Actions, resources, and condition keys for Amazon Cognito User Pools

Amazon Cognito User Pools (service prefix: cognito-idp) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by Amazon Cognito User Pools

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AddCustomAttributes	Adds additional user attributes to the user pool schema.	Write	userpool*
AdminAddUserToGroup	Adds the specified user to the specified group.	Write	userpool*
AdminConfirmSignUp	Confirms user registration as an admin without using a confirmation code. Works on any user.	Write	userpool*
AdminCreateUser	Creates a new user in the specified user pool and sends a welcome message via email or phone (SMS).	Write	userpool*
AdminDeleteUser	Deletes a user as an administrator. Works on any user.	Write	userpool*
AdminDeleteUserAttributes	Deletes the user attributes in a user pool as an administrator. Works on any user.	Write	userpool*
AdminDisableProviderForUser	Disables the user from signing in with the specified external (SAML or social) identity provider.	Write	userpool*
AdminDisableUser	Disables the specified user as an administrator. Works on any user.	Write	userpool*
AdminEnableUser	Enables the specified user as an administrator. Works on any user.	Write	userpool*
AdminForgetDevice	Forgets the device, as an administrator.	Write	userpool*
AdminGetDevice	Gets the device, as an administrator.	Read	userpool*
AdminGetUser	Gets the specified user by user name in a user pool as an administrator. Works on any user.	Read	userpool*
AdminInitiateAuth	Authenticates a user in a user pool as an administrator. Works on any user.	Write	userpool*
AdminLinkProviderForUser	Links an existing user account in a user pool (DestinationUser) to an identity from an external identity provider (SourceUser) based on a specified attribute name and value from the external identity provider.	Write	userpool*
AdminListDevices	Lists devices, as an administrator.	List	userpool*
AdminListGroupsForUser	Lists the groups that the user belongs to.	List	userpool*
AdminListUserAuthEvents	Lists the authentication events for the user.	Read	userpool*
AdminRemoveUserFromGroup	Removes the specified user from the specified group.	Write	userpool*
AdminResetUserPassword	Resets the specified user's password in a user pool as an administrator. Works on any user.	Write	userpool*
AdminRespondToAuthChallenge	Responds to an authentication challenge, as an administrator.	Write	userpool*
AdminSetUserMFAPreference	Sets MFA preference for the user in the userpool	Write	userpool*
AdminSetUserPassword	Sets the specified user's password in a user pool as an administrator. Works on any user.	Write	userpool*
AdminSetUserSettings	Sets all the user settings for a specified user name. Works on any user.	Write	userpool*
AdminUpdateAuthEventFeedback	Updates the feedback for the user authentication event	Write	userpool*
AdminUpdateDeviceStatus	Updates the device status as an administrator.	Write	userpool*
AdminUpdateUserAttributes	Updates the specified user's attributes, including developer attributes, as an administrator.	Write	userpool*
AdminUserGlobalSignOut	Signs out users from all devices, as an administrator.	Write	userpool*
AssociateSoftwareToken	Returns a unique generated shared secret key code for the user account.	Write
ChangePassword	Changes the password for a specified user in a user pool.	Write
ConfirmDevice	Confirms tracking of the device. This API call is the call that begins device tracking.	Write
ConfirmForgotPassword	Allows a user to enter a confirmation code to reset a forgotten password.	Write
ConfirmSignUp	Confirms registration of a user and handles the existing alias from a previous user.	Write
CreateGroup	Creates a new group in the specified user pool.	Write	userpool*
CreateIdentityProvider	Creates an identity provider for a user pool.	Write	userpool*
CreateResourceServer	Creates a new OAuth2.0 resource server and defines custom scopes in it.	Write	userpool*
CreateUserImportJob	Creates the user import job.	Write	userpool*
CreateUserPool	Creates a new Amazon Cognito user pool and sets the password policy for the pool.	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateUserPoolClient	Creates the user pool client.	Write	userpool*
CreateUserPoolDomain	Creates a new domain for a user pool.	Write	userpool*
DeleteGroup	Deletes a group. Currently only groups with no members can be deleted.	Write	userpool*
DeleteIdentityProvider	Deletes an identity provider for a user pool.	Write	userpool*
DeleteResourceServer	Deletes a resource server.	Write	userpool*
DeleteUser	Allows a user to delete one's self.	Write
DeleteUserAttributes	Deletes the attributes for a user.	Write
DeleteUserPool	Deletes the specified Amazon Cognito user pool.	Write	userpool*
DeleteUserPoolClient	Allows the developer to delete the user pool client.	Write	userpool*
DeleteUserPoolDomain	Deletes a domain for a user pool.	Write	userpool*
DescribeIdentityProvider	Gets information about a specific identity provider.	Read	userpool*
DescribeResourceServer	Describes a resource server.	Read	userpool*
DescribeRiskConfiguration	Describes the risk configuration setting for the userpool / userpool client	Read	userpool*
DescribeUserImportJob	Describes the user import job.	Read	userpool*
DescribeUserPool	Returns the configuration information and metadata of the specified user pool.	Read	userpool*
DescribeUserPoolClient	Client method for returning the configuration information and metadata of the specified user pool client.	Read	userpool*
DescribeUserPoolDomain	Gets information about a domain.	Read
ForgetDevice	Forgets the specified device.	Write
ForgotPassword	Calling this API causes a message to be sent to the end user with a confirmation code that is required to change the user's password.	Write
GetCSVHeader	Gets the header information for the .csv file to be used as input for the user import job.	Read	userpool*
GetDevice	Gets the device.	Read
GetGroup	Gets a group.	Read	userpool*
GetIdentityProviderByIdentifier	Gets the specified identity provider.	Read	userpool*
GetSigningCertificate	Returns the signing certificate.	Read	userpool*
GetUICustomization	Gets the UI Customization information for a particular app client's app UI, if there is something set.	Read	userpool*
GetUser	Gets the user attributes and metadata for a user.	Read
GetUserAttributeVerificationCode	Gets the user attribute verification code for the specified attribute name.	Read
GetUserPoolMfaConfig	Gets the MFA configuration for the userpool	Read	userpool*
GlobalSignOut	Signs out users from all devices.	Write
InitiateAuth	Initiates the authentication flow.	Write
ListDevices	Lists the devices.	List
ListGroups	Lists the groups associated with a user pool.	List	userpool*
ListIdentityProviders	Lists information about all identity providers for a user pool.	List	userpool*
ListResourceServers	Lists the resource servers for a user pool.	List	userpool*
ListTagsForResource	Lists the tags that are assigned to an Amazon Cognito user pool.	List	userpool
ListUserImportJobs	Lists the user import jobs..	List	userpool*
ListUserPoolClients	Lists the clients that have been created for the specified user pool.	List	userpool*
ListUserPools	Lists the user pools associated with an AWS account.	List
ListUsers	Lists the users in the Amazon Cognito user pool.	List	userpool*
ListUsersInGroup	Lists the users in the specified group.	List	userpool*
ResendConfirmationCode	Resends the confirmation (for confirmation of registration) to a specific user in the user pool.	Write
RespondToAuthChallenge	Responds to the authentication challenge.	Write
SetRiskConfiguration	sets the risk configuration setting for the userpool / userpool client	Write	userpool*
SetUICustomization	Sets the UI customization information for a user pool's built-in app UI.	Write	userpool*
SetUserMFAPreference	Sets MFA preference for the user in the userpool	Write
SetUserPoolMfaConfig	Sets the MFA configuration for the userpool	Write	userpool*
SetUserSettings	Sets the user settings like multi-factor authentication (MFA).	Write
SignUp	Registers the user in the specified user pool and creates a user name, password, and user attributes.	Write
StartUserImportJob	Starts the user import.	Write	userpool*
StopUserImportJob	Stops the user import job.	Write	userpool*
TagResource	Assigns a set of tags to an Amazon Cognito user pool.	Tagging	userpool
				aws:RequestTag/${TagKey} aws:TagKeys
UntagResource	Removes the specified tags from an Amazon Cognito user pool.	Tagging	userpool
				aws:TagKeys
UpdateAuthEventFeedback	Updates the feedback for the user authentication event	Write	userpool*
UpdateDeviceStatus	Updates the device status.	Write
UpdateGroup	Updates the specified group with the specified attributes.	Write	userpool*
UpdateIdentityProvider	Updates identity provider information for a user pool.	Write	userpool*
UpdateResourceServer	Updates the name and scopes of resource server.	Write	userpool*
UpdateUserAttributes	Allows a user to update a specific attribute (one at a time).	Write
UpdateUserPool	Updates the specified user pool with the specified attributes.	Write	userpool*
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateUserPoolClient	Allows the developer to update the specified user pool client and password policy.	Write	userpool*
UpdateUserPoolDomain	Updates the Secure Sockets Layer (SSL) certificate for the custom domain for your user pool.	Write	userpool*
VerifySoftwareToken	Registers a user's entered TOTP code and mark the user's software token MFA status as verified if successful.	Write
VerifyUserAttribute	Verifies a user attribute using a one time verification code.	Write

Resource types defined by Amazon Cognito User Pools

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The resource types table.

Resource types	ARN	Condition keys
userpool	arn:${Partition}:cognito-idp:${Region}:${Account}:userpool/${UserPoolId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Cognito User Pools

Amazon Cognito User Pools defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the presence of tag key-value pairs in the request.	String
aws:ResourceTag/${TagKey}	Filters actions based on tag key-value pairs attached to the resource.	String
aws:TagKeys	Filters access by a key that is present in the request.	String