aws-cdk-lib 2.153.0__py3-none-any.whl → 2.154.0__py3-none-any.whl

aws_cdk/aws_cognito/__init__.py

@@ -1011,11 +1011,13 @@ from .._jsii import *
 import constructs as _constructs_77d1e7e8
 from .. import (
     CfnResource as _CfnResource_9df397a6,
+    CfnTag as _CfnTag_f6864754,
     Duration as _Duration_4839e8c3,
     IInspectable as _IInspectable_c2943556,
     IResolvable as _IResolvable_da3f097b,
     IResource as _IResource_c80c4260,
     ITaggable as _ITaggable_36806126,
+    ITaggableV2 as _ITaggableV2_4e6798f8,
     RemovalPolicy as _RemovalPolicy_9f93c814,
     Resource as _Resource_45bc6135,
     SecretValue as _SecretValue_3dd0ddae,
@@ -1638,7 +1640,7 @@ class BaseUrlOptions:
         )
 
 
-@jsii.implements(_IInspectable_c2943556)
+@jsii.implements(_IInspectable_c2943556, _ITaggableV2_4e6798f8)
 class CfnIdentityPool(
     _CfnResource_9df397a6,
     metaclass=jsii.JSIIMeta,
@@ -1677,6 +1679,7 @@ class CfnIdentityPool(
         cognito_streams: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnIdentityPool.CognitoStreamsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         developer_provider_name: typing.Optional[builtins.str] = None,
         identity_pool_name: typing.Optional[builtins.str] = None,
+        identity_pool_tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
         open_id_connect_provider_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
         push_sync: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnIdentityPool.PushSyncProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         saml_provider_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
@@ -1692,6 +1695,7 @@ class CfnIdentityPool(
         :param cognito_streams: Configuration options for configuring Amazon Cognito streams.
         :param developer_provider_name: The "domain" Amazon Cognito uses when referencing your users. This name acts as a placeholder that allows your backend and the Amazon Cognito service to communicate about the developer provider. For the ``DeveloperProviderName`` , you can use letters and periods (.), underscores (_), and dashes (-). *Minimum length* : 1 *Maximum length* : 100
         :param identity_pool_name: The name of your Amazon Cognito identity pool. *Minimum length* : 1 *Maximum length* : 128 *Pattern* : ``[\\w\\s+=,.@-]+``
+        :param identity_pool_tags: Tags to assign to the identity pool. A tag is a label that you can apply to identity pools to categorize and manage them in different ways, such as by purpose, owner, environment, or other criteria.
         :param open_id_connect_provider_arns: The Amazon Resource Names (ARNs) of the OpenID connect providers.
         :param push_sync: The configuration options to be applied to the identity pool.
         :param saml_provider_arns: The Amazon Resource Names (ARNs) of the Security Assertion Markup Language (SAML) providers.
@@ -1709,6 +1713,7 @@ class CfnIdentityPool(
             cognito_streams=cognito_streams,
             developer_provider_name=developer_provider_name,
             identity_pool_name=identity_pool_name,
+            identity_pool_tags=identity_pool_tags,
             open_id_connect_provider_arns=open_id_connect_provider_arns,
             push_sync=push_sync,
             saml_provider_arns=saml_provider_arns,
@@ -1764,6 +1769,12 @@ class CfnIdentityPool(
         '''
         return typing.cast(builtins.str, jsii.get(self, "attrName"))
 
+    @builtins.property
+    @jsii.member(jsii_name="cdkTagManager")
+    def cdk_tag_manager(self) -> _TagManager_0a598cb3:
+        '''Tag Manager which manages the tags for this resource.'''
+        return typing.cast(_TagManager_0a598cb3, jsii.get(self, "cdkTagManager"))
+
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
@@ -1785,7 +1796,7 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__db6ea31d27c717c9763b6408e0f3923cd9b6dc2e5d79b1a66ce864122450159f)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "allowUnauthenticatedIdentities", value)
+        jsii.set(self, "allowUnauthenticatedIdentities", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="allowClassicFlow")
@@ -1803,7 +1814,7 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__c5b513e4bd7ec3f84408bf9a2b747fb0b06357d05747f6825c473e9274958606)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "allowClassicFlow", value)
+        jsii.set(self, "allowClassicFlow", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="cognitoEvents")
@@ -1816,7 +1827,7 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__360f21073c65bd16eeda7bcf34ec57609826f7d58ba6dc4fc009286320ef72de)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "cognitoEvents", value)
+        jsii.set(self, "cognitoEvents", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="cognitoIdentityProviders")
@@ -1834,7 +1845,7 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__fbb45d26060f7e1f74033e6a37741666fb843374b7a2b735483dea6f9b824230)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "cognitoIdentityProviders", value)
+        jsii.set(self, "cognitoIdentityProviders", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="cognitoStreams")
@@ -1852,7 +1863,7 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__502164af12ab71961d7f4f2e11817973d435bc4577d049f15a4cf62796079879)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "cognitoStreams", value)
+        jsii.set(self, "cognitoStreams", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="developerProviderName")
@@ -1865,7 +1876,7 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__f2b5f037f02889c2a585909dfa772a6165c4470d0984cfa622e1374ed7852936)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "developerProviderName", value)
+        jsii.set(self, "developerProviderName", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="identityPoolName")
@@ -1878,7 +1889,23 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__6010d0ddbf0b577c8e7ea0796913ba4085881df0b32cec744c271c99300165af)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "identityPoolName", value)
+        jsii.set(self, "identityPoolName", value) # pyright: ignore[reportArgumentType]
+
+    @builtins.property
+    @jsii.member(jsii_name="identityPoolTags")
+    def identity_pool_tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
+        '''Tags to assign to the identity pool.'''
+        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], jsii.get(self, "identityPoolTags"))
+
+    @identity_pool_tags.setter
+    def identity_pool_tags(
+        self,
+        value: typing.Optional[typing.List[_CfnTag_f6864754]],
+    ) -> None:
+        if __debug__:
+            type_hints = typing.get_type_hints(_typecheckingstub__caf91efc577806bf48a176729ecabaf6b30c2d71ecfff869256e7500e4dcb9bc)
+            check_type(argname="argument value", value=value, expected_type=type_hints["value"])
+        jsii.set(self, "identityPoolTags", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="openIdConnectProviderArns")
@@ -1896,7 +1923,7 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__61d80fcbd99af6003aec5d0b96e0ec9abdb3d4f6e2f44f67bdd2e746351a3517)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "openIdConnectProviderArns", value)
+        jsii.set(self, "openIdConnectProviderArns", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="pushSync")
@@ -1914,7 +1941,7 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__37451572b0d939f18081b9fd4743a223e16c702244d56835c0e577ed22f85c70)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "pushSync", value)
+        jsii.set(self, "pushSync", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="samlProviderArns")
@@ -1930,7 +1957,7 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__d2aad48eb5d6c1e553867325f44b35ef0b577c7971cf240ed4b646c07303a760)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "samlProviderArns", value)
+        jsii.set(self, "samlProviderArns", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="supportedLoginProviders")
@@ -1943,7 +1970,7 @@ class CfnIdentityPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__905e78c8fb6056ab2fc4961e4c0d8d7817993690aff93e2be1384e79b1effe9a)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "supportedLoginProviders", value)
+        jsii.set(self, "supportedLoginProviders", value) # pyright: ignore[reportArgumentType]
 
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnIdentityPool.CognitoIdentityProviderProperty",
@@ -2318,7 +2345,7 @@ class CfnIdentityPoolPrincipalTag(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__18add40294e453336d39c4b2518445fd0e172f25c23bd78b598609632a714548)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "identityPoolId", value)
+        jsii.set(self, "identityPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="identityProviderName")
@@ -2331,7 +2358,7 @@ class CfnIdentityPoolPrincipalTag(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__671325bd1b5eb381434a0ced3b0ca5b3646c379113e1014679b7ebacca38cc3e)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "identityProviderName", value)
+        jsii.set(self, "identityProviderName", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="principalTags")
@@ -2344,7 +2371,7 @@ class CfnIdentityPoolPrincipalTag(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__941cd9f870d419478e147197cb0134b687f7c233a8bc805887d04a761669aefc)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "principalTags", value)
+        jsii.set(self, "principalTags", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="useDefaults")
@@ -2362,7 +2389,7 @@ class CfnIdentityPoolPrincipalTag(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__615ac6e1fae0725987511e0b22108f8d03202321eadeee202779d4e5248fd19a)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "useDefaults", value)
+        jsii.set(self, "useDefaults", value) # pyright: ignore[reportArgumentType]
 
 
 @jsii.data_type(
@@ -2491,6 +2518,7 @@ class CfnIdentityPoolPrincipalTagProps:
         "cognito_streams": "cognitoStreams",
         "developer_provider_name": "developerProviderName",
         "identity_pool_name": "identityPoolName",
+        "identity_pool_tags": "identityPoolTags",
         "open_id_connect_provider_arns": "openIdConnectProviderArns",
         "push_sync": "pushSync",
         "saml_provider_arns": "samlProviderArns",
@@ -2508,6 +2536,7 @@ class CfnIdentityPoolProps:
         cognito_streams: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnIdentityPool.CognitoStreamsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         developer_provider_name: typing.Optional[builtins.str] = None,
         identity_pool_name: typing.Optional[builtins.str] = None,
+        identity_pool_tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
         open_id_connect_provider_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
         push_sync: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnIdentityPool.PushSyncProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
         saml_provider_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
@@ -2522,6 +2551,7 @@ class CfnIdentityPoolProps:
         :param cognito_streams: Configuration options for configuring Amazon Cognito streams.
         :param developer_provider_name: The "domain" Amazon Cognito uses when referencing your users. This name acts as a placeholder that allows your backend and the Amazon Cognito service to communicate about the developer provider. For the ``DeveloperProviderName`` , you can use letters and periods (.), underscores (_), and dashes (-). *Minimum length* : 1 *Maximum length* : 100
         :param identity_pool_name: The name of your Amazon Cognito identity pool. *Minimum length* : 1 *Maximum length* : 128 *Pattern* : ``[\\w\\s+=,.@-]+``
+        :param identity_pool_tags: Tags to assign to the identity pool. A tag is a label that you can apply to identity pools to categorize and manage them in different ways, such as by purpose, owner, environment, or other criteria.
         :param open_id_connect_provider_arns: The Amazon Resource Names (ARNs) of the OpenID connect providers.
         :param push_sync: The configuration options to be applied to the identity pool.
         :param saml_provider_arns: The Amazon Resource Names (ARNs) of the Security Assertion Markup Language (SAML) providers.
@@ -2551,6 +2581,7 @@ class CfnIdentityPoolProps:
             check_type(argname="argument cognito_streams", value=cognito_streams, expected_type=type_hints["cognito_streams"])
             check_type(argname="argument developer_provider_name", value=developer_provider_name, expected_type=type_hints["developer_provider_name"])
             check_type(argname="argument identity_pool_name", value=identity_pool_name, expected_type=type_hints["identity_pool_name"])
+            check_type(argname="argument identity_pool_tags", value=identity_pool_tags, expected_type=type_hints["identity_pool_tags"])
             check_type(argname="argument open_id_connect_provider_arns", value=open_id_connect_provider_arns, expected_type=type_hints["open_id_connect_provider_arns"])
             check_type(argname="argument push_sync", value=push_sync, expected_type=type_hints["push_sync"])
             check_type(argname="argument saml_provider_arns", value=saml_provider_arns, expected_type=type_hints["saml_provider_arns"])
@@ -2570,6 +2601,8 @@ class CfnIdentityPoolProps:
             self._values["developer_provider_name"] = developer_provider_name
         if identity_pool_name is not None:
             self._values["identity_pool_name"] = identity_pool_name
+        if identity_pool_tags is not None:
+            self._values["identity_pool_tags"] = identity_pool_tags
         if open_id_connect_provider_arns is not None:
             self._values["open_id_connect_provider_arns"] = open_id_connect_provider_arns
         if push_sync is not None:
@@ -2663,6 +2696,17 @@ class CfnIdentityPoolProps:
         result = self._values.get("identity_pool_name")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def identity_pool_tags(self) -> typing.Optional[typing.List[_CfnTag_f6864754]]:
+        '''Tags to assign to the identity pool.
+
+        A tag is a label that you can apply to identity pools to categorize and manage them in different ways, such as by purpose, owner, environment, or other criteria.
+
+        :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-identitypool.html#cfn-cognito-identitypool-identitypooltags
+        '''
+        result = self._values.get("identity_pool_tags")
+        return typing.cast(typing.Optional[typing.List[_CfnTag_f6864754]], result)
+
     @builtins.property
     def open_id_connect_provider_arns(
         self,
@@ -2841,7 +2885,7 @@ class CfnIdentityPoolRoleAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__c00bf0f77c984f55d1c0f4d659a057ac347b7a1e253f7f07e04e7cb5836f96be)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "identityPoolId", value)
+        jsii.set(self, "identityPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="roleMappings")
@@ -2859,7 +2903,7 @@ class CfnIdentityPoolRoleAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__260d54d4ee9e4e92869ee257cefc54f19659c465c953f833a73ba65eac311091)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "roleMappings", value)
+        jsii.set(self, "roleMappings", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="roles")
@@ -2872,7 +2916,7 @@ class CfnIdentityPoolRoleAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__987142230d77cd554d510e7265f08bb6c8a2ff277afb6532b8166d2315b9510c)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "roles", value)
+        jsii.set(self, "roles", value) # pyright: ignore[reportArgumentType]
 
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnIdentityPoolRoleAttachment.MappingRuleProperty",
@@ -3306,7 +3350,7 @@ class CfnLogDeliveryConfiguration(
     metaclass=jsii.JSIIMeta,
     jsii_type="aws-cdk-lib.aws_cognito.CfnLogDeliveryConfiguration",
 ):
-    '''The logging parameters of a user pool.
+    '''The logging parameters of a user pool returned in response to ``GetLogDeliveryConfiguration`` .
 
     :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-logdeliveryconfiguration.html
     :cloudformationResource: AWS::Cognito::LogDeliveryConfiguration
@@ -3327,7 +3371,13 @@ class CfnLogDeliveryConfiguration(
                     log_group_arn="logGroupArn"
                 ),
                 event_source="eventSource",
-                log_level="logLevel"
+                firehose_configuration=cognito.CfnLogDeliveryConfiguration.FirehoseConfigurationProperty(
+                    stream_arn="streamArn"
+                ),
+                log_level="logLevel",
+                s3_configuration=cognito.CfnLogDeliveryConfiguration.S3ConfigurationProperty(
+                    bucket_arn="bucketArn"
+                )
             )]
         )
     '''
@@ -3343,8 +3393,8 @@ class CfnLogDeliveryConfiguration(
         '''
         :param scope: Scope in which this resource is defined.
         :param id: Construct identifier for this resource (unique in its scope).
-        :param user_pool_id: The ID of the user pool where you configured detailed activity logging.
-        :param log_configurations: The detailed activity logging destination of a user pool.
+        :param user_pool_id: The ID of the user pool where you configured logging.
+        :param log_configurations: A logging destination of a user pool. User pools can have multiple logging destinations for message-delivery and user-activity logs.
         '''
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__e29530a80c41b2b01a02705536af0f4120664e64afaf6cf445105a2dd4a7023d)
@@ -3403,7 +3453,7 @@ class CfnLogDeliveryConfiguration(
     @builtins.property
     @jsii.member(jsii_name="userPoolId")
     def user_pool_id(self) -> builtins.str:
-        '''The ID of the user pool where you configured detailed activity logging.'''
+        '''The ID of the user pool where you configured logging.'''
         return typing.cast(builtins.str, jsii.get(self, "userPoolId"))
 
     @user_pool_id.setter
@@ -3411,14 +3461,14 @@ class CfnLogDeliveryConfiguration(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__2182e97aaa93da941d4811edec2c32bd2af08481e5b611636933cf688c72d4a5)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolId", value)
+        jsii.set(self, "userPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="logConfigurations")
     def log_configurations(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnLogDeliveryConfiguration.LogConfigurationProperty"]]]]:
-        '''The detailed activity logging destination of a user pool.'''
+        '''A logging destination of a user pool.'''
         return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, "CfnLogDeliveryConfiguration.LogConfigurationProperty"]]]], jsii.get(self, "logConfigurations"))
 
     @log_configurations.setter
@@ -3429,7 +3479,7 @@ class CfnLogDeliveryConfiguration(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__40a6b8e2f773442c634fa6b71515839097ae56e3de02083447219aae5f9c1a9f)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "logConfigurations", value)
+        jsii.set(self, "logConfigurations", value) # pyright: ignore[reportArgumentType]
 
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnLogDeliveryConfiguration.CloudWatchLogsConfigurationProperty",
@@ -3442,7 +3492,7 @@ class CfnLogDeliveryConfiguration(
             *,
             log_group_arn: typing.Optional[builtins.str] = None,
         ) -> None:
-            '''The CloudWatch logging destination of a user pool detailed activity logging configuration.
+            '''Configuration for the CloudWatch log group destination of user pool detailed activity logging, or of user activity log export with advanced security features.
 
             :param log_group_arn: The Amazon Resource Name (arn) of a CloudWatch Logs log group where your user pool sends logs. The log group must not be encrypted with AWS Key Management Service and must be in the same AWS account as your user pool. To send logs to log groups with a resource policy of a size greater than 5120 characters, configure a log group with a path that starts with ``/aws/vendedlogs`` . For more information, see `Enabling logging from certain AWS services <https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html>`_ .
 
@@ -3490,13 +3540,66 @@ class CfnLogDeliveryConfiguration(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cognito.CfnLogDeliveryConfiguration.FirehoseConfigurationProperty",
+        jsii_struct_bases=[],
+        name_mapping={"stream_arn": "streamArn"},
+    )
+    class FirehoseConfigurationProperty:
+        def __init__(self, *, stream_arn: typing.Optional[builtins.str] = None) -> None:
+            '''Configuration for the Amazon Data Firehose stream destination of user activity log export with advanced security features.
+
+            :param stream_arn: The ARN of an Amazon Data Firehose stream that's the destination for advanced security features log export.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-logdeliveryconfiguration-firehoseconfiguration.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cognito as cognito
+                
+                firehose_configuration_property = cognito.CfnLogDeliveryConfiguration.FirehoseConfigurationProperty(
+                    stream_arn="streamArn"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__ae072d70f2bbea287c140340ad4ca6d5b9e1b95bf2308803bfb1cfbd9e23e5e0)
+                check_type(argname="argument stream_arn", value=stream_arn, expected_type=type_hints["stream_arn"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if stream_arn is not None:
+                self._values["stream_arn"] = stream_arn
+
+        @builtins.property
+        def stream_arn(self) -> typing.Optional[builtins.str]:
+            '''The ARN of an Amazon Data Firehose stream that's the destination for advanced security features log export.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-logdeliveryconfiguration-firehoseconfiguration.html#cfn-cognito-logdeliveryconfiguration-firehoseconfiguration-streamarn
+            '''
+            result = self._values.get("stream_arn")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "FirehoseConfigurationProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnLogDeliveryConfiguration.LogConfigurationProperty",
         jsii_struct_bases=[],
         name_mapping={
             "cloud_watch_logs_configuration": "cloudWatchLogsConfiguration",
             "event_source": "eventSource",
+            "firehose_configuration": "firehoseConfiguration",
             "log_level": "logLevel",
+            "s3_configuration": "s3Configuration",
         },
     )
     class LogConfigurationProperty:
@@ -3505,13 +3608,17 @@ class CfnLogDeliveryConfiguration(
             *,
             cloud_watch_logs_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnLogDeliveryConfiguration.CloudWatchLogsConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             event_source: typing.Optional[builtins.str] = None,
+            firehose_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnLogDeliveryConfiguration.FirehoseConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             log_level: typing.Optional[builtins.str] = None,
+            s3_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnLogDeliveryConfiguration.S3ConfigurationProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
         ) -> None:
             '''The logging parameters of a user pool.
 
-            :param cloud_watch_logs_configuration: The CloudWatch logging destination of a user pool detailed activity logging configuration.
-            :param event_source: The source of events that your user pool sends for detailed activity logging.
-            :param log_level: The ``errorlevel`` selection of logs that a user pool sends for detailed activity logging.
+            :param cloud_watch_logs_configuration: Configuration for the CloudWatch log group destination of user pool detailed activity logging, or of user activity log export with advanced security features.
+            :param event_source: The source of events that your user pool sends for logging. To send error-level logs about user notification activity, set to ``userNotification`` . To send info-level logs about advanced security features user activity, set to ``userAuthEvents`` .
+            :param firehose_configuration: Configuration for the Amazon Data Firehose stream destination of user activity log export with advanced security features.
+            :param log_level: The ``errorlevel`` selection of logs that a user pool sends for detailed activity logging. To send ``userNotification`` activity with `information about message delivery <https://docs.aws.amazon.com/cognito/latest/developerguide/tracking-quotas-and-usage-in-cloud-watch-logs.html>`_ , choose ``ERROR`` with ``CloudWatchLogsConfiguration`` . To send ``userAuthEvents`` activity with user logs from advanced security features, choose ``INFO`` with one of ``CloudWatchLogsConfiguration`` , ``FirehoseConfiguration`` , or ``S3Configuration`` .
+            :param s3_configuration: Configuration for the Amazon S3 bucket destination of user activity log export with advanced security features.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-logdeliveryconfiguration-logconfiguration.html
             :exampleMetadata: fixture=_generated
@@ -3527,27 +3634,39 @@ class CfnLogDeliveryConfiguration(
                         log_group_arn="logGroupArn"
                     ),
                     event_source="eventSource",
-                    log_level="logLevel"
+                    firehose_configuration=cognito.CfnLogDeliveryConfiguration.FirehoseConfigurationProperty(
+                        stream_arn="streamArn"
+                    ),
+                    log_level="logLevel",
+                    s3_configuration=cognito.CfnLogDeliveryConfiguration.S3ConfigurationProperty(
+                        bucket_arn="bucketArn"
+                    )
                 )
             '''
             if __debug__:
                 type_hints = typing.get_type_hints(_typecheckingstub__3fcaff05e87f499492c9c4ac6949463926f4833510675569310df4f8cb619149)
                 check_type(argname="argument cloud_watch_logs_configuration", value=cloud_watch_logs_configuration, expected_type=type_hints["cloud_watch_logs_configuration"])
                 check_type(argname="argument event_source", value=event_source, expected_type=type_hints["event_source"])
+                check_type(argname="argument firehose_configuration", value=firehose_configuration, expected_type=type_hints["firehose_configuration"])
                 check_type(argname="argument log_level", value=log_level, expected_type=type_hints["log_level"])
+                check_type(argname="argument s3_configuration", value=s3_configuration, expected_type=type_hints["s3_configuration"])
             self._values: typing.Dict[builtins.str, typing.Any] = {}
             if cloud_watch_logs_configuration is not None:
                 self._values["cloud_watch_logs_configuration"] = cloud_watch_logs_configuration
             if event_source is not None:
                 self._values["event_source"] = event_source
+            if firehose_configuration is not None:
+                self._values["firehose_configuration"] = firehose_configuration
             if log_level is not None:
                 self._values["log_level"] = log_level
+            if s3_configuration is not None:
+                self._values["s3_configuration"] = s3_configuration
 
         @builtins.property
         def cloud_watch_logs_configuration(
             self,
         ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnLogDeliveryConfiguration.CloudWatchLogsConfigurationProperty"]]:
-            '''The CloudWatch logging destination of a user pool detailed activity logging configuration.
+            '''Configuration for the CloudWatch log group destination of user pool detailed activity logging, or of user activity log export with advanced security features.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-logdeliveryconfiguration-logconfiguration.html#cfn-cognito-logdeliveryconfiguration-logconfiguration-cloudwatchlogsconfiguration
             '''
@@ -3556,22 +3675,48 @@ class CfnLogDeliveryConfiguration(
 
         @builtins.property
         def event_source(self) -> typing.Optional[builtins.str]:
-            '''The source of events that your user pool sends for detailed activity logging.
+            '''The source of events that your user pool sends for logging.
+
+            To send error-level logs about user notification activity, set to ``userNotification`` . To send info-level logs about advanced security features user activity, set to ``userAuthEvents`` .
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-logdeliveryconfiguration-logconfiguration.html#cfn-cognito-logdeliveryconfiguration-logconfiguration-eventsource
             '''
             result = self._values.get("event_source")
             return typing.cast(typing.Optional[builtins.str], result)
 
+        @builtins.property
+        def firehose_configuration(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnLogDeliveryConfiguration.FirehoseConfigurationProperty"]]:
+            '''Configuration for the Amazon Data Firehose stream destination of user activity log export with advanced security features.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-logdeliveryconfiguration-logconfiguration.html#cfn-cognito-logdeliveryconfiguration-logconfiguration-firehoseconfiguration
+            '''
+            result = self._values.get("firehose_configuration")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnLogDeliveryConfiguration.FirehoseConfigurationProperty"]], result)
+
         @builtins.property
         def log_level(self) -> typing.Optional[builtins.str]:
             '''The ``errorlevel`` selection of logs that a user pool sends for detailed activity logging.
 
+            To send ``userNotification`` activity with `information about message delivery <https://docs.aws.amazon.com/cognito/latest/developerguide/tracking-quotas-and-usage-in-cloud-watch-logs.html>`_ , choose ``ERROR`` with ``CloudWatchLogsConfiguration`` . To send ``userAuthEvents`` activity with user logs from advanced security features, choose ``INFO`` with one of ``CloudWatchLogsConfiguration`` , ``FirehoseConfiguration`` , or ``S3Configuration`` .
+
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-logdeliveryconfiguration-logconfiguration.html#cfn-cognito-logdeliveryconfiguration-logconfiguration-loglevel
             '''
             result = self._values.get("log_level")
             return typing.cast(typing.Optional[builtins.str], result)
 
+        @builtins.property
+        def s3_configuration(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnLogDeliveryConfiguration.S3ConfigurationProperty"]]:
+            '''Configuration for the Amazon S3 bucket destination of user activity log export with advanced security features.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-logdeliveryconfiguration-logconfiguration.html#cfn-cognito-logdeliveryconfiguration-logconfiguration-s3configuration
+            '''
+            result = self._values.get("s3_configuration")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnLogDeliveryConfiguration.S3ConfigurationProperty"]], result)
+
         def __eq__(self, rhs: typing.Any) -> builtins.bool:
             return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -3583,6 +3728,57 @@ class CfnLogDeliveryConfiguration(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cognito.CfnLogDeliveryConfiguration.S3ConfigurationProperty",
+        jsii_struct_bases=[],
+        name_mapping={"bucket_arn": "bucketArn"},
+    )
+    class S3ConfigurationProperty:
+        def __init__(self, *, bucket_arn: typing.Optional[builtins.str] = None) -> None:
+            '''Configuration for the Amazon S3 bucket destination of user activity log export with advanced security features.
+
+            :param bucket_arn: The ARN of an Amazon S3 bucket that's the destination for advanced security features log export.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-logdeliveryconfiguration-s3configuration.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cognito as cognito
+                
+                s3_configuration_property = cognito.CfnLogDeliveryConfiguration.S3ConfigurationProperty(
+                    bucket_arn="bucketArn"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__35855407409f14c2401e604d3e25c83bb2d207f28090618c8174149befb93967)
+                check_type(argname="argument bucket_arn", value=bucket_arn, expected_type=type_hints["bucket_arn"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if bucket_arn is not None:
+                self._values["bucket_arn"] = bucket_arn
+
+        @builtins.property
+        def bucket_arn(self) -> typing.Optional[builtins.str]:
+            '''The ARN of an Amazon S3 bucket that's the destination for advanced security features log export.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-logdeliveryconfiguration-s3configuration.html#cfn-cognito-logdeliveryconfiguration-s3configuration-bucketarn
+            '''
+            result = self._values.get("bucket_arn")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "S3ConfigurationProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
 
 @jsii.data_type(
     jsii_type="aws-cdk-lib.aws_cognito.CfnLogDeliveryConfigurationProps",
@@ -3601,8 +3797,8 @@ class CfnLogDeliveryConfigurationProps:
     ) -> None:
         '''Properties for defining a ``CfnLogDeliveryConfiguration``.
 
-        :param user_pool_id: The ID of the user pool where you configured detailed activity logging.
-        :param log_configurations: The detailed activity logging destination of a user pool.
+        :param user_pool_id: The ID of the user pool where you configured logging.
+        :param log_configurations: A logging destination of a user pool. User pools can have multiple logging destinations for message-delivery and user-activity logs.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-logdeliveryconfiguration.html
         :exampleMetadata: fixture=_generated
@@ -3622,7 +3818,13 @@ class CfnLogDeliveryConfigurationProps:
                         log_group_arn="logGroupArn"
                     ),
                     event_source="eventSource",
-                    log_level="logLevel"
+                    firehose_configuration=cognito.CfnLogDeliveryConfiguration.FirehoseConfigurationProperty(
+                        stream_arn="streamArn"
+                    ),
+                    log_level="logLevel",
+                    s3_configuration=cognito.CfnLogDeliveryConfiguration.S3ConfigurationProperty(
+                        bucket_arn="bucketArn"
+                    )
                 )]
             )
         '''
@@ -3638,7 +3840,7 @@ class CfnLogDeliveryConfigurationProps:
 
     @builtins.property
     def user_pool_id(self) -> builtins.str:
-        '''The ID of the user pool where you configured detailed activity logging.
+        '''The ID of the user pool where you configured logging.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-logdeliveryconfiguration.html#cfn-cognito-logdeliveryconfiguration-userpoolid
         '''
@@ -3650,7 +3852,9 @@ class CfnLogDeliveryConfigurationProps:
     def log_configurations(
         self,
     ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, typing.List[typing.Union[_IResolvable_da3f097b, CfnLogDeliveryConfiguration.LogConfigurationProperty]]]]:
-        '''The detailed activity logging destination of a user pool.
+        '''A logging destination of a user pool.
+
+        User pools can have multiple logging destinations for message-delivery and user-activity logs.
 
         :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-logdeliveryconfiguration.html#cfn-cognito-logdeliveryconfiguration-logconfigurations
         '''
@@ -3756,6 +3960,7 @@ class CfnUserPool(
             policies=cognito.CfnUserPool.PoliciesProperty(
                 password_policy=cognito.CfnUserPool.PasswordPolicyProperty(
                     minimum_length=123,
+                    password_history_size=123,
                     require_lowercase=False,
                     require_numbers=False,
                     require_symbols=False,
@@ -3793,6 +3998,9 @@ class CfnUserPool(
                 case_sensitive=False
             ),
             user_pool_add_ons=cognito.CfnUserPool.UserPoolAddOnsProperty(
+                advanced_security_additional_flows=cognito.CfnUserPool.AdvancedSecurityAdditionalFlowsProperty(
+                    custom_auth_mode="customAuthMode"
+                ),
                 advanced_security_mode="advancedSecurityMode"
             ),
             user_pool_name="userPoolName",
@@ -3992,7 +4200,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__da99efaebeb66459045576f8f7065b4ef07804424df0623f038bbd64d754aacc)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "accountRecoverySetting", value)
+        jsii.set(self, "accountRecoverySetting", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="adminCreateUserConfig")
@@ -4010,7 +4218,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__eaaa881203c259b6afa777936a9ca0096f8c631069a5ebd10e4ad0bd2c5229d4)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "adminCreateUserConfig", value)
+        jsii.set(self, "adminCreateUserConfig", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="aliasAttributes")
@@ -4029,7 +4237,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__cc3f2402f4f88736f7b230549074e49d6aee20281b90dbeeb4a0bb5c031e81d2)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "aliasAttributes", value)
+        jsii.set(self, "aliasAttributes", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="autoVerifiedAttributes")
@@ -4045,7 +4253,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__67b5b672ef087a1ed7f05991df5c156df67b6c51d144847ad452e5f52c4bcbe5)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "autoVerifiedAttributes", value)
+        jsii.set(self, "autoVerifiedAttributes", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="deletionProtection")
@@ -4058,7 +4266,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__455a3b25859643cc12071049235f2feb590ee06f70ec42d2cd83bc166d9e9c9f)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "deletionProtection", value)
+        jsii.set(self, "deletionProtection", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="deviceConfiguration")
@@ -4076,7 +4284,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__7eb821a70b459056b6d26722d06f8b948b315111a936804d8aba0e7ff07d13bf)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "deviceConfiguration", value)
+        jsii.set(self, "deviceConfiguration", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="emailConfiguration")
@@ -4094,7 +4302,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__32d0b53f74dc294b25f20f54bcdaf8477a3dfc8b505387d70f97f7febe6ae209)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "emailConfiguration", value)
+        jsii.set(self, "emailConfiguration", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="emailVerificationMessage")
@@ -4107,7 +4315,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__82f2fd26b3ec2cf294bdc8be0a8bbae7dbacd31abbdbead2a75eac9566efd913)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "emailVerificationMessage", value)
+        jsii.set(self, "emailVerificationMessage", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="emailVerificationSubject")
@@ -4120,7 +4328,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__e72167174985dddad82c3fffee5bd2e72f61e1a560cae39101e0f0bfa55a6c74)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "emailVerificationSubject", value)
+        jsii.set(self, "emailVerificationSubject", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="enabledMfas")
@@ -4133,7 +4341,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__043cb4b4941782c98919a853fc16bce8663c274df01579f9caeb0cc2a0e4c28a)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "enabledMfas", value)
+        jsii.set(self, "enabledMfas", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="lambdaConfig")
@@ -4151,7 +4359,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__8c7be7c0b2e4badc8ab3ce5fb0f327b3c26ebcb18bb31bc39a369f1c5fd64877)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "lambdaConfig", value)
+        jsii.set(self, "lambdaConfig", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="mfaConfiguration")
@@ -4167,7 +4375,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__02262b9b75d7d340810cfbaca693eeab69c3422010742739d64170db818cd1c5)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "mfaConfiguration", value)
+        jsii.set(self, "mfaConfiguration", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="policies")
@@ -4185,7 +4393,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__cc547f06b5c5b29499b9c1debda606db3aa38d2243e5ea837490a194d6ee562d)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "policies", value)
+        jsii.set(self, "policies", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="schema")
@@ -4206,7 +4414,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__f0e5b663faa7be35e96a6bb7a25793a3650b322376c4df96db6ab04037432ec8)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "schema", value)
+        jsii.set(self, "schema", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="smsAuthenticationMessage")
@@ -4219,7 +4427,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__b0033e90845dce5d5ed18e8cdb36333bda83daa85a52bf9b317447a2b26bb923)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "smsAuthenticationMessage", value)
+        jsii.set(self, "smsAuthenticationMessage", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="smsConfiguration")
@@ -4237,7 +4445,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__7770291e207a266c6092133c98f74702280b1b762eadf5a38996872fd156c65d)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "smsConfiguration", value)
+        jsii.set(self, "smsConfiguration", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="smsVerificationMessage")
@@ -4250,7 +4458,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__698f1380b9328c4a773190401993fe201c403d6b9d10c9d4d82aac1836766754)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "smsVerificationMessage", value)
+        jsii.set(self, "smsVerificationMessage", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userAttributeUpdateSettings")
@@ -4268,7 +4476,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__092e452d396de66cdb0e7fad3a126dc88f5db6854ad416e350af1806e6465101)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userAttributeUpdateSettings", value)
+        jsii.set(self, "userAttributeUpdateSettings", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="usernameAttributes")
@@ -4284,7 +4492,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__70fd85fe188c058531323dc3601df251b6fe7e56cbb9e62fb3d7b9f710f2597c)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "usernameAttributes", value)
+        jsii.set(self, "usernameAttributes", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="usernameConfiguration")
@@ -4302,7 +4510,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__5021fa9a3421f51a3fb6735566cc12e369ce2d1a11bc37330e0278145be57e21)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "usernameConfiguration", value)
+        jsii.set(self, "usernameConfiguration", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userPoolAddOns")
@@ -4320,7 +4528,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__9387d4cd9039881cdf533356e5c6db2db0d1781598e0bee842b7485eca8c8fb2)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolAddOns", value)
+        jsii.set(self, "userPoolAddOns", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userPoolName")
@@ -4333,7 +4541,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__a877e7ca735a6cf85b712d1b09de98f59adcdbef66ffacb8f24d5687caa6a37a)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolName", value)
+        jsii.set(self, "userPoolName", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userPoolTagsRaw")
@@ -4346,7 +4554,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__c0ac7e31445bc4b1c75709a8cde084565899b188ecd5ed75a434afb3fecf7e3f)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolTagsRaw", value)
+        jsii.set(self, "userPoolTagsRaw", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="verificationMessageTemplate")
@@ -4364,7 +4572,7 @@ class CfnUserPool(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__9163d1ccc0cf294430031f1b8b5289192a6e048b52e8181e9ca8707780aac888)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "verificationMessageTemplate", value)
+        jsii.set(self, "verificationMessageTemplate", value) # pyright: ignore[reportArgumentType]
 
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnUserPool.AccountRecoverySettingProperty",
@@ -4534,6 +4742,59 @@ class CfnUserPool(
                 k + "=" + repr(v) for k, v in self._values.items()
             )
 
+    @jsii.data_type(
+        jsii_type="aws-cdk-lib.aws_cognito.CfnUserPool.AdvancedSecurityAdditionalFlowsProperty",
+        jsii_struct_bases=[],
+        name_mapping={"custom_auth_mode": "customAuthMode"},
+    )
+    class AdvancedSecurityAdditionalFlowsProperty:
+        def __init__(
+            self,
+            *,
+            custom_auth_mode: typing.Optional[builtins.str] = None,
+        ) -> None:
+            '''
+            :param custom_auth_mode: 
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-advancedsecurityadditionalflows.html
+            :exampleMetadata: fixture=_generated
+
+            Example::
+
+                # The code below shows an example of how to instantiate this type.
+                # The values are placeholders you should change.
+                from aws_cdk import aws_cognito as cognito
+                
+                advanced_security_additional_flows_property = cognito.CfnUserPool.AdvancedSecurityAdditionalFlowsProperty(
+                    custom_auth_mode="customAuthMode"
+                )
+            '''
+            if __debug__:
+                type_hints = typing.get_type_hints(_typecheckingstub__13d285bc1be8956472b23e9b2a73954ac4f3700dcebec3973e7b6cbad4639935)
+                check_type(argname="argument custom_auth_mode", value=custom_auth_mode, expected_type=type_hints["custom_auth_mode"])
+            self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if custom_auth_mode is not None:
+                self._values["custom_auth_mode"] = custom_auth_mode
+
+        @builtins.property
+        def custom_auth_mode(self) -> typing.Optional[builtins.str]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-advancedsecurityadditionalflows.html#cfn-cognito-userpool-advancedsecurityadditionalflows-customauthmode
+            '''
+            result = self._values.get("custom_auth_mode")
+            return typing.cast(typing.Optional[builtins.str], result)
+
+        def __eq__(self, rhs: typing.Any) -> builtins.bool:
+            return isinstance(rhs, self.__class__) and rhs._values == self._values
+
+        def __ne__(self, rhs: typing.Any) -> builtins.bool:
+            return not (rhs == self)
+
+        def __repr__(self) -> str:
+            return "AdvancedSecurityAdditionalFlowsProperty(%s)" % ", ".join(
+                k + "=" + repr(v) for k, v in self._values.items()
+            )
+
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnUserPool.CustomEmailSenderProperty",
         jsii_struct_bases=[],
@@ -5379,6 +5640,7 @@ class CfnUserPool(
         jsii_struct_bases=[],
         name_mapping={
             "minimum_length": "minimumLength",
+            "password_history_size": "passwordHistorySize",
             "require_lowercase": "requireLowercase",
             "require_numbers": "requireNumbers",
             "require_symbols": "requireSymbols",
@@ -5391,6 +5653,7 @@ class CfnUserPool(
             self,
             *,
             minimum_length: typing.Optional[jsii.Number] = None,
+            password_history_size: typing.Optional[jsii.Number] = None,
             require_lowercase: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
             require_numbers: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
             require_symbols: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
@@ -5400,6 +5663,7 @@ class CfnUserPool(
             '''The password policy type.
 
             :param minimum_length: The minimum length of the password in the policy that you have set. This value can't be less than 6.
+            :param password_history_size: The number of previous passwords that you want Amazon Cognito to restrict each user from reusing. Users can't set a password that matches any of ``n`` previous passwords, where ``n`` is the value of ``PasswordHistorySize`` . Password history isn't enforced and isn't displayed in `DescribeUserPool <https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPool.html>`_ responses when you set this value to ``0`` or don't provide it. To activate this setting, `advanced security features <https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-advanced-security.html>`_ must be active in your user pool.
             :param require_lowercase: In the password policy that you have set, refers to whether you have required users to use at least one lowercase letter in their password.
             :param require_numbers: In the password policy that you have set, refers to whether you have required users to use at least one number in their password.
             :param require_symbols: In the password policy that you have set, refers to whether you have required users to use at least one symbol in their password.
@@ -5417,6 +5681,7 @@ class CfnUserPool(
                 
                 password_policy_property = cognito.CfnUserPool.PasswordPolicyProperty(
                     minimum_length=123,
+                    password_history_size=123,
                     require_lowercase=False,
                     require_numbers=False,
                     require_symbols=False,
@@ -5427,6 +5692,7 @@ class CfnUserPool(
             if __debug__:
                 type_hints = typing.get_type_hints(_typecheckingstub__388245a445a407251a06f0f49f236a6b0a76ff7177f23a1d5cd9d4ffa819b2c0)
                 check_type(argname="argument minimum_length", value=minimum_length, expected_type=type_hints["minimum_length"])
+                check_type(argname="argument password_history_size", value=password_history_size, expected_type=type_hints["password_history_size"])
                 check_type(argname="argument require_lowercase", value=require_lowercase, expected_type=type_hints["require_lowercase"])
                 check_type(argname="argument require_numbers", value=require_numbers, expected_type=type_hints["require_numbers"])
                 check_type(argname="argument require_symbols", value=require_symbols, expected_type=type_hints["require_symbols"])
@@ -5435,6 +5701,8 @@ class CfnUserPool(
             self._values: typing.Dict[builtins.str, typing.Any] = {}
             if minimum_length is not None:
                 self._values["minimum_length"] = minimum_length
+            if password_history_size is not None:
+                self._values["password_history_size"] = password_history_size
             if require_lowercase is not None:
                 self._values["require_lowercase"] = require_lowercase
             if require_numbers is not None:
@@ -5457,6 +5725,19 @@ class CfnUserPool(
             result = self._values.get("minimum_length")
             return typing.cast(typing.Optional[jsii.Number], result)
 
+        @builtins.property
+        def password_history_size(self) -> typing.Optional[jsii.Number]:
+            '''The number of previous passwords that you want Amazon Cognito to restrict each user from reusing.
+
+            Users can't set a password that matches any of ``n`` previous passwords, where ``n`` is the value of ``PasswordHistorySize`` .
+
+            Password history isn't enforced and isn't displayed in `DescribeUserPool <https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPool.html>`_ responses when you set this value to ``0`` or don't provide it. To activate this setting, `advanced security features <https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-advanced-security.html>`_ must be active in your user pool.
+
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-passwordpolicy.html#cfn-cognito-userpool-passwordpolicy-passwordhistorysize
+            '''
+            result = self._values.get("password_history_size")
+            return typing.cast(typing.Optional[jsii.Number], result)
+
         @builtins.property
         def require_lowercase(
             self,
@@ -5553,6 +5834,7 @@ class CfnUserPool(
                 policies_property = cognito.CfnUserPool.PoliciesProperty(
                     password_policy=cognito.CfnUserPool.PasswordPolicyProperty(
                         minimum_length=123,
+                        password_history_size=123,
                         require_lowercase=False,
                         require_numbers=False,
                         require_symbols=False,
@@ -6165,12 +6447,16 @@ class CfnUserPool(
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnUserPool.UserPoolAddOnsProperty",
         jsii_struct_bases=[],
-        name_mapping={"advanced_security_mode": "advancedSecurityMode"},
+        name_mapping={
+            "advanced_security_additional_flows": "advancedSecurityAdditionalFlows",
+            "advanced_security_mode": "advancedSecurityMode",
+        },
     )
     class UserPoolAddOnsProperty:
         def __init__(
             self,
             *,
+            advanced_security_additional_flows: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union["CfnUserPool.AdvancedSecurityAdditionalFlowsProperty", typing.Dict[builtins.str, typing.Any]]]] = None,
             advanced_security_mode: typing.Optional[builtins.str] = None,
         ) -> None:
             '''User pool add-ons.
@@ -6179,7 +6465,8 @@ class CfnUserPool(
 
             For more information, see `Adding advanced security to a user pool <https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pool-settings-advanced-security.html>`_ .
 
-            :param advanced_security_mode: The operating mode of advanced security features in your user pool.
+            :param advanced_security_additional_flows: 
+            :param advanced_security_mode: The operating mode of advanced security features for standard authentication types in your user pool, including username-password and secure remote password (SRP) authentication.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-userpooladdons.html
             :exampleMetadata: fixture=_generated
@@ -6191,19 +6478,35 @@ class CfnUserPool(
                 from aws_cdk import aws_cognito as cognito
                 
                 user_pool_add_ons_property = cognito.CfnUserPool.UserPoolAddOnsProperty(
+                    advanced_security_additional_flows=cognito.CfnUserPool.AdvancedSecurityAdditionalFlowsProperty(
+                        custom_auth_mode="customAuthMode"
+                    ),
                     advanced_security_mode="advancedSecurityMode"
                 )
             '''
             if __debug__:
                 type_hints = typing.get_type_hints(_typecheckingstub__134d2b8e9ae3077b4c1f940aca55cabaa1dcdc1e12d0cd06c074768ee425ce71)
+                check_type(argname="argument advanced_security_additional_flows", value=advanced_security_additional_flows, expected_type=type_hints["advanced_security_additional_flows"])
                 check_type(argname="argument advanced_security_mode", value=advanced_security_mode, expected_type=type_hints["advanced_security_mode"])
             self._values: typing.Dict[builtins.str, typing.Any] = {}
+            if advanced_security_additional_flows is not None:
+                self._values["advanced_security_additional_flows"] = advanced_security_additional_flows
             if advanced_security_mode is not None:
                 self._values["advanced_security_mode"] = advanced_security_mode
 
+        @builtins.property
+        def advanced_security_additional_flows(
+            self,
+        ) -> typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnUserPool.AdvancedSecurityAdditionalFlowsProperty"]]:
+            '''
+            :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-userpooladdons.html#cfn-cognito-userpool-userpooladdons-advancedsecurityadditionalflows
+            '''
+            result = self._values.get("advanced_security_additional_flows")
+            return typing.cast(typing.Optional[typing.Union[_IResolvable_da3f097b, "CfnUserPool.AdvancedSecurityAdditionalFlowsProperty"]], result)
+
         @builtins.property
         def advanced_security_mode(self) -> typing.Optional[builtins.str]:
-            '''The operating mode of advanced security features in your user pool.
+            '''The operating mode of advanced security features for standard authentication types in your user pool, including username-password and secure remote password (SRP) authentication.
 
             :see: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cognito-userpool-userpooladdons.html#cfn-cognito-userpool-userpooladdons-advancedsecuritymode
             '''
@@ -6664,7 +6967,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__1b25b3f1d7835d1e1c5594b9c3dffd6b2c3b2773f547e55b57c8e0919e93a204)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolId", value)
+        jsii.set(self, "userPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="accessTokenValidity")
@@ -6677,7 +6980,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__9c22b177f80150859dd3fc0ec6040fd86d6718dde2ccbb4e6e2993f4f0179616)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "accessTokenValidity", value)
+        jsii.set(self, "accessTokenValidity", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="allowedOAuthFlows")
@@ -6693,7 +6996,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__a4e6becf32885d0d881b59d33ec61072e6d7812d751551a739cadf93d3754c73)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "allowedOAuthFlows", value)
+        jsii.set(self, "allowedOAuthFlows", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="allowedOAuthFlowsUserPoolClient")
@@ -6711,7 +7014,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__21873ac965a2fe0f5bdf6747b41efd7cf29a1e20f79888c68d664a70a929167f)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "allowedOAuthFlowsUserPoolClient", value)
+        jsii.set(self, "allowedOAuthFlowsUserPoolClient", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="allowedOAuthScopes")
@@ -6727,7 +7030,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__96cd6c659670b16fdec9188b6f46c9069df3c2c6e960eb82c804a6eee58c0676)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "allowedOAuthScopes", value)
+        jsii.set(self, "allowedOAuthScopes", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="analyticsConfiguration")
@@ -6745,7 +7048,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__20f4094b4b15bf8a99ce9e0a2bb559a164606de26b84fc2bb8855aa07e1b624b)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "analyticsConfiguration", value)
+        jsii.set(self, "analyticsConfiguration", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="authSessionValidity")
@@ -6758,7 +7061,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__c933dc37f47234e60d586123e1b18e9c28a667f37c5d5427aa85b4409376ea07)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "authSessionValidity", value)
+        jsii.set(self, "authSessionValidity", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="callbackUrLs")
@@ -6771,7 +7074,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__d014efcb2549aac6515f36258ccaf4ecec07ac09bca5d035df6559947c4ac2c1)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "callbackUrLs", value)
+        jsii.set(self, "callbackUrLs", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="clientName")
@@ -6784,7 +7087,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__0137f7e9c73233d74a2df7b39c8c4bb8d81b22d045b5741333e0b7f4cad603ba)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "clientName", value)
+        jsii.set(self, "clientName", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="defaultRedirectUri")
@@ -6797,7 +7100,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__dfdc028ae25dd39e3553917a9d4209340b6c920f4ae1efe20b0c2c400f79d71b)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "defaultRedirectUri", value)
+        jsii.set(self, "defaultRedirectUri", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="enablePropagateAdditionalUserContextData")
@@ -6815,7 +7118,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__1c6e219444196075c25c38bf5995f93c8a7cec9a53523c8ac01a848afffefd1c)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "enablePropagateAdditionalUserContextData", value)
+        jsii.set(self, "enablePropagateAdditionalUserContextData", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="enableTokenRevocation")
@@ -6836,7 +7139,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__fb0c7908c7db28417fc0f3140fa5d8ceb244c98f8aa1729c6e2945ed0e1c43cb)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "enableTokenRevocation", value)
+        jsii.set(self, "enableTokenRevocation", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="explicitAuthFlows")
@@ -6852,7 +7155,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__40565d8b2082bb82a66f2c2881526bbe7e4d5f0f2f08ba6dc2976e98f59f7c8f)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "explicitAuthFlows", value)
+        jsii.set(self, "explicitAuthFlows", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="generateSecret")
@@ -6870,7 +7173,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__957788b79d759b4d61639c557602d69d56690104c1f0aaa40f50729534e68c16)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "generateSecret", value)
+        jsii.set(self, "generateSecret", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="idTokenValidity")
@@ -6883,7 +7186,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__fc02869bb5973b6100efb5c37bedca5b74e381117419f1bac379398aaffc2d11)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "idTokenValidity", value)
+        jsii.set(self, "idTokenValidity", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="logoutUrLs")
@@ -6896,7 +7199,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__794ffdcf30a3962d0a3f7e5f05ddfd74a6fef4d201947dd6201c7a686f541188)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "logoutUrLs", value)
+        jsii.set(self, "logoutUrLs", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="preventUserExistenceErrors")
@@ -6912,7 +7215,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__69feb00103083800cef9fe6cb134d68a642b9492532f75a271736355bf5da06d)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "preventUserExistenceErrors", value)
+        jsii.set(self, "preventUserExistenceErrors", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="readAttributes")
@@ -6928,7 +7231,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__d0450b9a1c4091ecc8dc0197c1b8b862535cb1a705df2e839371c83db2f684ba)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "readAttributes", value)
+        jsii.set(self, "readAttributes", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="refreshTokenValidity")
@@ -6941,7 +7244,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__ffd4a00853573a9063ab6bfb4bd488904d41fa8453a02d33cc8b44f6638125c5)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "refreshTokenValidity", value)
+        jsii.set(self, "refreshTokenValidity", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="supportedIdentityProviders")
@@ -6959,7 +7262,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__97736930ca8413d8b00c7851c37dde3d55fed9ca3778ecbfeb14cf25389e28c8)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "supportedIdentityProviders", value)
+        jsii.set(self, "supportedIdentityProviders", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="tokenValidityUnits")
@@ -6977,7 +7280,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__dd54ee51ef07c33acd2cbd8e02b234784fa5a6a1c7879a29066514822e4147fb)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "tokenValidityUnits", value)
+        jsii.set(self, "tokenValidityUnits", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="writeAttributes")
@@ -6993,7 +7296,7 @@ class CfnUserPoolClient(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__d9ed7bc7a68b64df6709c00059cae06196e10a1a3cf55f0554b70dc90d3f9945)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "writeAttributes", value)
+        jsii.set(self, "writeAttributes", value) # pyright: ignore[reportArgumentType]
 
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnUserPoolClient.AnalyticsConfigurationProperty",
@@ -7867,7 +8170,7 @@ class CfnUserPoolDomain(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__60984af4b9f95693c974811dba163dc41c64348226be0621cde58067d75c2a75)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "domain", value)
+        jsii.set(self, "domain", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userPoolId")
@@ -7880,7 +8183,7 @@ class CfnUserPoolDomain(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__01784117c77cfebe2ef420bdb95cfa641714c4080a504ef08ebfbc5cb9e64418)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolId", value)
+        jsii.set(self, "userPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="customDomainConfig")
@@ -7898,7 +8201,7 @@ class CfnUserPoolDomain(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__534c4957c36eac9a89217ff1b762b65d25e33f26c5048218fc840dc7f7ee2b0e)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "customDomainConfig", value)
+        jsii.set(self, "customDomainConfig", value) # pyright: ignore[reportArgumentType]
 
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnUserPoolDomain.CustomDomainConfigTypeProperty",
@@ -8170,7 +8473,7 @@ class CfnUserPoolGroup(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__ca8402c546b7f090c567d019103e9d2674bfb6e4c199608669a4b2acc2afc5f3)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolId", value)
+        jsii.set(self, "userPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="description")
@@ -8183,7 +8486,7 @@ class CfnUserPoolGroup(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__7bda9e548a82a5206aec39e356f410d438353851dcd1f974bd59be186f5ff66a)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "description", value)
+        jsii.set(self, "description", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="groupName")
@@ -8196,7 +8499,7 @@ class CfnUserPoolGroup(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__50cee63463b0a00e9516a517c3ecba89edae39efb6890c70ea606f9e3cfca0bc)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "groupName", value)
+        jsii.set(self, "groupName", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="precedence")
@@ -8209,7 +8512,7 @@ class CfnUserPoolGroup(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__a1542aa260237dd220738bd8c2fdd54d12089e9f7ff0f7f70cd927c2f8d90da2)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "precedence", value)
+        jsii.set(self, "precedence", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="roleArn")
@@ -8222,7 +8525,7 @@ class CfnUserPoolGroup(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__3a22fc1c6f27de296195da5e404a5a9d43aea635361d630ed9185ab2d04e6ee2)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "roleArn", value)
+        jsii.set(self, "roleArn", value) # pyright: ignore[reportArgumentType]
 
 
 @jsii.data_type(
@@ -8483,7 +8786,7 @@ class CfnUserPoolIdentityProvider(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__03fef1ca3436f487bdb2ac4c72e914ca702f01a40d12470aaa64c77a0f7e15a2)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "providerName", value)
+        jsii.set(self, "providerName", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="providerType")
@@ -8496,7 +8799,7 @@ class CfnUserPoolIdentityProvider(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__1ee8fc97c7ce3a7223eabd6be18090c6fec027c8b81ecf420c175e278dafb535)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "providerType", value)
+        jsii.set(self, "providerType", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userPoolId")
@@ -8509,7 +8812,7 @@ class CfnUserPoolIdentityProvider(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__8f109ed40a77a3077cbab955821323c4293e2697420abd221b2032bb4abc2edb)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolId", value)
+        jsii.set(self, "userPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="attributeMapping")
@@ -8522,7 +8825,7 @@ class CfnUserPoolIdentityProvider(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__bb44cf93ad9714e2bf7765a12f95e3a12d5a4b89bee8d2de779a247dbd587039)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "attributeMapping", value)
+        jsii.set(self, "attributeMapping", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="idpIdentifiers")
@@ -8538,7 +8841,7 @@ class CfnUserPoolIdentityProvider(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__7662247fd2cd01f6776c3a84fedff308a45861e95cabe426cb256482aaeaead5)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "idpIdentifiers", value)
+        jsii.set(self, "idpIdentifiers", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="providerDetails")
@@ -8551,7 +8854,7 @@ class CfnUserPoolIdentityProvider(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__dd9b80463fd736be9b8b32bf8d2368b0c44578e3b056d45e068ca1e5fdfdb299)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "providerDetails", value)
+        jsii.set(self, "providerDetails", value) # pyright: ignore[reportArgumentType]
 
 
 @jsii.data_type(
@@ -8892,6 +9195,7 @@ class CfnUserPoolProps:
                 policies=cognito.CfnUserPool.PoliciesProperty(
                     password_policy=cognito.CfnUserPool.PasswordPolicyProperty(
                         minimum_length=123,
+                        password_history_size=123,
                         require_lowercase=False,
                         require_numbers=False,
                         require_symbols=False,
@@ -8929,6 +9233,9 @@ class CfnUserPoolProps:
                     case_sensitive=False
                 ),
                 user_pool_add_ons=cognito.CfnUserPool.UserPoolAddOnsProperty(
+                    advanced_security_additional_flows=cognito.CfnUserPool.AdvancedSecurityAdditionalFlowsProperty(
+                        custom_auth_mode="customAuthMode"
+                    ),
                     advanced_security_mode="advancedSecurityMode"
                 ),
                 user_pool_name="userPoolName",
@@ -9447,7 +9754,7 @@ class CfnUserPoolResourceServer(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__0784cedf1608a8758f1c44b7e3aacb96f3672ac970fc80673ae8a281382775da)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "identifier", value)
+        jsii.set(self, "identifier", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="name")
@@ -9460,7 +9767,7 @@ class CfnUserPoolResourceServer(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__091a350381e1228e09795024704316d40f0bce3ead6bff97b512b103b8bb1ee6)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "name", value)
+        jsii.set(self, "name", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userPoolId")
@@ -9473,7 +9780,7 @@ class CfnUserPoolResourceServer(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__050918e589a6f0ea5348f6c36799b16672c9d8127f2e78e25499ac0ee092b4fa)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolId", value)
+        jsii.set(self, "userPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="scopes")
@@ -9491,7 +9798,7 @@ class CfnUserPoolResourceServer(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__160fcb672d8fdc3b92b02edf7b6742270c60fcaadc1b0091d06e1413b15e3583)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "scopes", value)
+        jsii.set(self, "scopes", value) # pyright: ignore[reportArgumentType]
 
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnUserPoolResourceServer.ResourceServerScopeTypeProperty",
@@ -9852,7 +10159,7 @@ class CfnUserPoolRiskConfigurationAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__3a5b05e9407391c0557e201e4e58dfac89a06f57c4adc732162c79169e069fc0)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "clientId", value)
+        jsii.set(self, "clientId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userPoolId")
@@ -9865,7 +10172,7 @@ class CfnUserPoolRiskConfigurationAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__258e8ccdb5a39874f49d032edd3b21eafc55726e815291b2ba0aeb3d1e5e57f2)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolId", value)
+        jsii.set(self, "userPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="accountTakeoverRiskConfiguration")
@@ -9883,7 +10190,7 @@ class CfnUserPoolRiskConfigurationAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__b17909dd0638cbbc0f1921202089390881098b016d096fd0e7523987a4e30ba9)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "accountTakeoverRiskConfiguration", value)
+        jsii.set(self, "accountTakeoverRiskConfiguration", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="compromisedCredentialsRiskConfiguration")
@@ -9901,7 +10208,7 @@ class CfnUserPoolRiskConfigurationAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__114c02dca6d5bbc7b9068e92676886981e1fa4247a8584ed917e5391b74f2d2d)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "compromisedCredentialsRiskConfiguration", value)
+        jsii.set(self, "compromisedCredentialsRiskConfiguration", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="riskExceptionConfiguration")
@@ -9919,7 +10226,7 @@ class CfnUserPoolRiskConfigurationAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__2bce41f342258d692515e8eebb6c2745c7105edc270a2bbcfb45f41d2bf1ca46)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "riskExceptionConfiguration", value)
+        jsii.set(self, "riskExceptionConfiguration", value) # pyright: ignore[reportArgumentType]
 
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnUserPoolRiskConfigurationAttachment.AccountTakeoverActionTypeProperty",
@@ -10968,14 +11275,6 @@ class CfnUserPoolUICustomizationAttachment(
         '''The CloudFormation resource type name for this resource class.'''
         return typing.cast(builtins.str, jsii.sget(cls, "CFN_RESOURCE_TYPE_NAME"))
 
-    @builtins.property
-    @jsii.member(jsii_name="attrId")
-    def attr_id(self) -> builtins.str:
-        '''
-        :cloudformationAttribute: Id
-        '''
-        return typing.cast(builtins.str, jsii.get(self, "attrId"))
-
     @builtins.property
     @jsii.member(jsii_name="cfnProperties")
     def _cfn_properties(self) -> typing.Mapping[builtins.str, typing.Any]:
@@ -10992,7 +11291,7 @@ class CfnUserPoolUICustomizationAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__2fb840d14a15822261415d3d8b15b58403a1bf218216b5d0aba1826076c9cb03)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "clientId", value)
+        jsii.set(self, "clientId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userPoolId")
@@ -11005,7 +11304,7 @@ class CfnUserPoolUICustomizationAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__bc21fab90e665a827c26364efaa1568390b907cce17d5fc3f8621bfe65268d7b)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolId", value)
+        jsii.set(self, "userPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="css")
@@ -11018,7 +11317,7 @@ class CfnUserPoolUICustomizationAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__95fdebc4b645acafac0d58bca95a8d84ac0be5fcf3ca3d612ad578dbb3faa891)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "css", value)
+        jsii.set(self, "css", value) # pyright: ignore[reportArgumentType]
 
 
 @jsii.data_type(
@@ -11241,7 +11540,7 @@ class CfnUserPoolUser(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__feefc710cb336bda2be62c58dcbdfc764a535ab2e52aa19e44511aca0956258c)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolId", value)
+        jsii.set(self, "userPoolId", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="clientMetadata")
@@ -11259,7 +11558,7 @@ class CfnUserPoolUser(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__674b44537db9d65119536a886fe3b7990cd0df2f1aa1c3c2880711f8b302ae40)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "clientMetadata", value)
+        jsii.set(self, "clientMetadata", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="desiredDeliveryMediums")
@@ -11275,7 +11574,7 @@ class CfnUserPoolUser(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__91542a3b74c01d216df5ff651d130ee1327aa0fc3c895cbd605609cf901699ba)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "desiredDeliveryMediums", value)
+        jsii.set(self, "desiredDeliveryMediums", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="forceAliasCreation")
@@ -11293,7 +11592,7 @@ class CfnUserPoolUser(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__7c2c789fa64d9c856de89108f23fbf51d514f0cffa783771cfbacd552aee676c)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "forceAliasCreation", value)
+        jsii.set(self, "forceAliasCreation", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="messageAction")
@@ -11306,7 +11605,7 @@ class CfnUserPoolUser(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__9f0192dc3faa77898f91fb1e03cf55e5b740abf20bba3ba939ce4df47ae4227d)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "messageAction", value)
+        jsii.set(self, "messageAction", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userAttributes")
@@ -11324,7 +11623,7 @@ class CfnUserPoolUser(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__3a84d0d411d439647c27dc7ac7d1d6e760fe129e919aa8a0a8b4194179281b3e)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userAttributes", value)
+        jsii.set(self, "userAttributes", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="username")
@@ -11337,7 +11636,7 @@ class CfnUserPoolUser(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__942108c1e34b7c1e541ffb7d9f565c31400708ae6fa3757029d02956f7e7086d)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "username", value)
+        jsii.set(self, "username", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="validationData")
@@ -11355,7 +11654,7 @@ class CfnUserPoolUser(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__69a6ee7471fbb46c9acd4942399424982966d6d11c89f8748a188ab7f08e54be)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "validationData", value)
+        jsii.set(self, "validationData", value) # pyright: ignore[reportArgumentType]
 
     @jsii.data_type(
         jsii_type="aws-cdk-lib.aws_cognito.CfnUserPoolUser.AttributeTypeProperty",
@@ -11747,7 +12046,7 @@ class CfnUserPoolUserToGroupAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__76f277297f14c067592421ffe39f914d1d4341dd9bc83f4c42c66f73914f3488)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "groupName", value)
+        jsii.set(self, "groupName", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="username")
@@ -11759,7 +12058,7 @@ class CfnUserPoolUserToGroupAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__a387f868c25297921e89f6892a60def04748b83f31771d79ae06623bc4eb435b)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "username", value)
+        jsii.set(self, "username", value) # pyright: ignore[reportArgumentType]
 
     @builtins.property
     @jsii.member(jsii_name="userPoolId")
@@ -11772,7 +12071,7 @@ class CfnUserPoolUserToGroupAttachment(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__82177f095c7231924dc4eb6d3e0b1affc9151da04e151d35489d6ee497b571cc)
             check_type(argname="argument value", value=value, expected_type=type_hints["value"])
-        jsii.set(self, "userPoolId", value)
+        jsii.set(self, "userPoolId", value) # pyright: ignore[reportArgumentType]
 
 
 @jsii.data_type(
@@ -20896,6 +21195,7 @@ def _typecheckingstub__d5156c08d9bb3b0ceca6f4ec485d84f9775d7be40128a6614e1b9cbf0
     cognito_streams: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnIdentityPool.CognitoStreamsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     developer_provider_name: typing.Optional[builtins.str] = None,
     identity_pool_name: typing.Optional[builtins.str] = None,
+    identity_pool_tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     open_id_connect_provider_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
     push_sync: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnIdentityPool.PushSyncProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     saml_provider_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
@@ -20958,6 +21258,12 @@ def _typecheckingstub__6010d0ddbf0b577c8e7ea0796913ba4085881df0b32cec744c271c993
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__caf91efc577806bf48a176729ecabaf6b30c2d71ecfff869256e7500e4dcb9bc(
+    value: typing.Optional[typing.List[_CfnTag_f6864754]],
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__61d80fcbd99af6003aec5d0b96e0ec9abdb3d4f6e2f44f67bdd2e746351a3517(
     value: typing.Optional[typing.List[builtins.str]],
 ) -> None:
@@ -21075,6 +21381,7 @@ def _typecheckingstub__3f190bc45ca19526ebd4b37441370bac2bb0babaadb5489ad9375252a
     cognito_streams: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnIdentityPool.CognitoStreamsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     developer_provider_name: typing.Optional[builtins.str] = None,
     identity_pool_name: typing.Optional[builtins.str] = None,
+    identity_pool_tags: typing.Optional[typing.Sequence[typing.Union[_CfnTag_f6864754, typing.Dict[builtins.str, typing.Any]]]] = None,
     open_id_connect_provider_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
     push_sync: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnIdentityPool.PushSyncProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     saml_provider_arns: typing.Optional[typing.Sequence[builtins.str]] = None,
@@ -21201,11 +21508,27 @@ def _typecheckingstub__ff46bbb404bb2daaadf6da44499aa85e733a076298ca686e738f64972
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__ae072d70f2bbea287c140340ad4ca6d5b9e1b95bf2308803bfb1cfbd9e23e5e0(
+    *,
+    stream_arn: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__3fcaff05e87f499492c9c4ac6949463926f4833510675569310df4f8cb619149(
     *,
     cloud_watch_logs_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnLogDeliveryConfiguration.CloudWatchLogsConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     event_source: typing.Optional[builtins.str] = None,
+    firehose_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnLogDeliveryConfiguration.FirehoseConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     log_level: typing.Optional[builtins.str] = None,
+    s3_configuration: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnLogDeliveryConfiguration.S3ConfigurationProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
+def _typecheckingstub__35855407409f14c2401e604d3e25c83bb2d207f28090618c8174149befb93967(
+    *,
+    bucket_arn: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -21422,6 +21745,13 @@ def _typecheckingstub__eccc17237dcc735721e8ed9027a445ee9831366ce5b71c7ee0c61cc06
     """Type checking stubs"""
     pass
 
+def _typecheckingstub__13d285bc1be8956472b23e9b2a73954ac4f3700dcebec3973e7b6cbad4639935(
+    *,
+    custom_auth_mode: typing.Optional[builtins.str] = None,
+) -> None:
+    """Type checking stubs"""
+    pass
+
 def _typecheckingstub__820d7b1c7eb3367a1ba085ab349db46e7dfd21d8e9d99e1a78219dc6a2258553(
     *,
     lambda_arn: typing.Optional[builtins.str] = None,
@@ -21497,6 +21827,7 @@ def _typecheckingstub__fcd4fcf3db45f8dea604d1f3bcc70f5f37fb4061fc1c279ad00b155cc
 def _typecheckingstub__388245a445a407251a06f0f49f236a6b0a76ff7177f23a1d5cd9d4ffa819b2c0(
     *,
     minimum_length: typing.Optional[jsii.Number] = None,
+    password_history_size: typing.Optional[jsii.Number] = None,
     require_lowercase: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     require_numbers: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
     require_symbols: typing.Optional[typing.Union[builtins.bool, _IResolvable_da3f097b]] = None,
@@ -21568,6 +21899,7 @@ def _typecheckingstub__9c5843901d71c5f7088f0e7c239f7dbd10ae5d4810ba8341e48b29354
 
 def _typecheckingstub__134d2b8e9ae3077b4c1f940aca55cabaa1dcdc1e12d0cd06c074768ee425ce71(
     *,
+    advanced_security_additional_flows: typing.Optional[typing.Union[_IResolvable_da3f097b, typing.Union[CfnUserPool.AdvancedSecurityAdditionalFlowsProperty, typing.Dict[builtins.str, typing.Any]]]] = None,
     advanced_security_mode: typing.Optional[builtins.str] = None,
 ) -> None:
     """Type checking stubs"""