against deletion, you
|
|
4432
4411
|
* must deactivate this feature.</p>
|
|
4433
|
-
*
|
|
4412
|
+
* <p>When you try to delete a protected user pool in a <code>DeleteUserPool</code> API request,
|
|
4434
4413
|
* Amazon Cognito returns an <code>InvalidParameterException</code> error. To delete a protected user pool,
|
|
4435
4414
|
* send a new <code>DeleteUserPool</code> request after you deactivate deletion protection in an
|
|
4436
4415
|
* <code>UpdateUserPool</code> API request.</p>
|
|
@@ -4498,20 +4477,20 @@ export interface UserPoolType {
|
|
|
4498
4477
|
UserAttributeUpdateSettings?: UserAttributeUpdateSettingsType;
|
|
4499
4478
|
/**
|
|
4500
4479
|
* <p>Can be one of the following values:</p>
|
|
4501
|
-
*
|
|
4480
|
+
* <ul>
|
|
4502
4481
|
* <li>
|
|
4503
|
-
*
|
|
4504
|
-
*
|
|
4482
|
+
* <p>
|
|
4483
|
+
* <code>OFF</code> - MFA tokens aren't required and can't be specified during user
|
|
4505
4484
|
* registration.</p>
|
|
4506
4485
|
* </li>
|
|
4507
4486
|
* <li>
|
|
4508
|
-
*
|
|
4509
|
-
*
|
|
4487
|
+
* <p>
|
|
4488
|
+
* <code>ON</code> - MFA tokens are required for all user registrations. You can
|
|
4510
4489
|
* only specify required when you're initially creating a user pool.</p>
|
|
4511
4490
|
* </li>
|
|
4512
4491
|
* <li>
|
|
4513
|
-
*
|
|
4514
|
-
*
|
|
4492
|
+
* <p>
|
|
4493
|
+
* <code>OPTIONAL</code> - Users have the option when registering to create an MFA
|
|
4515
4494
|
* token.</p>
|
|
4516
4495
|
* </li>
|
|
4517
4496
|
* </ul>
|
|
@@ -4519,9 +4498,9 @@ export interface UserPoolType {
|
|
|
4519
4498
|
MfaConfiguration?: UserPoolMfaType | string;
|
|
4520
4499
|
/**
|
|
4521
4500
|
* <p>The device-remembering configuration for a user pool. A null value indicates that you have deactivated device remembering in your user pool.</p>
|
|
4522
|
-
*
|
|
4501
|
+
* <note>
|
|
4523
4502
|
* <p>When you provide a value for any <code>DeviceConfiguration</code> field, you activate the Amazon Cognito device-remembering feature.</p>
|
|
4524
|
-
*
|
|
4503
|
+
* </note>
|
|
4525
4504
|
*/
|
|
4526
4505
|
DeviceConfiguration?: DeviceConfigurationType;
|
|
4527
4506
|
/**
|
|
@@ -4549,23 +4528,23 @@ export interface UserPoolType {
|
|
|
4549
4528
|
UserPoolTags?: Record<string, string>;
|
|
4550
4529
|
/**
|
|
4551
4530
|
* <p>The reason why the SMS configuration can't send the messages to your users.</p>
|
|
4552
|
-
*
|
|
4531
|
+
* <p>This message might include comma-separated values to describe why your SMS
|
|
4553
4532
|
* configuration can't send messages to user pool end users.</p>
|
|
4554
|
-
*
|
|
4533
|
+
* <dl>
|
|
4555
4534
|
* <dt>InvalidSmsRoleAccessPolicyException</dt>
|
|
4556
4535
|
* <dd>
|
|
4557
|
-
*
|
|
4536
|
+
* <p>The Identity and Access Management role that Amazon Cognito uses to send SMS messages isn't properly
|
|
4558
4537
|
* configured. For more information, see <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SmsConfigurationType.html">SmsConfigurationType</a>.</p>
|
|
4559
|
-
*
|
|
4538
|
+
* </dd>
|
|
4560
4539
|
* <dt>SNSSandbox</dt>
|
|
4561
4540
|
* <dd>
|
|
4562
|
-
*
|
|
4541
|
+
* <p>The Amazon Web Services account is in the SNS SMS Sandbox and messages will
|
|
4563
4542
|
* only reach verified end users. This parameter won’t get populated with
|
|
4564
4543
|
* SNSSandbox if the IAM user creating the user pool doesn’t have SNS
|
|
4565
4544
|
* permissions. To learn how to move your Amazon Web Services account out of the
|
|
4566
4545
|
* sandbox, see <a href="https://docs.aws.amazon.com/sns/latest/dg/sns-sms-sandbox-moving-to-production.html">Moving out
|
|
4567
4546
|
* of the SMS sandbox</a>.</p>
|
|
4568
|
-
*
|
|
4547
|
+
* </dd>
|
|
4569
4548
|
* </dl>
|
|
4570
4549
|
*/
|
|
4571
4550
|
SmsConfigurationFailure?: string;
|
|
@@ -4583,7 +4562,7 @@ export interface UserPoolType {
|
|
|
4583
4562
|
* <p>A custom domain name that you provide to Amazon Cognito. This parameter applies only if you use
|
|
4584
4563
|
* a custom domain to host the sign-up and sign-in pages for your application. An example
|
|
4585
4564
|
* of a custom domain name might be <code>auth.example.com</code>.</p>
|
|
4586
|
-
*
|
|
4565
|
+
* <p>For more information about adding a custom domain to your user pool, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-add-custom-domain.html">Using Your Own Domain for the Hosted UI</a>.</p>
|
|
4587
4566
|
*/
|
|
4588
4567
|
CustomDomain?: string;
|
|
4589
4568
|
/**
|
|
@@ -4743,14 +4722,14 @@ export interface CreateUserPoolClientRequest {
|
|
|
4743
4722
|
* their refresh token. To specify the time unit for <code>RefreshTokenValidity</code> as
|
|
4744
4723
|
* <code>seconds</code>, <code>minutes</code>, <code>hours</code>, or <code>days</code>,
|
|
4745
4724
|
* set a <code>TokenValidityUnits</code> value in your API request.</p>
|
|
4746
|
-
*
|
|
4725
|
+
* <p>For example, when you set <code>RefreshTokenValidity</code> as <code>10</code> and
|
|
4747
4726
|
* <code>TokenValidityUnits</code> as <code>days</code>, your user can refresh their session
|
|
4748
4727
|
* and retrieve new access and ID tokens for 10 days.</p>
|
|
4749
|
-
*
|
|
4728
|
+
* <p>The default time unit for <code>RefreshTokenValidity</code> in an API request is days.
|
|
4750
4729
|
* You can't set <code>RefreshTokenValidity</code> to 0. If you do, Amazon Cognito overrides the
|
|
4751
4730
|
* value with the default value of 30 days. <i>Valid range</i> is displayed below
|
|
4752
4731
|
* in seconds.</p>
|
|
4753
|
-
*
|
|
4732
|
+
* <p>If you don't specify otherwise in the configuration of your app client, your refresh
|
|
4754
4733
|
* tokens are valid for 30 days.</p>
|
|
4755
4734
|
*/
|
|
4756
4735
|
RefreshTokenValidity?: number;
|
|
@@ -4759,12 +4738,12 @@ export interface CreateUserPoolClientRequest {
|
|
|
4759
4738
|
* their access token. To specify the time unit for <code>AccessTokenValidity</code> as
|
|
4760
4739
|
* <code>seconds</code>, <code>minutes</code>, <code>hours</code>, or <code>days</code>,
|
|
4761
4740
|
* set a <code>TokenValidityUnits</code> value in your API request.</p>
|
|
4762
|
-
*
|
|
4741
|
+
* <p>For example, when you set <code>AccessTokenValidity</code> to <code>10</code> and
|
|
4763
4742
|
* <code>TokenValidityUnits</code> to <code>hours</code>, your user can authorize access with
|
|
4764
4743
|
* their access token for 10 hours.</p>
|
|
4765
|
-
*
|
|
4744
|
+
* <p>The default time unit for <code>AccessTokenValidity</code> in an API request is hours.
|
|
4766
4745
|
* <i>Valid range</i> is displayed below in seconds.</p>
|
|
4767
|
-
*
|
|
4746
|
+
* <p>If you don't specify otherwise in the configuration of your app client, your access
|
|
4768
4747
|
* tokens are valid for one hour.</p>
|
|
4769
4748
|
*/
|
|
4770
4749
|
AccessTokenValidity?: number;
|
|
@@ -4773,12 +4752,12 @@ export interface CreateUserPoolClientRequest {
|
|
|
4773
4752
|
* their ID token. To specify the time unit for <code>IdTokenValidity</code> as
|
|
4774
4753
|
* <code>seconds</code>, <code>minutes</code>, <code>hours</code>, or <code>days</code>,
|
|
4775
4754
|
* set a <code>TokenValidityUnits</code> value in your API request.</p>
|
|
4776
|
-
*
|
|
4755
|
+
* <p>For example, when you set <code>IdTokenValidity</code> as <code>10</code> and
|
|
4777
4756
|
* <code>TokenValidityUnits</code> as <code>hours</code>, your user can authenticate their
|
|
4778
4757
|
* session with their ID token for 10 hours.</p>
|
|
4779
|
-
*
|
|
4758
|
+
* <p>The default time unit for <code>AccessTokenValidity</code> in an API request is hours.
|
|
4780
4759
|
* <i>Valid range</i> is displayed below in seconds.</p>
|
|
4781
|
-
*
|
|
4760
|
+
* <p>If you don't specify otherwise in the configuration of your app client, your ID
|
|
4782
4761
|
* tokens are valid for one hour.</p>
|
|
4783
4762
|
*/
|
|
4784
4763
|
IdTokenValidity?: number;
|
|
@@ -4793,7 +4772,7 @@ export interface CreateUserPoolClientRequest {
|
|
|
4793
4772
|
ReadAttributes?: string[];
|
|
4794
4773
|
/**
|
|
4795
4774
|
* <p>The user pool attributes that the app client can write to.</p>
|
|
4796
|
-
*
|
|
4775
|
+
* <p>If your app client allows users to sign in through an IdP, this array must include all
|
|
4797
4776
|
* attributes that you have mapped to IdP attributes. Amazon Cognito updates mapped attributes when
|
|
4798
4777
|
* users sign in to your application through an IdP. If your app client does not have write
|
|
4799
4778
|
* access to a mapped attribute, Amazon Cognito throws an error when it tries to update the
|
|
@@ -4854,23 +4833,23 @@ export interface CreateUserPoolClientRequest {
|
|
|
4854
4833
|
SupportedIdentityProviders?: string[];
|
|
4855
4834
|
/**
|
|
4856
4835
|
* <p>A list of allowed redirect (callback) URLs for the IdPs.</p>
|
|
4857
|
-
*
|
|
4858
|
-
*
|
|
4836
|
+
* <p>A redirect URI must:</p>
|
|
4837
|
+
* <ul>
|
|
4859
4838
|
* <li>
|
|
4860
|
-
*
|
|
4839
|
+
* <p>Be an absolute URI.</p>
|
|
4861
4840
|
* </li>
|
|
4862
4841
|
* <li>
|
|
4863
|
-
*
|
|
4842
|
+
* <p>Be registered with the authorization server.</p>
|
|
4864
4843
|
* </li>
|
|
4865
4844
|
* <li>
|
|
4866
|
-
*
|
|
4845
|
+
* <p>Not include a fragment component.</p>
|
|
4867
4846
|
* </li>
|
|
4868
4847
|
* </ul>
|
|
4869
|
-
*
|
|
4848
|
+
* <p>See <a href="https://tools.ietf.org/html/rfc6749#section-3.1.2">OAuth 2.0 -
|
|
4870
4849
|
* Redirection Endpoint</a>.</p>
|
|
4871
|
-
*
|
|
4850
|
+
* <p>Amazon Cognito requires HTTPS over HTTP except for http://localhost for testing purposes
|
|
4872
4851
|
* only.</p>
|
|
4873
|
-
*
|
|
4852
|
+
* <p>App callback URLs such as myapp://example are also supported.</p>
|
|
4874
4853
|
*/
|
|
4875
4854
|
CallbackURLs?: string[];
|
|
4876
4855
|
/**
|
|
@@ -4879,45 +4858,45 @@ export interface CreateUserPoolClientRequest {
|
|
|
4879
4858
|
LogoutURLs?: string[];
|
|
4880
4859
|
/**
|
|
4881
4860
|
* <p>The default redirect URI. Must be in the <code>CallbackURLs</code> list.</p>
|
|
4882
|
-
*
|
|
4883
|
-
*
|
|
4861
|
+
* <p>A redirect URI must:</p>
|
|
4862
|
+
* <ul>
|
|
4884
4863
|
* <li>
|
|
4885
|
-
*
|
|
4864
|
+
* <p>Be an absolute URI.</p>
|
|
4886
4865
|
* </li>
|
|
4887
4866
|
* <li>
|
|
4888
|
-
*
|
|
4867
|
+
* <p>Be registered with the authorization server.</p>
|
|
4889
4868
|
* </li>
|
|
4890
4869
|
* <li>
|
|
4891
|
-
*
|
|
4870
|
+
* <p>Not include a fragment component.</p>
|
|
4892
4871
|
* </li>
|
|
4893
4872
|
* </ul>
|
|
4894
|
-
*
|
|
4873
|
+
* <p>See <a href="https://tools.ietf.org/html/rfc6749#section-3.1.2">OAuth 2.0 -
|
|
4895
4874
|
* Redirection Endpoint</a>.</p>
|
|
4896
|
-
*
|
|
4875
|
+
* <p>Amazon Cognito requires HTTPS over HTTP except for http://localhost for testing purposes
|
|
4897
4876
|
* only.</p>
|
|
4898
|
-
*
|
|
4877
|
+
* <p>App callback URLs such as myapp://example are also supported.</p>
|
|
4899
4878
|
*/
|
|
4900
4879
|
DefaultRedirectURI?: string;
|
|
4901
4880
|
/**
|
|
4902
4881
|
* <p>The allowed OAuth flows.</p>
|
|
4903
|
-
*
|
|
4882
|
+
* <dl>
|
|
4904
4883
|
* <dt>code</dt>
|
|
4905
4884
|
* <dd>
|
|
4906
|
-
*
|
|
4885
|
+
* <p>Use a code grant flow, which provides an authorization code as the
|
|
4907
4886
|
* response. This code can be exchanged for access tokens with the
|
|
4908
4887
|
* <code>/oauth2/token</code> endpoint.</p>
|
|
4909
|
-
*
|
|
4888
|
+
* </dd>
|
|
4910
4889
|
* <dt>implicit</dt>
|
|
4911
4890
|
* <dd>
|
|
4912
|
-
*
|
|
4891
|
+
* <p>Issue the access token (and, optionally, ID token, based on scopes)
|
|
4913
4892
|
* directly to your user.</p>
|
|
4914
|
-
*
|
|
4893
|
+
* </dd>
|
|
4915
4894
|
* <dt>client_credentials</dt>
|
|
4916
4895
|
* <dd>
|
|
4917
|
-
*
|
|
4896
|
+
* <p>Issue the access token from the <code>/oauth2/token</code> endpoint
|
|
4918
4897
|
* directly to a non-person user using a combination of the client ID and
|
|
4919
4898
|
* client secret.</p>
|
|
4920
|
-
*
|
|
4899
|
+
* </dd>
|
|
4921
4900
|
* </dl>
|
|
4922
4901
|
*/
|
|
4923
4902
|
AllowedOAuthFlows?: (OAuthFlowType | string)[];
|
|
@@ -4936,12 +4915,12 @@ export interface CreateUserPoolClientRequest {
|
|
|
4936
4915
|
/**
|
|
4937
4916
|
* <p>The user pool analytics configuration for collecting metrics and sending them to your
|
|
4938
4917
|
* Amazon Pinpoint campaign.</p>
|
|
4939
|
-
*
|
|
4918
|
+
* <note>
|
|
4940
4919
|
* <p>In Amazon Web Services Regions where Amazon Pinpoint isn't available, user pools only support sending
|
|
4941
4920
|
* events to Amazon Pinpoint projects in Amazon Web Services Region us-east-1. In Regions where Amazon Pinpoint is
|
|
4942
4921
|
* available, user pools support sending events to Amazon Pinpoint projects within that same
|
|
4943
4922
|
* Region.</p>
|
|
4944
|
-
*
|
|
4923
|
+
* </note>
|
|
4945
4924
|
*/
|
|
4946
4925
|
AnalyticsConfiguration?: AnalyticsConfigurationType;
|
|
4947
4926
|
/**
|
|
@@ -4953,14 +4932,14 @@ export interface CreateUserPoolClientRequest {
|
|
|
4953
4932
|
* destination. When set to <code>LEGACY</code>, those APIs return a
|
|
4954
4933
|
* <code>UserNotFoundException</code> exception if the user doesn't exist in the user
|
|
4955
4934
|
* pool.</p>
|
|
4956
|
-
*
|
|
4957
|
-
*
|
|
4935
|
+
* <p>Valid values include:</p>
|
|
4936
|
+
* <ul>
|
|
4958
4937
|
* <li>
|
|
4959
|
-
*
|
|
4938
|
+
* <p>
|
|
4960
4939
|
* <code>ENABLED</code> - This prevents user existence-related errors.</p>
|
|
4961
4940
|
* </li>
|
|
4962
4941
|
* <li>
|
|
4963
|
-
*
|
|
4942
|
+
* <p>
|
|
4964
4943
|
* <code>LEGACY</code> - This represents the early behavior of Amazon Cognito where user
|
|
4965
4944
|
* existence related errors aren't prevented.</p>
|
|
4966
4945
|
* </li>
|
|
@@ -4970,7 +4949,7 @@ export interface CreateUserPoolClientRequest {
|
|
|
4970
4949
|
/**
|
|
4971
4950
|
* <p>Activates or deactivates token revocation. For more information about revoking tokens,
|
|
4972
4951
|
* see <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RevokeToken.html">RevokeToken</a>.</p>
|
|
4973
|
-
*
|
|
4952
|
+
* <p>If you don't include this parameter, token revocation is automatically activated for
|
|
4974
4953
|
* the new user pool client.</p>
|
|
4975
4954
|
*/
|
|
4976
4955
|
EnableTokenRevocation?: boolean;
|
|
@@ -5023,14 +5002,14 @@ export interface UserPoolClientType {
|
|
|
5023
5002
|
* their refresh token. To specify the time unit for <code>RefreshTokenValidity</code> as
|
|
5024
5003
|
* <code>seconds</code>, <code>minutes</code>, <code>hours</code>, or <code>days</code>,
|
|
5025
5004
|
* set a <code>TokenValidityUnits</code> value in your API request.</p>
|
|
5026
|
-
*
|
|
5005
|
+
* <p>For example, when you set <code>RefreshTokenValidity</code> as <code>10</code> and
|
|
5027
5006
|
* <code>TokenValidityUnits</code> as <code>days</code>, your user can refresh their session
|
|
5028
5007
|
* and retrieve new access and ID tokens for 10 days.</p>
|
|
5029
|
-
*
|
|
5008
|
+
* <p>The default time unit for <code>RefreshTokenValidity</code> in an API request is days.
|
|
5030
5009
|
* You can't set <code>RefreshTokenValidity</code> to 0. If you do, Amazon Cognito overrides the
|
|
5031
5010
|
* value with the default value of 30 days. <i>Valid range</i> is displayed below
|
|
5032
5011
|
* in seconds.</p>
|
|
5033
|
-
*
|
|
5012
|
+
* <p>If you don't specify otherwise in the configuration of your app client, your refresh
|
|
5034
5013
|
* tokens are valid for 30 days.</p>
|
|
5035
5014
|
*/
|
|
5036
5015
|
RefreshTokenValidity?: number;
|
|
@@ -5039,12 +5018,12 @@ export interface UserPoolClientType {
|
|
|
5039
5018
|
* their access token. To specify the time unit for <code>AccessTokenValidity</code> as
|
|
5040
5019
|
* <code>seconds</code>, <code>minutes</code>, <code>hours</code>, or <code>days</code>,
|
|
5041
5020
|
* set a <code>TokenValidityUnits</code> value in your API request.</p>
|
|
5042
|
-
*
|
|
5021
|
+
* <p>For example, when you set <code>AccessTokenValidity</code> to <code>10</code> and
|
|
5043
5022
|
* <code>TokenValidityUnits</code> to <code>hours</code>, your user can authorize access with
|
|
5044
5023
|
* their access token for 10 hours.</p>
|
|
5045
|
-
*
|
|
5024
|
+
* <p>The default time unit for <code>AccessTokenValidity</code> in an API request is hours.
|
|
5046
5025
|
* <i>Valid range</i> is displayed below in seconds.</p>
|
|
5047
|
-
*
|
|
5026
|
+
* <p>If you don't specify otherwise in the configuration of your app client, your access
|
|
5048
5027
|
* tokens are valid for one hour.</p>
|
|
5049
5028
|
*/
|
|
5050
5029
|
AccessTokenValidity?: number;
|
|
@@ -5053,12 +5032,12 @@ export interface UserPoolClientType {
|
|
|
5053
5032
|
* their ID token. To specify the time unit for <code>IdTokenValidity</code> as
|
|
5054
5033
|
* <code>seconds</code>, <code>minutes</code>, <code>hours</code>, or <code>days</code>,
|
|
5055
5034
|
* set a <code>TokenValidityUnits</code> value in your API request.</p>
|
|
5056
|
-
*
|
|
5035
|
+
* <p>For example, when you set <code>IdTokenValidity</code> as <code>10</code> and
|
|
5057
5036
|
* <code>TokenValidityUnits</code> as <code>hours</code>, your user can authenticate their
|
|
5058
5037
|
* session with their ID token for 10 hours.</p>
|
|
5059
|
-
*
|
|
5038
|
+
* <p>The default time unit for <code>AccessTokenValidity</code> in an API request is hours.
|
|
5060
5039
|
* <i>Valid range</i> is displayed below in seconds.</p>
|
|
5061
|
-
*
|
|
5040
|
+
* <p>If you don't specify otherwise in the configuration of your app client, your ID
|
|
5062
5041
|
* tokens are valid for one hour.</p>
|
|
5063
5042
|
*/
|
|
5064
5043
|
IdTokenValidity?: number;
|
|
@@ -5126,23 +5105,23 @@ export interface UserPoolClientType {
|
|
|
5126
5105
|
SupportedIdentityProviders?: string[];
|
|
5127
5106
|
/**
|
|
5128
5107
|
* <p>A list of allowed redirect (callback) URLs for the IdPs.</p>
|
|
5129
|
-
*
|
|
5130
|
-
*
|
|
5108
|
+
* <p>A redirect URI must:</p>
|
|
5109
|
+
* <ul>
|
|
5131
5110
|
* <li>
|
|
5132
|
-
*
|
|
5111
|
+
* <p>Be an absolute URI.</p>
|
|
5133
5112
|
* </li>
|
|
5134
5113
|
* <li>
|
|
5135
|
-
*
|
|
5114
|
+
* <p>Be registered with the authorization server.</p>
|
|
5136
5115
|
* </li>
|
|
5137
5116
|
* <li>
|
|
5138
|
-
*
|
|
5117
|
+
* <p>Not include a fragment component.</p>
|
|
5139
5118
|
* </li>
|
|
5140
5119
|
* </ul>
|
|
5141
|
-
*
|
|
5120
|
+
* <p>See <a href="https://tools.ietf.org/html/rfc6749#section-3.1.2">OAuth 2.0 -
|
|
5142
5121
|
* Redirection Endpoint</a>.</p>
|
|
5143
|
-
*
|
|
5122
|
+
* <p>Amazon Cognito requires HTTPS over HTTP except for http://localhost for testing purposes
|
|
5144
5123
|
* only.</p>
|
|
5145
|
-
*
|
|
5124
|
+
* <p>App callback URLs such as myapp://example are also supported.</p>
|
|
5146
5125
|
*/
|
|
5147
5126
|
CallbackURLs?: string[];
|
|
5148
5127
|
/**
|
|
@@ -5151,45 +5130,45 @@ export interface UserPoolClientType {
|
|
|
5151
5130
|
LogoutURLs?: string[];
|
|
5152
5131
|
/**
|
|
5153
5132
|
* <p>The default redirect URI. Must be in the <code>CallbackURLs</code> list.</p>
|
|
5154
|
-
*
|
|
5155
|
-
*
|
|
5133
|
+
* <p>A redirect URI must:</p>
|
|
5134
|
+
* <ul>
|
|
5156
5135
|
* <li>
|
|
5157
|
-
*
|
|
5136
|
+
* <p>Be an absolute URI.</p>
|
|
5158
5137
|
* </li>
|
|
5159
5138
|
* <li>
|
|
5160
|
-
*
|
|
5139
|
+
* <p>Be registered with the authorization server.</p>
|
|
5161
5140
|
* </li>
|
|
5162
5141
|
* <li>
|
|
5163
|
-
*
|
|
5142
|
+
* <p>Not include a fragment component.</p>
|
|
5164
5143
|
* </li>
|
|
5165
5144
|
* </ul>
|
|
5166
|
-
*
|
|
5145
|
+
* <p>See <a href="https://tools.ietf.org/html/rfc6749#section-3.1.2">OAuth 2.0 -
|
|
5167
5146
|
* Redirection Endpoint</a>.</p>
|
|
5168
|
-
*
|
|
5147
|
+
* <p>Amazon Cognito requires HTTPS over HTTP except for http://localhost for testing purposes
|
|
5169
5148
|
* only.</p>
|
|
5170
|
-
*
|
|
5149
|
+
* <p>App callback URLs such as myapp://example are also supported.</p>
|
|
5171
5150
|
*/
|
|
5172
5151
|
DefaultRedirectURI?: string;
|
|
5173
5152
|
/**
|
|
5174
5153
|
* <p>The allowed OAuth flows.</p>
|
|
5175
|
-
*
|
|
5154
|
+
* <dl>
|
|
5176
5155
|
* <dt>code</dt>
|
|
5177
5156
|
* <dd>
|
|
5178
|
-
*
|
|
5157
|
+
* <p>Use a code grant flow, which provides an authorization code as the
|
|
5179
5158
|
* response. This code can be exchanged for access tokens with the
|
|
5180
5159
|
* <code>/oauth2/token</code> endpoint.</p>
|
|
5181
|
-
*
|
|
5160
|
+
* </dd>
|
|
5182
5161
|
* <dt>implicit</dt>
|
|
5183
5162
|
* <dd>
|
|
5184
|
-
*
|
|
5163
|
+
* <p>Issue the access token (and, optionally, ID token, based on scopes)
|
|
5185
5164
|
* directly to your user.</p>
|
|
5186
|
-
*
|
|
5165
|
+
* </dd>
|
|
5187
5166
|
* <dt>client_credentials</dt>
|
|
5188
5167
|
* <dd>
|
|
5189
|
-
*
|
|
5168
|
+
* <p>Issue the access token from the <code>/oauth2/token</code> endpoint
|
|
5190
5169
|
* directly to a non-person user using a combination of the client ID and
|
|
5191
5170
|
* client secret.</p>
|
|
5192
|
-
*
|
|
5171
|
+
* </dd>
|
|
5193
5172
|
* </dl>
|
|
5194
5173
|
*/
|
|
5195
5174
|
AllowedOAuthFlows?: (OAuthFlowType | string)[];
|
|
@@ -5208,11 +5187,11 @@ export interface UserPoolClientType {
|
|
|
5208
5187
|
AllowedOAuthFlowsUserPoolClient?: boolean;
|
|
5209
5188
|
/**
|
|
5210
5189
|
* <p>The Amazon Pinpoint analytics configuration for the user pool client.</p>
|
|
5211
|
-
*
|
|
5190
|
+
* <note>
|
|
5212
5191
|
* <p>Amazon Cognito user pools only support sending events to Amazon Pinpoint projects in the US East
|
|
5213
5192
|
* (N. Virginia) us-east-1 Region, regardless of the Region where the user pool
|
|
5214
5193
|
* resides.</p>
|
|
5215
|
-
*
|
|
5194
|
+
* </note>
|
|
5216
5195
|
*/
|
|
5217
5196
|
AnalyticsConfiguration?: AnalyticsConfigurationType;
|
|
5218
5197
|
/**
|
|
@@ -5224,14 +5203,14 @@ export interface UserPoolClientType {
|
|
|
5224
5203
|
* destination. When set to <code>LEGACY</code>, those APIs return a
|
|
5225
5204
|
* <code>UserNotFoundException</code> exception if the user doesn't exist in the user
|
|
5226
5205
|
* pool.</p>
|
|
5227
|
-
*
|
|
5228
|
-
*
|
|
5206
|
+
* <p>Valid values include:</p>
|
|
5207
|
+
* <ul>
|
|
5229
5208
|
* <li>
|
|
5230
|
-
*
|
|
5209
|
+
* <p>
|
|
5231
5210
|
* <code>ENABLED</code> - This prevents user existence-related errors.</p>
|
|
5232
5211
|
* </li>
|
|
5233
5212
|
* <li>
|
|
5234
|
-
*
|
|
5213
|
+
* <p>
|
|
5235
5214
|
* <code>LEGACY</code> - This represents the old behavior of Amazon Cognito where user
|
|
5236
5215
|
* existence related errors aren't prevented.</p>
|
|
5237
5216
|
* </li>
|
|
@@ -5251,13 +5230,13 @@ export interface UserPoolClientType {
|
|
|
5251
5230
|
* advanced security for risk analysis. You can send <code>UserContextData</code> when you
|
|
5252
5231
|
* sign in Amazon Cognito native users with the <code>InitiateAuth</code> and
|
|
5253
5232
|
* <code>RespondToAuthChallenge</code> API operations.</p>
|
|
5254
|
-
*
|
|
5233
|
+
* <p>When <code>EnablePropagateAdditionalUserContextData</code> is false, you can't send
|
|
5255
5234
|
* your user's source IP address to Amazon Cognito advanced security with unauthenticated API
|
|
5256
5235
|
* operations. <code>EnablePropagateAdditionalUserContextData</code> doesn't affect whether
|
|
5257
5236
|
* you can send a source IP address in a <code>ContextData</code> parameter with the
|
|
5258
5237
|
* authenticated API operations <code>AdminInitiateAuth</code> and
|
|
5259
5238
|
* <code>AdminRespondToAuthChallenge</code>.</p>
|
|
5260
|
-
*
|
|
5239
|
+
* <p>You can only activate <code>EnablePropagateAdditionalUserContextData</code> in an app
|
|
5261
5240
|
* client that has a client secret. For more information about propagation of user context
|
|
5262
5241
|
* data, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-adaptive-authentication.html#user-pool-settings-adaptive-authentication-device-fingerprint">Adding user device and session data to API requests</a>.</p>
|
|
5263
5242
|
*/
|
|
@@ -5331,10 +5310,10 @@ export interface CreateUserPoolDomainRequest {
|
|
|
5331
5310
|
/**
|
|
5332
5311
|
* <p>The configuration for a custom domain that hosts the sign-up and sign-in webpages for
|
|
5333
5312
|
* your application.</p>
|
|
5334
|
-
*
|
|
5313
|
+
* <p>Provide this parameter only if you want to use a custom domain for your user pool.
|
|
5335
5314
|
* Otherwise, you can exclude this parameter and use the Amazon Cognito hosted domain
|
|
5336
5315
|
* instead.</p>
|
|
5337
|
-
*
|
|
5316
|
+
* <p>For more information about the hosted domain and custom domains, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-assign-domain.html">Configuring a User Pool Domain</a>.</p>
|
|
5338
5317
|
*/
|
|
5339
5318
|
CustomDomainConfig?: CustomDomainConfigType;
|
|
5340
5319
|
}
|
|
@@ -5417,7 +5396,7 @@ export interface DeleteUserRequest {
|
|
|
5417
5396
|
export interface DeleteUserAttributesRequest {
|
|
5418
5397
|
/**
|
|
5419
5398
|
* <p>An array of strings representing the user attribute names you want to delete.</p>
|
|
5420
|
-
*
|
|
5399
|
+
* <p>For custom attributes, you must prependattach the <code>custom:</code> prefix to the
|
|
5421
5400
|
* front of the attribute name.</p>
|
|
5422
5401
|
*/
|
|
5423
5402
|
UserAttributeNames: string[] | undefined;
|
|
@@ -5837,7 +5816,7 @@ export interface ForgotPasswordRequest {
|
|
|
5837
5816
|
/**
|
|
5838
5817
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
5839
5818
|
* that this action triggers.</p>
|
|
5840
|
-
*
|
|
5819
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool
|
|
5841
5820
|
* triggers. When you use the ForgotPassword API action, Amazon Cognito invokes any
|
|
5842
5821
|
* functions that are assigned to the following triggers: <i>pre sign-up</i>,
|
|
5843
5822
|
* <i>custom message</i>, and <i>user migration</i>. When
|
|
@@ -5847,29 +5826,27 @@ export interface ForgotPasswordRequest {
|
|
|
5847
5826
|
* your ForgotPassword request. In your function code in Lambda, you can
|
|
5848
5827
|
* process the <code>clientMetadata</code> value to enhance your workflow for your specific
|
|
5849
5828
|
* needs.</p>
|
|
5850
|
-
*
|
|
5851
5829
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
5852
5830
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
5853
|
-
*
|
|
5854
|
-
* <note>
|
|
5831
|
+
* <note>
|
|
5855
5832
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
5856
5833
|
* following:</p>
|
|
5857
5834
|
* <ul>
|
|
5858
5835
|
* <li>
|
|
5859
|
-
*
|
|
5836
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
5860
5837
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
5861
5838
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
5862
5839
|
* parameter serves no purpose.</p>
|
|
5863
|
-
*
|
|
5840
|
+
* </li>
|
|
5864
5841
|
* <li>
|
|
5865
|
-
*
|
|
5866
|
-
*
|
|
5842
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
5843
|
+
* </li>
|
|
5867
5844
|
* <li>
|
|
5868
|
-
*
|
|
5845
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
5869
5846
|
* information.</p>
|
|
5870
|
-
*
|
|
5847
|
+
* </li>
|
|
5871
5848
|
* </ul>
|
|
5872
|
-
*
|
|
5849
|
+
* </note>
|
|
5873
5850
|
*/
|
|
5874
5851
|
ClientMetadata?: Record<string, string>;
|
|
5875
5852
|
}
|
|
@@ -6097,7 +6074,7 @@ export interface GetUserResponse {
|
|
|
6097
6074
|
Username: string | undefined;
|
|
6098
6075
|
/**
|
|
6099
6076
|
* <p>An array of name-value pairs representing user attributes.</p>
|
|
6100
|
-
*
|
|
6077
|
+
* <p>For custom attributes, you must prepend the <code>custom:</code> prefix to the
|
|
6101
6078
|
* attribute name.</p>
|
|
6102
6079
|
*/
|
|
6103
6080
|
UserAttributes: AttributeType[] | undefined;
|
|
@@ -6138,7 +6115,7 @@ export interface GetUserAttributeVerificationCodeRequest {
|
|
|
6138
6115
|
/**
|
|
6139
6116
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
6140
6117
|
* that this action triggers.</p>
|
|
6141
|
-
*
|
|
6118
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool
|
|
6142
6119
|
* triggers. When you use the GetUserAttributeVerificationCode API action, Amazon Cognito invokes
|
|
6143
6120
|
* the function that is assigned to the <i>custom message</i> trigger. When
|
|
6144
6121
|
* Amazon Cognito invokes this function, it passes a JSON payload, which the function receives as
|
|
@@ -6146,29 +6123,27 @@ export interface GetUserAttributeVerificationCodeRequest {
|
|
|
6146
6123
|
* data that you assigned to the ClientMetadata parameter in your
|
|
6147
6124
|
* GetUserAttributeVerificationCode request. In your function code in Lambda, you can process the <code>clientMetadata</code> value to enhance your workflow for
|
|
6148
6125
|
* your specific needs.</p>
|
|
6149
|
-
*
|
|
6150
6126
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
6151
6127
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
6152
|
-
*
|
|
6153
|
-
* <note>
|
|
6128
|
+
* <note>
|
|
6154
6129
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
6155
6130
|
* following:</p>
|
|
6156
6131
|
* <ul>
|
|
6157
6132
|
* <li>
|
|
6158
|
-
*
|
|
6133
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
6159
6134
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
6160
6135
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
6161
6136
|
* parameter serves no purpose.</p>
|
|
6162
|
-
*
|
|
6137
|
+
* </li>
|
|
6163
6138
|
* <li>
|
|
6164
|
-
*
|
|
6165
|
-
*
|
|
6139
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
6140
|
+
* </li>
|
|
6166
6141
|
* <li>
|
|
6167
|
-
*
|
|
6142
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
6168
6143
|
* information.</p>
|
|
6169
|
-
*
|
|
6144
|
+
* </li>
|
|
6170
6145
|
* </ul>
|
|
6171
|
-
*
|
|
6146
|
+
* </note>
|
|
6172
6147
|
*/
|
|
6173
6148
|
ClientMetadata?: Record<string, string>;
|
|
6174
6149
|
}
|
|
@@ -6236,17 +6211,17 @@ export interface GetUserPoolMfaConfigResponse {
|
|
|
6236
6211
|
SoftwareTokenMfaConfiguration?: SoftwareTokenMfaConfigType;
|
|
6237
6212
|
/**
|
|
6238
6213
|
* <p>The multi-factor authentication (MFA) configuration. Valid values include:</p>
|
|
6239
|
-
*
|
|
6214
|
+
* <ul>
|
|
6240
6215
|
* <li>
|
|
6241
|
-
*
|
|
6216
|
+
* <p>
|
|
6242
6217
|
* <code>OFF</code> MFA won't be used for any users.</p>
|
|
6243
6218
|
* </li>
|
|
6244
6219
|
* <li>
|
|
6245
|
-
*
|
|
6220
|
+
* <p>
|
|
6246
6221
|
* <code>ON</code> MFA is required for all users to sign in.</p>
|
|
6247
6222
|
* </li>
|
|
6248
6223
|
* <li>
|
|
6249
|
-
*
|
|
6224
|
+
* <p>
|
|
6250
6225
|
* <code>OPTIONAL</code> MFA will be required only for individual users who have
|
|
6251
6226
|
* an MFA factor activated.</p>
|
|
6252
6227
|
* </li>
|
|
@@ -6278,50 +6253,50 @@ export interface InitiateAuthRequest {
|
|
|
6278
6253
|
/**
|
|
6279
6254
|
* <p>The authentication flow for this call to run. The API action will depend on this
|
|
6280
6255
|
* value. For example:</p>
|
|
6281
|
-
*
|
|
6256
|
+
* <ul>
|
|
6282
6257
|
* <li>
|
|
6283
|
-
*
|
|
6258
|
+
* <p>
|
|
6284
6259
|
* <code>REFRESH_TOKEN_AUTH</code> takes in a valid refresh token and returns new
|
|
6285
6260
|
* tokens.</p>
|
|
6286
6261
|
* </li>
|
|
6287
6262
|
* <li>
|
|
6288
|
-
*
|
|
6263
|
+
* <p>
|
|
6289
6264
|
* <code>USER_SRP_AUTH</code> takes in <code>USERNAME</code> and
|
|
6290
6265
|
* <code>SRP_A</code> and returns the SRP variables to be used for next
|
|
6291
6266
|
* challenge execution.</p>
|
|
6292
6267
|
* </li>
|
|
6293
6268
|
* <li>
|
|
6294
|
-
*
|
|
6269
|
+
* <p>
|
|
6295
6270
|
* <code>USER_PASSWORD_AUTH</code> takes in <code>USERNAME</code> and
|
|
6296
6271
|
* <code>PASSWORD</code> and returns the next challenge or tokens.</p>
|
|
6297
6272
|
* </li>
|
|
6298
6273
|
* </ul>
|
|
6299
|
-
*
|
|
6300
|
-
*
|
|
6274
|
+
* <p>Valid values include:</p>
|
|
6275
|
+
* <ul>
|
|
6301
6276
|
* <li>
|
|
6302
|
-
*
|
|
6277
|
+
* <p>
|
|
6303
6278
|
* <code>USER_SRP_AUTH</code>: Authentication flow for the Secure Remote Password
|
|
6304
6279
|
* (SRP) protocol.</p>
|
|
6305
6280
|
* </li>
|
|
6306
6281
|
* <li>
|
|
6307
|
-
*
|
|
6282
|
+
* <p>
|
|
6308
6283
|
* <code>REFRESH_TOKEN_AUTH</code>/<code>REFRESH_TOKEN</code>: Authentication
|
|
6309
6284
|
* flow for refreshing the access token and ID token by supplying a valid refresh
|
|
6310
6285
|
* token.</p>
|
|
6311
6286
|
* </li>
|
|
6312
6287
|
* <li>
|
|
6313
|
-
*
|
|
6288
|
+
* <p>
|
|
6314
6289
|
* <code>CUSTOM_AUTH</code>: Custom authentication flow.</p>
|
|
6315
6290
|
* </li>
|
|
6316
6291
|
* <li>
|
|
6317
|
-
*
|
|
6292
|
+
* <p>
|
|
6318
6293
|
* <code>USER_PASSWORD_AUTH</code>: Non-SRP authentication flow; user name and
|
|
6319
6294
|
* password are passed directly. If a user migration Lambda trigger is set, this
|
|
6320
6295
|
* flow will invoke the user migration Lambda if it doesn't find the user name in
|
|
6321
6296
|
* the user pool. </p>
|
|
6322
6297
|
* </li>
|
|
6323
6298
|
* </ul>
|
|
6324
|
-
*
|
|
6299
|
+
* <p>
|
|
6325
6300
|
* <code>ADMIN_NO_SRP_AUTH</code> isn't a valid value.</p>
|
|
6326
6301
|
*/
|
|
6327
6302
|
AuthFlow: AuthFlowType | string | undefined;
|
|
@@ -6329,19 +6304,19 @@ export interface InitiateAuthRequest {
|
|
|
6329
6304
|
* <p>The authentication parameters. These are inputs corresponding to the
|
|
6330
6305
|
* <code>AuthFlow</code> that you're invoking. The required values depend on the value
|
|
6331
6306
|
* of <code>AuthFlow</code>:</p>
|
|
6332
|
-
*
|
|
6307
|
+
* <ul>
|
|
6333
6308
|
* <li>
|
|
6334
|
-
*
|
|
6309
|
+
* <p>For <code>USER_SRP_AUTH</code>: <code>USERNAME</code> (required),
|
|
6335
6310
|
* <code>SRP_A</code> (required), <code>SECRET_HASH</code> (required if the app
|
|
6336
6311
|
* client is configured with a client secret), <code>DEVICE_KEY</code>.</p>
|
|
6337
6312
|
* </li>
|
|
6338
6313
|
* <li>
|
|
6339
|
-
*
|
|
6314
|
+
* <p>For <code>REFRESH_TOKEN_AUTH/REFRESH_TOKEN</code>: <code>REFRESH_TOKEN</code>
|
|
6340
6315
|
* (required), <code>SECRET_HASH</code> (required if the app client is configured
|
|
6341
6316
|
* with a client secret), <code>DEVICE_KEY</code>.</p>
|
|
6342
6317
|
* </li>
|
|
6343
6318
|
* <li>
|
|
6344
|
-
*
|
|
6319
|
+
* <p>For <code>CUSTOM_AUTH</code>: <code>USERNAME</code> (required),
|
|
6345
6320
|
* <code>SECRET_HASH</code> (if app client is configured with client secret),
|
|
6346
6321
|
* <code>DEVICE_KEY</code>. To start the authentication flow with password
|
|
6347
6322
|
* verification, include <code>ChallengeName: SRP_A</code> and <code>SRP_A: (The
|
|
@@ -6353,72 +6328,70 @@ export interface InitiateAuthRequest {
|
|
|
6353
6328
|
/**
|
|
6354
6329
|
* <p>A map of custom key-value pairs that you can provide as input for certain custom
|
|
6355
6330
|
* workflows that this action triggers.</p>
|
|
6356
|
-
*
|
|
6331
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool triggers.
|
|
6357
6332
|
* When you use the InitiateAuth API action, Amazon Cognito invokes the Lambda functions that are
|
|
6358
6333
|
* specified for various triggers. The ClientMetadata value is passed as input to the
|
|
6359
6334
|
* functions for only the following triggers:</p>
|
|
6360
|
-
*
|
|
6335
|
+
* <ul>
|
|
6361
6336
|
* <li>
|
|
6362
|
-
*
|
|
6337
|
+
* <p>Pre signup</p>
|
|
6363
6338
|
* </li>
|
|
6364
6339
|
* <li>
|
|
6365
|
-
*
|
|
6340
|
+
* <p>Pre authentication</p>
|
|
6366
6341
|
* </li>
|
|
6367
6342
|
* <li>
|
|
6368
|
-
*
|
|
6343
|
+
* <p>User migration</p>
|
|
6369
6344
|
* </li>
|
|
6370
6345
|
* </ul>
|
|
6371
|
-
*
|
|
6346
|
+
* <p>When Amazon Cognito invokes the functions for these triggers, it passes a JSON payload, which
|
|
6372
6347
|
* the function receives as input. This payload contains a <code>validationData</code>
|
|
6373
6348
|
* attribute, which provides the data that you assigned to the ClientMetadata parameter in
|
|
6374
6349
|
* your InitiateAuth request. In your function code in Lambda, you can process the
|
|
6375
6350
|
* <code>validationData</code> value to enhance your workflow for your specific
|
|
6376
6351
|
* needs.</p>
|
|
6377
|
-
*
|
|
6352
|
+
* <p>When you use the InitiateAuth API action, Amazon Cognito also invokes the functions for the
|
|
6378
6353
|
* following triggers, but it doesn't provide the ClientMetadata value as input:</p>
|
|
6379
|
-
*
|
|
6354
|
+
* <ul>
|
|
6380
6355
|
* <li>
|
|
6381
|
-
*
|
|
6356
|
+
* <p>Post authentication</p>
|
|
6382
6357
|
* </li>
|
|
6383
6358
|
* <li>
|
|
6384
|
-
*
|
|
6359
|
+
* <p>Custom message</p>
|
|
6385
6360
|
* </li>
|
|
6386
6361
|
* <li>
|
|
6387
|
-
*
|
|
6362
|
+
* <p>Pre token generation</p>
|
|
6388
6363
|
* </li>
|
|
6389
6364
|
* <li>
|
|
6390
|
-
*
|
|
6365
|
+
* <p>Create auth challenge</p>
|
|
6391
6366
|
* </li>
|
|
6392
6367
|
* <li>
|
|
6393
|
-
*
|
|
6368
|
+
* <p>Define auth challenge</p>
|
|
6394
6369
|
* </li>
|
|
6395
6370
|
* <li>
|
|
6396
|
-
*
|
|
6371
|
+
* <p>Verify auth challenge</p>
|
|
6397
6372
|
* </li>
|
|
6398
6373
|
* </ul>
|
|
6399
|
-
*
|
|
6400
6374
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
6401
6375
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
6402
|
-
*
|
|
6403
|
-
* <note>
|
|
6376
|
+
* <note>
|
|
6404
6377
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
6405
6378
|
* following:</p>
|
|
6406
6379
|
* <ul>
|
|
6407
6380
|
* <li>
|
|
6408
|
-
*
|
|
6381
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
6409
6382
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
6410
6383
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
6411
6384
|
* parameter serves no purpose.</p>
|
|
6412
|
-
*
|
|
6385
|
+
* </li>
|
|
6413
6386
|
* <li>
|
|
6414
|
-
*
|
|
6415
|
-
*
|
|
6387
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
6388
|
+
* </li>
|
|
6416
6389
|
* <li>
|
|
6417
|
-
*
|
|
6390
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
6418
6391
|
* information.</p>
|
|
6419
|
-
*
|
|
6392
|
+
* </li>
|
|
6420
6393
|
* </ul>
|
|
6421
|
-
*
|
|
6394
|
+
* </note>
|
|
6422
6395
|
*/
|
|
6423
6396
|
ClientMetadata?: Record<string, string>;
|
|
6424
6397
|
/**
|
|
@@ -6446,63 +6419,61 @@ export interface InitiateAuthResponse {
|
|
|
6446
6419
|
* <p>The name of the challenge that you're responding to with this call. This name is
|
|
6447
6420
|
* returned in the <code>AdminInitiateAuth</code> response if you must pass another
|
|
6448
6421
|
* challenge.</p>
|
|
6449
|
-
*
|
|
6450
|
-
*
|
|
6422
|
+
* <p>Valid values include the following:</p>
|
|
6423
|
+
* <note>
|
|
6451
6424
|
* <p>All of the following challenges require <code>USERNAME</code> and
|
|
6452
6425
|
* <code>SECRET_HASH</code> (if applicable) in the parameters.</p>
|
|
6453
|
-
*
|
|
6454
|
-
*
|
|
6426
|
+
* </note>
|
|
6427
|
+
* <ul>
|
|
6455
6428
|
* <li>
|
|
6456
|
-
*
|
|
6429
|
+
* <p>
|
|
6457
6430
|
* <code>SMS_MFA</code>: Next challenge is to supply an
|
|
6458
6431
|
* <code>SMS_MFA_CODE</code>, delivered via SMS.</p>
|
|
6459
6432
|
* </li>
|
|
6460
6433
|
* <li>
|
|
6461
|
-
*
|
|
6434
|
+
* <p>
|
|
6462
6435
|
* <code>PASSWORD_VERIFIER</code>: Next challenge is to supply
|
|
6463
6436
|
* <code>PASSWORD_CLAIM_SIGNATURE</code>,
|
|
6464
6437
|
* <code>PASSWORD_CLAIM_SECRET_BLOCK</code>, and <code>TIMESTAMP</code> after
|
|
6465
6438
|
* the client-side SRP calculations.</p>
|
|
6466
6439
|
* </li>
|
|
6467
6440
|
* <li>
|
|
6468
|
-
*
|
|
6441
|
+
* <p>
|
|
6469
6442
|
* <code>CUSTOM_CHALLENGE</code>: This is returned if your custom authentication
|
|
6470
6443
|
* flow determines that the user should pass another challenge before tokens are
|
|
6471
6444
|
* issued.</p>
|
|
6472
6445
|
* </li>
|
|
6473
6446
|
* <li>
|
|
6474
|
-
*
|
|
6447
|
+
* <p>
|
|
6475
6448
|
* <code>DEVICE_SRP_AUTH</code>: If device tracking was activated on your user
|
|
6476
6449
|
* pool and the previous challenges were passed, this challenge is returned so that
|
|
6477
6450
|
* Amazon Cognito can start tracking this device.</p>
|
|
6478
6451
|
* </li>
|
|
6479
6452
|
* <li>
|
|
6480
|
-
*
|
|
6453
|
+
* <p>
|
|
6481
6454
|
* <code>DEVICE_PASSWORD_VERIFIER</code>: Similar to
|
|
6482
6455
|
* <code>PASSWORD_VERIFIER</code>, but for devices only.</p>
|
|
6483
6456
|
* </li>
|
|
6484
6457
|
* <li>
|
|
6485
|
-
*
|
|
6458
|
+
* <p>
|
|
6486
6459
|
* <code>NEW_PASSWORD_REQUIRED</code>: For users who are required to change their
|
|
6487
6460
|
* passwords after successful first login. </p>
|
|
6488
|
-
*
|
|
6461
|
+
* <p>Respond to this challenge with <code>NEW_PASSWORD</code> and any required
|
|
6489
6462
|
* attributes that Amazon Cognito returned in the <code>requiredAttributes</code> parameter.
|
|
6490
6463
|
* You can also set values for attributes that aren't required by your user pool
|
|
6491
6464
|
* and that your app client can write. For more information, see <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RespondToAuthChallenge.html">RespondToAuthChallenge</a>.</p>
|
|
6492
|
-
*
|
|
6493
6465
|
* <note>
|
|
6494
6466
|
* <p>In a <code>NEW_PASSWORD_REQUIRED</code> challenge response, you can't modify a required attribute that already has a value.
|
|
6495
6467
|
* In <code>RespondToAuthChallenge</code>, set a value for any keys that Amazon Cognito returned in the <code>requiredAttributes</code> parameter,
|
|
6496
6468
|
* then use the <code>UpdateUserAttributes</code> API operation to modify the value of any additional attributes.</p>
|
|
6497
6469
|
* </note>
|
|
6498
|
-
*
|
|
6499
6470
|
* </li>
|
|
6500
6471
|
* <li>
|
|
6501
|
-
*
|
|
6472
|
+
* <p>
|
|
6502
6473
|
* <code>MFA_SETUP</code>: For users who are required to setup an MFA factor
|
|
6503
6474
|
* before they can sign in. The MFA types activated for the user pool will be
|
|
6504
6475
|
* listed in the challenge parameters <code>MFA_CAN_SETUP</code> value. </p>
|
|
6505
|
-
*
|
|
6476
|
+
* <p> To set up software token MFA, use the session returned here from
|
|
6506
6477
|
* <code>InitiateAuth</code> as an input to
|
|
6507
6478
|
* <code>AssociateSoftwareToken</code>. Use the session returned by
|
|
6508
6479
|
* <code>VerifySoftwareToken</code> as an input to
|
|
@@ -6526,7 +6497,7 @@ export interface InitiateAuthResponse {
|
|
|
6526
6497
|
* <p>The challenge parameters. These are returned in the <code>InitiateAuth</code> response
|
|
6527
6498
|
* if you must pass another challenge. The responses in this parameter should be used to
|
|
6528
6499
|
* compute inputs to the next call (<code>RespondToAuthChallenge</code>). </p>
|
|
6529
|
-
*
|
|
6500
|
+
* <p>All challenges require <code>USERNAME</code> and <code>SECRET_HASH</code> (if
|
|
6530
6501
|
* applicable).</p>
|
|
6531
6502
|
*/
|
|
6532
6503
|
ChallengeParameters?: Record<string, string>;
|
|
@@ -6883,80 +6854,80 @@ export interface ListUsersRequest {
|
|
|
6883
6854
|
* <i>Filter-Type</i> "<i>AttributeValue</i>"". Quotation marks
|
|
6884
6855
|
* within the filter string must be escaped using the backslash (\) character. For example,
|
|
6885
6856
|
* "<code>family_name</code> = \"Reddy\"".</p>
|
|
6886
|
-
*
|
|
6857
|
+
* <ul>
|
|
6887
6858
|
* <li>
|
|
6888
|
-
*
|
|
6859
|
+
* <p>
|
|
6889
6860
|
* <i>AttributeName</i>: The name of the attribute to search for.
|
|
6890
6861
|
* You can only search for one attribute at a time.</p>
|
|
6891
6862
|
* </li>
|
|
6892
6863
|
* <li>
|
|
6893
|
-
*
|
|
6864
|
+
* <p>
|
|
6894
6865
|
* <i>Filter-Type</i>: For an exact match, use =, for example,
|
|
6895
6866
|
* "<code>given_name</code> = \"Jon\"". For a prefix ("starts with") match, use
|
|
6896
6867
|
* ^=, for example, "<code>given_name</code> ^= \"Jon\"". </p>
|
|
6897
6868
|
* </li>
|
|
6898
6869
|
* <li>
|
|
6899
|
-
*
|
|
6870
|
+
* <p>
|
|
6900
6871
|
* <i>AttributeValue</i>: The attribute value that must be matched
|
|
6901
6872
|
* for each user.</p>
|
|
6902
6873
|
* </li>
|
|
6903
6874
|
* </ul>
|
|
6904
|
-
*
|
|
6875
|
+
* <p>If the filter string is empty, <code>ListUsers</code> returns all users in the user
|
|
6905
6876
|
* pool.</p>
|
|
6906
|
-
*
|
|
6907
|
-
*
|
|
6877
|
+
* <p>You can only search for the following standard attributes:</p>
|
|
6878
|
+
* <ul>
|
|
6908
6879
|
* <li>
|
|
6909
|
-
*
|
|
6880
|
+
* <p>
|
|
6910
6881
|
* <code>username</code> (case-sensitive)</p>
|
|
6911
6882
|
* </li>
|
|
6912
6883
|
* <li>
|
|
6913
|
-
*
|
|
6914
|
-
*
|
|
6915
|
-
*
|
|
6884
|
+
* <p>
|
|
6885
|
+
* <code>email</code>
|
|
6886
|
+
* </p>
|
|
6916
6887
|
* </li>
|
|
6917
6888
|
* <li>
|
|
6918
|
-
*
|
|
6919
|
-
*
|
|
6920
|
-
*
|
|
6889
|
+
* <p>
|
|
6890
|
+
* <code>phone_number</code>
|
|
6891
|
+
* </p>
|
|
6921
6892
|
* </li>
|
|
6922
6893
|
* <li>
|
|
6923
|
-
*
|
|
6924
|
-
*
|
|
6925
|
-
*
|
|
6894
|
+
* <p>
|
|
6895
|
+
* <code>name</code>
|
|
6896
|
+
* </p>
|
|
6926
6897
|
* </li>
|
|
6927
6898
|
* <li>
|
|
6928
|
-
*
|
|
6929
|
-
*
|
|
6930
|
-
*
|
|
6899
|
+
* <p>
|
|
6900
|
+
* <code>given_name</code>
|
|
6901
|
+
* </p>
|
|
6931
6902
|
* </li>
|
|
6932
6903
|
* <li>
|
|
6933
|
-
*
|
|
6934
|
-
*
|
|
6935
|
-
*
|
|
6904
|
+
* <p>
|
|
6905
|
+
* <code>family_name</code>
|
|
6906
|
+
* </p>
|
|
6936
6907
|
* </li>
|
|
6937
6908
|
* <li>
|
|
6938
|
-
*
|
|
6939
|
-
*
|
|
6940
|
-
*
|
|
6909
|
+
* <p>
|
|
6910
|
+
* <code>preferred_username</code>
|
|
6911
|
+
* </p>
|
|
6941
6912
|
* </li>
|
|
6942
6913
|
* <li>
|
|
6943
|
-
*
|
|
6914
|
+
* <p>
|
|
6944
6915
|
* <code>cognito:user_status</code> (called <b>Status</b> in the Console) (case-insensitive)</p>
|
|
6945
6916
|
* </li>
|
|
6946
6917
|
* <li>
|
|
6947
|
-
*
|
|
6918
|
+
* <p>
|
|
6948
6919
|
* <code>status (called <b>Enabled</b> in the Console)
|
|
6949
6920
|
* (case-sensitive)</code>
|
|
6950
6921
|
* </p>
|
|
6951
6922
|
* </li>
|
|
6952
6923
|
* <li>
|
|
6953
|
-
*
|
|
6924
|
+
* <p>
|
|
6954
6925
|
* <code>sub</code>
|
|
6955
6926
|
* </p>
|
|
6956
6927
|
* </li>
|
|
6957
6928
|
* </ul>
|
|
6958
|
-
*
|
|
6959
|
-
*
|
|
6929
|
+
* <p>Custom attributes aren't searchable.</p>
|
|
6930
|
+
* <note>
|
|
6960
6931
|
* <p>You can also list users with a client-side filter. The server-side filter matches
|
|
6961
6932
|
* no more than one attribute. For an advanced search, use a client-side filter with
|
|
6962
6933
|
* the <code>--query</code> parameter of the <code>list-users</code> action in the
|
|
@@ -6966,8 +6937,8 @@ export interface ListUsersRequest {
|
|
|
6966
6937
|
* pagination token value, and then review the combined result. </p>
|
|
6967
6938
|
* <p>For more information about server-side and client-side filtering, see <a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-filter.html">FilteringCLI output</a> in the <a href="https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-filter.html">Command Line Interface
|
|
6968
6939
|
* User Guide</a>. </p>
|
|
6969
|
-
*
|
|
6970
|
-
*
|
|
6940
|
+
* </note>
|
|
6941
|
+
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/how-to-manage-user-accounts.html#cognito-user-pools-searching-for-users-using-listusers-api">Searching for Users Using the ListUsers API</a> and <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/how-to-manage-user-accounts.html#cognito-user-pools-searching-for-users-listusers-api-examples">Examples of Using the ListUsers API</a> in the <i>Amazon Cognito Developer
|
|
6971
6942
|
* Guide</i>.</p>
|
|
6972
6943
|
*/
|
|
6973
6944
|
Filter?: string;
|
|
@@ -7056,7 +7027,7 @@ export interface ResendConfirmationCodeRequest {
|
|
|
7056
7027
|
/**
|
|
7057
7028
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
7058
7029
|
* that this action triggers.</p>
|
|
7059
|
-
*
|
|
7030
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool triggers.
|
|
7060
7031
|
* When you use the ResendConfirmationCode API action, Amazon Cognito invokes the function that is
|
|
7061
7032
|
* assigned to the <i>custom message</i> trigger. When Amazon Cognito invokes this
|
|
7062
7033
|
* function, it passes a JSON payload, which the function receives as input. This payload
|
|
@@ -7064,29 +7035,27 @@ export interface ResendConfirmationCodeRequest {
|
|
|
7064
7035
|
* assigned to the ClientMetadata parameter in your ResendConfirmationCode request. In your
|
|
7065
7036
|
* function code in Lambda, you can process the <code>clientMetadata</code> value to enhance
|
|
7066
7037
|
* your workflow for your specific needs.</p>
|
|
7067
|
-
*
|
|
7068
7038
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
7069
7039
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
7070
|
-
*
|
|
7071
|
-
* <note>
|
|
7040
|
+
* <note>
|
|
7072
7041
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
7073
7042
|
* following:</p>
|
|
7074
7043
|
* <ul>
|
|
7075
7044
|
* <li>
|
|
7076
|
-
*
|
|
7045
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
7077
7046
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
7078
7047
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
7079
7048
|
* parameter serves no purpose.</p>
|
|
7080
|
-
*
|
|
7049
|
+
* </li>
|
|
7081
7050
|
* <li>
|
|
7082
|
-
*
|
|
7083
|
-
*
|
|
7051
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
7052
|
+
* </li>
|
|
7084
7053
|
* <li>
|
|
7085
|
-
*
|
|
7054
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
7086
7055
|
* information.</p>
|
|
7087
|
-
*
|
|
7056
|
+
* </li>
|
|
7088
7057
|
* </ul>
|
|
7089
|
-
*
|
|
7058
|
+
* </note>
|
|
7090
7059
|
*/
|
|
7091
7060
|
ClientMetadata?: Record<string, string>;
|
|
7092
7061
|
}
|
|
@@ -7113,7 +7082,7 @@ export interface RespondToAuthChallengeRequest {
|
|
|
7113
7082
|
ClientId: string | undefined;
|
|
7114
7083
|
/**
|
|
7115
7084
|
* <p>The challenge name. For more information, see <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html">InitiateAuth</a>.</p>
|
|
7116
|
-
*
|
|
7085
|
+
* <p>
|
|
7117
7086
|
* <code>ADMIN_NO_SRP_AUTH</code> isn't a valid value.</p>
|
|
7118
7087
|
*/
|
|
7119
7088
|
ChallengeName: ChallengeNameType | string | undefined;
|
|
@@ -7128,30 +7097,30 @@ export interface RespondToAuthChallengeRequest {
|
|
|
7128
7097
|
/**
|
|
7129
7098
|
* <p>The challenge responses. These are inputs corresponding to the value of
|
|
7130
7099
|
* <code>ChallengeName</code>, for example:</p>
|
|
7131
|
-
*
|
|
7100
|
+
* <note>
|
|
7132
7101
|
* <p>
|
|
7133
7102
|
* <code>SECRET_HASH</code> (if app client is configured with client secret) applies
|
|
7134
7103
|
* to all of the inputs that follow (including <code>SOFTWARE_TOKEN_MFA</code>).</p>
|
|
7135
|
-
*
|
|
7136
|
-
*
|
|
7104
|
+
* </note>
|
|
7105
|
+
* <ul>
|
|
7137
7106
|
* <li>
|
|
7138
|
-
*
|
|
7107
|
+
* <p>
|
|
7139
7108
|
* <code>SMS_MFA</code>: <code>SMS_MFA_CODE</code>, <code>USERNAME</code>.</p>
|
|
7140
7109
|
* </li>
|
|
7141
7110
|
* <li>
|
|
7142
|
-
*
|
|
7111
|
+
* <p>
|
|
7143
7112
|
* <code>PASSWORD_VERIFIER</code>: <code>PASSWORD_CLAIM_SIGNATURE</code>,
|
|
7144
7113
|
* <code>PASSWORD_CLAIM_SECRET_BLOCK</code>, <code>TIMESTAMP</code>,
|
|
7145
7114
|
* <code>USERNAME</code>.</p>
|
|
7146
|
-
*
|
|
7147
|
-
*
|
|
7115
|
+
* <note>
|
|
7116
|
+
* <p>
|
|
7148
7117
|
* <code>PASSWORD_VERIFIER</code> requires <code>DEVICE_KEY</code> when you
|
|
7149
7118
|
* sign in with a remembered device.</p>
|
|
7150
|
-
*
|
|
7119
|
+
* </note>
|
|
7151
7120
|
* </li>
|
|
7152
7121
|
* <li>
|
|
7153
|
-
*
|
|
7154
|
-
*
|
|
7122
|
+
* <p>
|
|
7123
|
+
* <code>NEW_PASSWORD_REQUIRED</code>: <code>NEW_PASSWORD</code>,
|
|
7155
7124
|
* <code>USERNAME</code>, <code>SECRET_HASH</code> (if app client is configured
|
|
7156
7125
|
* with client secret). To set any required attributes that Amazon Cognito returned as
|
|
7157
7126
|
* <code>requiredAttributes</code> in the <code>InitiateAuth</code> response,
|
|
@@ -7159,33 +7128,31 @@ export interface RespondToAuthChallengeRequest {
|
|
|
7159
7128
|
* </code> parameter.
|
|
7160
7129
|
* This parameter can also set values for writable attributes that aren't required
|
|
7161
7130
|
* by your user pool.</p>
|
|
7162
|
-
*
|
|
7163
7131
|
* <note>
|
|
7164
7132
|
* <p>In a <code>NEW_PASSWORD_REQUIRED</code> challenge response, you can't modify a required attribute that already has a value.
|
|
7165
7133
|
* In <code>RespondToAuthChallenge</code>, set a value for any keys that Amazon Cognito returned in the <code>requiredAttributes</code> parameter,
|
|
7166
7134
|
* then use the <code>UpdateUserAttributes</code> API operation to modify the value of any additional attributes.</p>
|
|
7167
7135
|
* </note>
|
|
7168
|
-
*
|
|
7169
7136
|
* </li>
|
|
7170
7137
|
* <li>
|
|
7171
|
-
*
|
|
7138
|
+
* <p>
|
|
7172
7139
|
* <code>SOFTWARE_TOKEN_MFA</code>: <code>USERNAME</code> and
|
|
7173
7140
|
* <code>SOFTWARE_TOKEN_MFA_CODE</code> are required attributes.</p>
|
|
7174
7141
|
* </li>
|
|
7175
7142
|
* <li>
|
|
7176
|
-
*
|
|
7143
|
+
* <p>
|
|
7177
7144
|
* <code>DEVICE_SRP_AUTH</code> requires <code>USERNAME</code>,
|
|
7178
7145
|
* <code>DEVICE_KEY</code>, <code>SRP_A</code> (and
|
|
7179
7146
|
* <code>SECRET_HASH</code>).</p>
|
|
7180
7147
|
* </li>
|
|
7181
7148
|
* <li>
|
|
7182
|
-
*
|
|
7149
|
+
* <p>
|
|
7183
7150
|
* <code>DEVICE_PASSWORD_VERIFIER</code> requires everything that
|
|
7184
7151
|
* <code>PASSWORD_VERIFIER</code> requires, plus
|
|
7185
7152
|
* <code>DEVICE_KEY</code>.</p>
|
|
7186
7153
|
* </li>
|
|
7187
7154
|
* <li>
|
|
7188
|
-
*
|
|
7155
|
+
* <p>
|
|
7189
7156
|
* <code>MFA_SETUP</code> requires <code>USERNAME</code>, plus you must use the
|
|
7190
7157
|
* session value returned by <code>VerifySoftwareToken</code> in the
|
|
7191
7158
|
* <code>Session</code> parameter.</p>
|
|
@@ -7207,7 +7174,7 @@ export interface RespondToAuthChallengeRequest {
|
|
|
7207
7174
|
/**
|
|
7208
7175
|
* <p>A map of custom key-value pairs that you can provide as input for any custom workflows
|
|
7209
7176
|
* that this action triggers.</p>
|
|
7210
|
-
*
|
|
7177
|
+
* <p>You create custom workflows by assigning Lambda functions to user pool
|
|
7211
7178
|
* triggers. When you use the RespondToAuthChallenge API action, Amazon Cognito invokes any
|
|
7212
7179
|
* functions that are assigned to the following triggers: <i>post
|
|
7213
7180
|
* authentication</i>, <i>pre token generation</i>,
|
|
@@ -7219,29 +7186,27 @@ export interface RespondToAuthChallengeRequest {
|
|
|
7219
7186
|
* request. In your function code in Lambda, you can process the
|
|
7220
7187
|
* <code>clientMetadata</code> value to enhance your workflow for your specific
|
|
7221
7188
|
* needs.</p>
|
|
7222
|
-
*
|
|
7223
7189
|
* <p>For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html">
|
|
7224
7190
|
* Customizing user pool Workflows with Lambda Triggers</a> in the <i>Amazon Cognito Developer Guide</i>.</p>
|
|
7225
|
-
*
|
|
7226
|
-
* <note>
|
|
7191
|
+
* <note>
|
|
7227
7192
|
* <p>When you use the ClientMetadata parameter, remember that Amazon Cognito won't do the
|
|
7228
7193
|
* following:</p>
|
|
7229
7194
|
* <ul>
|
|
7230
7195
|
* <li>
|
|
7231
|
-
*
|
|
7196
|
+
* <p>Store the ClientMetadata value. This data is available only to Lambda
|
|
7232
7197
|
* triggers that are assigned to a user pool to support custom workflows. If
|
|
7233
7198
|
* your user pool configuration doesn't include triggers, the ClientMetadata
|
|
7234
7199
|
* parameter serves no purpose.</p>
|
|
7235
|
-
*
|
|
7200
|
+
* </li>
|
|
7236
7201
|
* <li>
|
|
7237
|
-
*
|
|
7238
|
-
*
|
|
7202
|
+
* <p>Validate the ClientMetadata value.</p>
|
|
7203
|
+
* </li>
|
|
7239
7204
|
* <li>
|
|
7240
|
-
*
|
|
7205
|
+
* <p>Encrypt the ClientMetadata value. Don't use Amazon Cognito to provide sensitive
|
|
7241
7206
|
* information.</p>
|
|
7242
|
-
*
|
|
7207
|
+
* </li>
|
|
7243
7208
|
* </ul>
|
|
7244
|
-
*
|
|
7209
|
+
* </note>
|
|
7245
7210
|
*/
|
|
7246
7211
|
ClientMetadata?: Record<string, string>;
|
|
7247
7212
|
}
|
|
@@ -7344,7 +7309,7 @@ export interface SetRiskConfigurationRequest {
|
|
|
7344
7309
|
* <p>The app client ID. If <code>ClientId</code> is null, then the risk configuration is
|
|
7345
7310
|
* mapped to <code>userPoolId</code>. When the client ID is null, the same risk
|
|
7346
7311
|
* configuration is applied to all the clients in the userPool.</p>
|
|
7347
|
-
*
|
|
7312
|
+
* <p>Otherwise, <code>ClientId</code> is mapped to the client. When the client ID isn't
|
|
7348
7313
|
* null, the user pool configuration is overridden and the risk configuration for the
|
|
7349
7314
|
* client is used instead.</p>
|
|
7350
7315
|
*/
|
|
@@ -7444,17 +7409,17 @@ export interface SetUserPoolMfaConfigRequest {
|
|
|
7444
7409
|
* <p>The MFA configuration. If you set the MfaConfiguration value to ‘ON’, only users who
|
|
7445
7410
|
* have set up an MFA factor can sign in. To learn more, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa.html">Adding Multi-Factor
|
|
7446
7411
|
* Authentication (MFA) to a user pool</a>. Valid values include:</p>
|
|
7447
|
-
*
|
|
7412
|
+
* <ul>
|
|
7448
7413
|
* <li>
|
|
7449
|
-
*
|
|
7414
|
+
* <p>
|
|
7450
7415
|
* <code>OFF</code> MFA won't be used for any users.</p>
|
|
7451
7416
|
* </li>
|
|
7452
7417
|
* <li>
|
|
7453
|
-
*
|
|
7418
|
+
* <p>
|
|
7454
7419
|
* <code>ON</code> MFA is required for all users to sign in.</p>
|
|
7455
7420
|
* </li>
|
|
7456
7421
|
* <li>
|
|
7457
|
-
*
|
|
7422
|
+
* <p>
|
|
7458
7423
|
* <code>OPTIONAL</code> MFA will be required only for individual users who have
|
|
7459
7424
|
* an MFA factor activated.</p>
|
|
7460
7425
|
* </li>
|
|
@@ -7476,17 +7441,17 @@ export interface SetUserPoolMfaConfigResponse {
|
|
|
7476
7441
|
SoftwareTokenMfaConfiguration?: SoftwareTokenMfaConfigType;
|
|
7477
7442
|
/**
|
|
7478
7443
|
* <p>The MFA configuration. Valid values include:</p>
|
|
7479
|
-
*
|
|
7444
|
+
* <ul>
|
|
7480
7445
|
* <li>
|
|
7481
|
-
*
|
|
7446
|
+
* <p>
|
|
7482
7447
|
* <code>OFF</code> MFA won't be used for any users.</p>
|
|
7483
7448
|
* </li>
|
|
7484
7449
|
* <li>
|
|
7485
|
-
*
|
|
7450
|
+
* <p>
|
|
7486
7451
|
* <code>ON</code> MFA is required for all users to sign in.</p>
|
|
7487
7452
|
* </li>
|
|
7488
7453
|
* <li>
|
|
7489
|
-
*
|
|
7454
|
+
* <p>
|
|
7490
7455
|
* <code>OPTIONAL</code> MFA will be required only for individual users who have
|
|
7491
7456
|
* an MFA factor enabled.</p>
|
|
7492
7457
|
* </li>
|
|
@@ -7668,6 +7633,10 @@ export declare const ChangePasswordRequestFilterSensitiveLog: (obj: ChangePasswo
|
|
|
7668
7633
|
* @internal
|
|
7669
7634
|
*/
|
|
7670
7635
|
export declare const ConfirmDeviceRequestFilterSensitiveLog: (obj: ConfirmDeviceRequest) => any;
|
|
7636
|
+
/**
|
|
7637
|
+
* @internal
|
|
7638
|
+
*/
|
|
7639
|
+
export declare const UserContextDataTypeFilterSensitiveLog: (obj: UserContextDataType) => any;
|
|
7671
7640
|
/**
|
|
7672
7641
|
* @internal
|
|
7673
7642
|
*/
|