Actions, resources, and condition keys for Amazon Cognito User Pools

Amazon Cognito User Pools (service prefix: cognito-idp) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by Amazon Cognito User Pools

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AddCustomAttributes	Adds additional user attributes to the user pool schema	Write	userpool*
AdminAddUserToGroup	Adds the specified user to the specified group	Write	userpool*
AdminConfirmSignUp	Confirms user registration as an admin without using a confirmation code. Works on any user	Write	userpool*
AdminCreateUser	Creates a new user in the specified user pool and sends a welcome message via email or phone (SMS)	Write	userpool*
AdminDeleteUser	Deletes a user as an administrator. Works on any user	Write	userpool*
AdminDeleteUserAttributes	Deletes the user attributes in a user pool as an administrator. Works on any user	Write	userpool*
AdminDisableProviderForUser	Disables the user from signing in with the specified external (SAML or social) identity provider	Write	userpool*
AdminDisableUser	Disables the specified user as an administrator. Works on any user	Write	userpool*
AdminEnableUser	Enables the specified user as an administrator. Works on any user	Write	userpool*
AdminForgetDevice	Forgets the device, as an administrator	Write	userpool*
AdminGetDevice	Gets the device, as an administrator	Read	userpool*
AdminGetUser	Gets the specified user by user name in a user pool as an administrator. Works on any user	Read	userpool*
AdminInitiateAuth	Authenticates a user in a user pool as an administrator. Works on any user	Write	userpool*
AdminLinkProviderForUser	Links an existing user account in a user pool (DestinationUser) to an identity from an external identity provider (SourceUser) based on a specified attribute name and value from the external identity provider	Write	userpool*
AdminListDevices	Lists devices, as an administrator	List	userpool*
AdminListGroupsForUser	Lists the groups that the user belongs to	List	userpool*
AdminListUserAuthEvents	Lists the authentication events for the user	Read	userpool*
AdminRemoveUserFromGroup	Removes the specified user from the specified group	Write	userpool*
AdminResetUserPassword	Resets the specified user's password in a user pool as an administrator. Works on any user	Write	userpool*
AdminRespondToAuthChallenge	Responds to an authentication challenge, as an administrator	Write	userpool*
AdminSetUserMFAPreference	Sets MFA preference for the user in the userpool	Write	userpool*
AdminSetUserPassword	Sets the specified user's password in a user pool as an administrator. Works on any user	Write	userpool*
AdminSetUserSettings	Sets all the user settings for a specified user name. Works on any user	Write	userpool*
AdminUpdateAuthEventFeedback	Updates the feedback for the user authentication event	Write	userpool*
AdminUpdateDeviceStatus	Updates the device status as an administrator	Write	userpool*
AdminUpdateUserAttributes	Updates the specified user's attributes, including developer attributes, as an administrator	Write	userpool*
AdminUserGlobalSignOut	Signs out users from all devices, as an administrator	Write	userpool*
AssociateSoftwareToken	Returns a unique generated shared secret key code for the user account	Write
ChangePassword	Changes the password for a specified user in a user pool	Write
ConfirmDevice	Confirms tracking of the device. This API call is the call that begins device tracking	Write
ConfirmForgotPassword	Allows a user to enter a confirmation code to reset a forgotten password	Write
ConfirmSignUp	Confirms registration of a user and handles the existing alias from a previous user	Write
CreateGroup	Creates a new group in the specified user pool	Write	userpool*
CreateIdentityProvider	Creates an identity provider for a user pool	Write	userpool*
CreateResourceServer	Creates a new OAuth2.0 resource server and defines custom scopes in it	Write	userpool*
CreateUserImportJob	Creates the user import job	Write	userpool*
CreateUserPool	Creates a new Amazon Cognito user pool and sets the password policy for the pool	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateUserPoolClient	Creates the user pool client	Write	userpool*
CreateUserPoolDomain	Creates a new domain for a user pool	Write	userpool*
DeleteGroup	Deletes a group. Currently only groups with no members can be deleted	Write	userpool*
DeleteIdentityProvider	Deletes an identity provider for a user pool	Write	userpool*
DeleteResourceServer	Deletes a resource server	Write	userpool*
DeleteUser	Allows a user to delete one's self	Write
DeleteUserAttributes	Deletes the attributes for a user	Write
DeleteUserPool	Deletes the specified Amazon Cognito user pool	Write	userpool*
DeleteUserPoolClient	Allows the developer to delete the user pool client	Write	userpool*
DeleteUserPoolDomain	Deletes a domain for a user pool	Write	userpool*
DescribeIdentityProvider	Gets information about a specific identity provider	Read	userpool*
DescribeResourceServer	Describes a resource server	Read	userpool*
DescribeRiskConfiguration	Describes the risk configuration setting for the userpool / userpool client	Read	userpool*
DescribeUserImportJob	Describes the user import job	Read	userpool*
DescribeUserPool	Returns the configuration information and metadata of the specified user pool	Read	userpool*
DescribeUserPoolClient	Client method for returning the configuration information and metadata of the specified user pool client	Read	userpool*
DescribeUserPoolDomain	Gets information about a domain	Read
ForgetDevice	Forgets the specified device	Write
ForgotPassword	Calling this API causes a message to be sent to the end user with a confirmation code that is required to change the user's password	Write
GetCSVHeader	Gets the header information for the .csv file to be used as input for the user import job	Read	userpool*
GetDevice	Gets the device	Read
GetGroup	Gets a group	Read	userpool*
GetIdentityProviderByIdentifier	Gets the specified identity provider	Read	userpool*
GetSigningCertificate	Returns the signing certificate	Read	userpool*
GetUICustomization	Gets the UI Customization information for a particular app client's app UI, if there is something set	Read	userpool*
GetUser	Gets the user attributes and metadata for a user	Read
GetUserAttributeVerificationCode	Gets the user attribute verification code for the specified attribute name	Read
GetUserPoolMfaConfig	Gets the MFA configuration for the userpool	Read	userpool*
GlobalSignOut	Signs out users from all devices	Write
InitiateAuth	Initiates the authentication flow	Write
ListDevices	Lists the devices	List
ListGroups	Lists the groups associated with a user pool	List	userpool*
ListIdentityProviders	Lists information about all identity providers for a user pool	List	userpool*
ListResourceServers	Lists the resource servers for a user pool	List	userpool*
ListTagsForResource	Lists the tags that are assigned to an Amazon Cognito user pool	List	userpool
ListUserImportJobs	Lists the user import jobs	List	userpool*
ListUserPoolClients	Lists the clients that have been created for the specified user pool	List	userpool*
ListUserPools	Lists the user pools associated with an AWS account	List
ListUsers	Lists the users in the Amazon Cognito user pool	List	userpool*
ListUsersInGroup	Lists the users in the specified group	List	userpool*
ResendConfirmationCode	Resends the confirmation (for confirmation of registration) to a specific user in the user pool	Write
RespondToAuthChallenge	Responds to the authentication challenge	Write
RevokeToken	Revokes all of the access tokens generated by the specified refresh token	Write
SetRiskConfiguration	sets the risk configuration setting for the userpool / userpool client	Write	userpool*
SetUICustomization	Sets the UI customization information for a user pool's built-in app UI	Write	userpool*
SetUserMFAPreference	Sets MFA preference for the user in the userpool	Write
SetUserPoolMfaConfig	Sets the MFA configuration for the userpool	Write	userpool*
SetUserSettings	Sets the user settings like multi-factor authentication (MFA)	Write
SignUp	Registers the user in the specified user pool and creates a user name, password, and user attributes	Write
StartUserImportJob	Starts the user import	Write	userpool*
StopUserImportJob	Stops the user import job	Write	userpool*
TagResource	Assigns a set of tags to an Amazon Cognito user pool	Tagging	userpool
				aws:RequestTag/${TagKey} aws:TagKeys
UntagResource	Removes the specified tags from an Amazon Cognito user pool	Tagging	userpool
				aws:TagKeys
UpdateAuthEventFeedback	Updates the feedback for the user authentication event	Write	userpool*
UpdateDeviceStatus	Updates the device status	Write
UpdateGroup	Updates the specified group with the specified attributes	Write	userpool*
UpdateIdentityProvider	Updates identity provider information for a user pool	Write	userpool*
UpdateResourceServer	Updates the name and scopes of resource server	Write	userpool*
UpdateUserAttributes	Allows a user to update a specific attribute (one at a time)	Write
UpdateUserPool	Updates the specified user pool with the specified attributes	Write	userpool*
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateUserPoolClient	Allows the developer to update the specified user pool client and password policy	Write	userpool*
UpdateUserPoolDomain	Updates the Secure Sockets Layer (SSL) certificate for the custom domain for your user pool	Write	userpool*
VerifySoftwareToken	Registers a user's entered TOTP code and mark the user's software token MFA status as verified if successful	Write
VerifyUserAttribute	Verifies a user attribute using a one time verification code	Write

Resource types defined by Amazon Cognito User Pools

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
userpool	arn:${Partition}:cognito-idp:${Region}:${Account}:userpool/${UserPoolId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Cognito User Pools

Amazon Cognito User Pools defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters actions based on tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by a key that is present in the request	ArrayOfString