Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Cognito User Pools

Amazon Cognito User Pools (service prefix: cognito-idp) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Cognito User Pools
Actions defined by Amazon Cognito User Pools
Permission-only actions for Amazon Cognito User Pools
Resource types defined by Amazon Cognito User Pools
Condition keys for Amazon Cognito User Pools

API operations defined by Amazon Cognito User Pools

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AddCustomAttributes	cognito-idp:AddCustomAttributes	Write
AddUserPoolClientSecret	cognito-idp:AddUserPoolClientSecret	Write
AdminAddUserToGroup	cognito-idp:AdminAddUserToGroup	Write
AdminConfirmSignUp	cognito-idp:AdminConfirmSignUp	Write
AdminCreateUser	cognito-idp:AdminCreateUser	Write
AdminDeleteUser	cognito-idp:AdminDeleteUser	Write
AdminDeleteUserAttributes	cognito-idp:AdminDeleteUserAttributes	Write
AdminDisableProviderForUser	cognito-idp:AdminDisableProviderForUser	Write
AdminDisableUser	cognito-idp:AdminDisableUser	Write
AdminEnableUser	cognito-idp:AdminEnableUser	Write
AdminForgetDevice	cognito-idp:AdminForgetDevice	Write
AdminGetDevice	cognito-idp:AdminGetDevice	Read
AdminGetUser	cognito-idp:AdminGetUser	Read
AdminInitiateAuth	cognito-idp:AdminInitiateAuth	Write
AdminLinkProviderForUser	cognito-idp:AdminLinkProviderForUser	Write
AdminListDevices	cognito-idp:AdminListDevices	List
AdminListGroupsForUser	cognito-idp:AdminListGroupsForUser	List
AdminListUserAuthEvents	cognito-idp:AdminListUserAuthEvents	Read
AdminRemoveUserFromGroup	cognito-idp:AdminRemoveUserFromGroup	Write
AdminResetUserPassword	cognito-idp:AdminResetUserPassword	Write
AdminRespondToAuthChallenge	cognito-idp:AdminRespondToAuthChallenge	Write
AdminSetUserMFAPreference	cognito-idp:AdminSetUserMFAPreference	Write
AdminSetUserPassword	cognito-idp:AdminSetUserPassword	Write
AdminSetUserSettings	cognito-idp:AdminSetUserSettings	Write
AdminUpdateAuthEventFeedback	cognito-idp:AdminUpdateAuthEventFeedback	Write
AdminUpdateDeviceStatus	cognito-idp:AdminUpdateDeviceStatus	Write
AdminUpdateUserAttributes	cognito-idp:AdminUpdateUserAttributes	Write
AdminUserGlobalSignOut	cognito-idp:AdminUserGlobalSignOut	Write
AssociateSoftwareToken	cognito-idp:AssociateSoftwareToken	Write
ChangePassword	cognito-idp:ChangePassword	Write
ConfirmDevice	cognito-idp:ConfirmDevice	Write
ConfirmForgotPassword	cognito-idp:ConfirmForgotPassword	Write
ConfirmSignUp	cognito-idp:ConfirmSignUp	Write
CreateGroup	cognito-idp:CreateGroup	Write
CreateGroup	iam:PassRole	Write
CreateIdentityProvider	cognito-idp:CreateIdentityProvider	Write
CreateManagedLoginBranding	cognito-idp:CreateManagedLoginBranding	Write
CreateResourceServer	cognito-idp:CreateResourceServer	Write
CreateTerms	cognito-idp:CreateTerms	Write
CreateUserImportJob	cognito-idp:CreateUserImportJob	Write
CreateUserImportJob	iam:PassRole	Write
CreateUserPool	cognito-idp:CreateUserPool	Write
	cognito-idp:TagResource	Tagging, Write
	iam:PassRole	Write
CreateUserPoolClient	cognito-idp:CreateUserPoolClient	Write
CreateUserPoolClient	iam:PassRole	Write
CreateUserPoolDomain	cognito-idp:CreateUserPoolDomain	Write
CreateUserPoolReplica	cognito-idp:CreateUserPoolReplica	Write
DeleteGroup	cognito-idp:DeleteGroup	Write
DeleteIdentityProvider	cognito-idp:DeleteIdentityProvider	Write
DeleteManagedLoginBranding	cognito-idp:DeleteManagedLoginBranding	Write
DeleteResourceServer	cognito-idp:DeleteResourceServer	Write
DeleteTerms	cognito-idp:DeleteTerms	Write
DeleteUser	cognito-idp:DeleteUser	Write
DeleteUserAttributes	cognito-idp:DeleteUserAttributes	Write
DeleteUserPool	cognito-idp:DeleteUserPool	Write
DeleteUserPoolClient	cognito-idp:DeleteUserPoolClient	Write
DeleteUserPoolClientSecret	cognito-idp:DeleteUserPoolClientSecret	Write
DeleteUserPoolDomain	cognito-idp:DeleteUserPoolDomain	Write
DeleteUserPoolReplica	cognito-idp:DeleteUserPoolReplica	Write
DescribeIdentityProvider	cognito-idp:DescribeIdentityProvider	Read
DescribeManagedLoginBranding	cognito-idp:DescribeManagedLoginBranding	Read
DescribeManagedLoginBrandingByClient	cognito-idp:DescribeManagedLoginBrandingByClient	Read
DescribeResourceServer	cognito-idp:DescribeResourceServer	Read
DescribeRiskConfiguration	cognito-idp:DescribeRiskConfiguration	Read
DescribeTerms	cognito-idp:DescribeTerms	Read
DescribeUserImportJob	cognito-idp:DescribeUserImportJob	Read
DescribeUserPool	cognito-idp:DescribeUserPool	Read
DescribeUserPoolClient	cognito-idp:DescribeUserPoolClient	Read
DescribeUserPoolDomain	cognito-idp:DescribeUserPoolDomain	Read
ForgetDevice	cognito-idp:ForgetDevice	Write
ForgotPassword	cognito-idp:ForgotPassword	Write
GetCSVHeader	cognito-idp:GetCSVHeader	Read
GetDevice	cognito-idp:GetDevice	Read
GetGroup	cognito-idp:GetGroup	Read
GetIdentityProviderByIdentifier	cognito-idp:GetIdentityProviderByIdentifier	Read
GetLogDeliveryConfiguration	cognito-idp:GetLogDeliveryConfiguration	Read
GetProvisionedLimit	cognito-idp:GetProvisionedLimit	Read
GetSigningCertificate	cognito-idp:GetSigningCertificate	Read
GetTokensFromRefreshToken	cognito-idp:GetTokensFromRefreshToken	Write
GetUICustomization	cognito-idp:GetUICustomization	Read
GetUser	cognito-idp:GetUser	Read
GetUserAttributeVerificationCode	cognito-idp:GetUserAttributeVerificationCode	Read
GetUserPoolMfaConfig	cognito-idp:GetUserPoolMfaConfig	Read
GlobalSignOut	cognito-idp:GlobalSignOut	Write
InitiateAuth	cognito-idp:InitiateAuth	Write
ListDevices	cognito-idp:ListDevices	List
ListGroups	cognito-idp:ListGroups	List
ListIdentityProviders	cognito-idp:ListIdentityProviders	List
ListResourceServers	cognito-idp:ListResourceServers	List
ListTagsForResource	cognito-idp:ListTagsForResource	List
ListTerms	cognito-idp:ListTerms	List
ListUserImportJobs	cognito-idp:ListUserImportJobs	List
ListUserPoolClientSecrets	cognito-idp:ListUserPoolClientSecrets	List
ListUserPoolClients	cognito-idp:ListUserPoolClients	List
ListUserPoolReplicas	cognito-idp:ListUserPoolReplicas	List
ListUserPools	cognito-idp:ListUserPools	List
ListUsers	cognito-idp:ListUsers	List
ListUsersInGroup	cognito-idp:ListUsersInGroup	List
ResendConfirmationCode	cognito-idp:ResendConfirmationCode	Write
RespondToAuthChallenge	cognito-idp:RespondToAuthChallenge	Write
RevokeToken	cognito-idp:RevokeToken	Write
SetLogDeliveryConfiguration	cognito-idp:SetLogDeliveryConfiguration	Write
SetRiskConfiguration	cognito-idp:SetRiskConfiguration	Write
SetUICustomization	cognito-idp:SetUICustomization	Write
SetUserMFAPreference	cognito-idp:SetUserMFAPreference	Write
SetUserPoolMfaConfig	cognito-idp:SetUserPoolMfaConfig	Write
SetUserPoolMfaConfig	iam:PassRole	Write
SetUserSettings	cognito-idp:SetUserSettings	Write
SignUp	cognito-idp:SignUp	Write
StartUserImportJob	cognito-idp:StartUserImportJob	Write
StopUserImportJob	cognito-idp:StopUserImportJob	Write
TagResource	cognito-idp:TagResource	Tagging, Write
UntagResource	cognito-idp:UntagResource	Tagging, Write
UpdateAuthEventFeedback	cognito-idp:UpdateAuthEventFeedback	Write
UpdateDeviceStatus	cognito-idp:UpdateDeviceStatus	Write
UpdateGroup	cognito-idp:UpdateGroup	Write
UpdateGroup	iam:PassRole	Write
UpdateIdentityProvider	cognito-idp:UpdateIdentityProvider	Write
UpdateManagedLoginBranding	cognito-idp:UpdateManagedLoginBranding	Write
UpdateProvisionedLimit	cognito-idp:UpdateProvisionedLimit	Write
UpdateResourceServer	cognito-idp:UpdateResourceServer	Write
UpdateTerms	cognito-idp:UpdateTerms	Write
UpdateUserAttributes	cognito-idp:UpdateUserAttributes	Write
UpdateUserPool	cognito-idp:TagResource	Tagging, Write
	cognito-idp:UntagResource	Tagging, Write
	cognito-idp:UpdateUserPool	Write
	iam:PassRole	Write
UpdateUserPoolClient	cognito-idp:UpdateUserPoolClient	Write
UpdateUserPoolClient	iam:PassRole	Write
UpdateUserPoolDomain	cognito-idp:UpdateUserPoolDomain	Write
UpdateUserPoolReplica	cognito-idp:UpdateUserPoolReplica	Write
VerifySoftwareToken	cognito-idp:VerifySoftwareToken	Write
VerifyUserAttribute	cognito-idp:VerifyUserAttribute	Write

Actions defined by Amazon Cognito User Pools

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddCustomAttributes	Grants permission to add user attributes to the user pool schema	userpool*	aws:ResourceTag/${TagKey}	Write
AddUserPoolClientSecret	Grants permission to add a new secret to a confidential client	userpool*	aws:ResourceTag/${TagKey}	Write
AdminAddUserToGroup	Grants permission to add any user to any group	userpool*	aws:ResourceTag/${TagKey}	Write
AdminConfirmSignUp	Grants permission to confirm any user's registration without a confirmation code	userpool*	aws:ResourceTag/${TagKey}	Write
AdminCreateUser	Grants permission to create new users and send welcome messages via email or SMS	userpool*	aws:ResourceTag/${TagKey}	Write
AdminDeleteUser	Grants permission to delete any user	userpool*	aws:ResourceTag/${TagKey}	Write
AdminDeleteUserAttributes	Grants permission to delete attributes from any user	userpool*	aws:ResourceTag/${TagKey}	Write
AdminDisableProviderForUser	Grants permission to unlink any user pool user from a third-party identity provider (IdP) user	userpool*	aws:ResourceTag/${TagKey}	Write
AdminDisableUser	Grants permission to deactivate any user	userpool*	aws:ResourceTag/${TagKey}	Write
AdminEnableUser	Grants permission to activate any user	userpool*	aws:ResourceTag/${TagKey}	Write
AdminForgetDevice	Grants permission to deregister any user's devices	userpool*	aws:ResourceTag/${TagKey}	Write
AdminGetDevice	Grants permission to get information about any user's devices	userpool*	aws:ResourceTag/${TagKey}	Read
AdminGetUser	Grants permission to look up any user by user name	userpool*	aws:ResourceTag/${TagKey}	Read
AdminInitiateAuth	Grants permission to authenticate any user	userpool*	aws:ResourceTag/${TagKey}	Write
AdminLinkProviderForUser	Grants permission to link any user pool user to a third-party IdP user	userpool*	aws:ResourceTag/${TagKey}	Write
AdminListDevices	Grants permission to list any user's remembered devices	userpool*	aws:ResourceTag/${TagKey}	List
AdminListGroupsForUser	Grants permission to list the groups that any user belongs to	userpool*	aws:ResourceTag/${TagKey}	List
AdminListUserAuthEvents	Grants permission to lists sign-in events for any user	userpool*	aws:ResourceTag/${TagKey}	Read
AdminRemoveUserFromGroup	Grants permission to remove any user from any group	userpool*	aws:ResourceTag/${TagKey}	Write
AdminResetUserPassword	Grants permission to reset any user's password	userpool*	aws:ResourceTag/${TagKey}	Write
AdminRespondToAuthChallenge	Grants permission to respond to an authentication challenge during the authentication of any user	userpool*	aws:ResourceTag/${TagKey}	Write
AdminSetUserMFAPreference	Grants permission to set any user's preferred MFA method	userpool*	aws:ResourceTag/${TagKey}	Write
AdminSetUserPassword	Grants permission to set any user's password	userpool*	aws:ResourceTag/${TagKey}	Write
AdminSetUserSettings	Grants permission to set user settings for any user	userpool*	aws:ResourceTag/${TagKey}	Write
AdminUpdateAuthEventFeedback	Grants permission to update advanced security feedback for any user's authentication event	userpool*	aws:ResourceTag/${TagKey}	Write
AdminUpdateDeviceStatus	Grants permission to update the status of any user's remembered devices	userpool*	aws:ResourceTag/${TagKey}	Write
AdminUpdateUserAttributes	Grants permission to updates any user's standard or custom attributes	userpool*	aws:ResourceTag/${TagKey}	Write
AdminUserGlobalSignOut	Grants permission to sign out any user from all sessions	userpool*	aws:ResourceTag/${TagKey}	Write
AssociateSoftwareToken	Grants permission to return a unique generated shared secret key code for the user			Write
ChangePassword	Grants permission to change the password for a specified user in a user pool			Write
ConfirmDevice	Grants permission to confirm tracking of the device. This API call is the call that begins device tracking			Write
ConfirmForgotPassword	Grants permission to allow a user to enter a confirmation code to reset a forgotten password			Write
ConfirmSignUp	Grants permission to confirm registration of a user and handles the existing alias from a previous user			Write
CreateGroup	Grants permission to create new user pool groups	userpool*	aws:ResourceTag/${TagKey}	Write
CreateIdentityProvider	Grants permission to add identity providers to user pools	userpool*	aws:ResourceTag/${TagKey}	Write
CreateManagedLoginBranding	Grants permission to create a branding settings for managed login and associate it with an app client	userpool*	aws:ResourceTag/${TagKey}	Write
CreateResourceServer	Grants permission to create and configure scopes for OAuth 2.0 resource servers	userpool*	aws:ResourceTag/${TagKey}	Write
CreateTerms	Grants permission to create terms and associate it with an app client	userpool*	aws:ResourceTag/${TagKey}	Write
CreateUserImportJob	Grants permission to create user CSV import jobs	userpool*	aws:ResourceTag/${TagKey}	Write
CreateUserPool	Grants permission to create and set password policy for user pools		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateUserPoolClient	Grants permission to create user pool app clients	userpool*	aws:ResourceTag/${TagKey}	Write
CreateUserPoolDomain	Grants permission to add user pool domains	userpool*	aws:ResourceTag/${TagKey}	Write
CreateUserPoolReplica	Grants permission to create a replica of a user pool	userpool*	aws:ResourceTag/${TagKey}	Write
DeleteGroup	Grants permission to delete any empty user pool group	userpool*	aws:ResourceTag/${TagKey}	Write
DeleteIdentityProvider	Grants permission to delete any identity provider from user pools	userpool*	aws:ResourceTag/${TagKey}	Write
DeleteManagedLoginBranding	Grants permission to delete the managed login branding style for any app client	userpool*	aws:ResourceTag/${TagKey}	Write
DeleteResourceServer	Grants permission to delete any OAuth 2.0 resource server from user pools	userpool*	aws:ResourceTag/${TagKey}	Write
DeleteTerms	Grants permission to delete terms for an app client	userpool*	aws:ResourceTag/${TagKey}	Write
DeleteUser	Grants permission to allow a user to delete one's self			Write
DeleteUserAttributes	Grants permission to delete the attributes for a user			Write
DeleteUserPool	Grants permission to delete user pools	userpool*	aws:ResourceTag/${TagKey}	Write
DeleteUserPoolClient	Grants permission to delete any user pool app client	userpool*	aws:ResourceTag/${TagKey}	Write
DeleteUserPoolClientSecret	Grants permission to delete a secret from a list of secrets associated with a client	userpool*	aws:ResourceTag/${TagKey}	Write
DeleteUserPoolDomain	Grants permission to delete any user pool domain	userpool*	aws:ResourceTag/${TagKey}	Write
DeleteUserPoolReplica	Grants permission to delete a replica of a user pool	userpool*	aws:ResourceTag/${TagKey}	Write
DescribeIdentityProvider	Grants permission to describe any user pool identity provider	userpool*	aws:ResourceTag/${TagKey}	Read
DescribeManagedLoginBranding	Grants permission to get the detailed information about the branding style of managed login	userpool*	aws:ResourceTag/${TagKey}	Read
DescribeManagedLoginBrandingByClient	Grants permission to get the detailed information about the branding style of managed login associated with an appclient	userpool*	aws:ResourceTag/${TagKey}	Read
DescribeResourceServer	Grants permission to describe any OAuth 2.0 resource server	userpool*	aws:ResourceTag/${TagKey}	Read
DescribeRiskConfiguration	Grants permission to describe the risk configuration settings of user pools and app clients	userpool*	aws:ResourceTag/${TagKey}	Read
DescribeTerms	Grants permission to get the detailed information about terms for an app client	userpool*	aws:ResourceTag/${TagKey}	Read
DescribeUserImportJob	Grants permission to describe any user import job	userpool*	aws:ResourceTag/${TagKey}	Read
DescribeUserPool	Grants permission to describe user pools	userpool*	aws:ResourceTag/${TagKey}	Read
DescribeUserPoolClient	Grants permission to describe any user pool app client	userpool*	aws:ResourceTag/${TagKey}	Read
DescribeUserPoolDomain	Grants permission to describe any user pool domain			Read
ForgetDevice	Grants permission to forget the specified device			Write
ForgotPassword	Grants permission to send a message to the end user with a confirmation code that is required to change the user's password			Write
GetCSVHeader	Grants permission to generate headers for a user import .csv file	userpool*	aws:ResourceTag/${TagKey}	Read
GetDevice	Grants permission to get the device			Read
GetGroup	Grants permission to describe a user pool group	userpool*	aws:ResourceTag/${TagKey}	Read
GetIdentityProviderByIdentifier	Grants permission to correlate a user pool IdP identifier to the IdP Name	userpool*	aws:ResourceTag/${TagKey}	Read
GetLogDeliveryConfiguration	Grants permission to get the detailed activity logging configuration for a user pool	userpool*	aws:ResourceTag/${TagKey}	Read
GetProvisionedLimit	Grants permission to get a provisioned limit for the AWS account			Read
GetSigningCertificate	Grants permission to look up signing certificates for user pools	userpool*	aws:ResourceTag/${TagKey}	Read
GetTokensFromRefreshToken	Grants permission to update user tokens with refresh tokens			Write
GetUICustomization	Grants permission to get UI customization information for the hosted UI of any app client	userpool*	aws:ResourceTag/${TagKey}	Read
GetUser	Grants permission to get the user attributes and metadata for a user			Read
GetUserAttributeVerificationCode	Grants permission to get the user attribute verification code for the specified attribute name			Read
GetUserPoolMfaConfig	Grants permission to look up the MFA configuration of user pools	userpool*	aws:ResourceTag/${TagKey}	Read
GlobalSignOut	Grants permission to sign out users from all devices			Write
InitiateAuth	Grants permission to initiate the authentication flow			Write
ListDevices	Grants permission to list the devices			List
ListGroups	Grants permission to list all groups in user pools	userpool*	aws:ResourceTag/${TagKey}	List
ListIdentityProviders	Grants permission to list all identity providers in user pools	userpool*	aws:ResourceTag/${TagKey}	List
ListResourceServers	Grants permission to list all resource servers in user pools	userpool*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list the tags that are assigned to an Amazon Cognito user pool	userpool	aws:ResourceTag/${TagKey}	List
ListTerms	Grants permission to list all terms for a user pool	userpool*	aws:ResourceTag/${TagKey}	List
ListUserImportJobs	Grants permission to list all user import jobs	userpool*	aws:ResourceTag/${TagKey}	List
ListUserPoolClientSecrets	Grants permission to list all secrets associated with a client	userpool*	aws:ResourceTag/${TagKey}	List
ListUserPoolClients	Grants permission to list all app clients in user pools	userpool*	aws:ResourceTag/${TagKey}	List
ListUserPoolReplicas	Grants permission to list replicas of a user pool	userpool*	aws:ResourceTag/${TagKey}	List
ListUserPools	Grants permission to list all user pools			List
ListUsers	Grants permission to list all user pool users	userpool*	aws:ResourceTag/${TagKey}	List
ListUsersInGroup	Grants permission to list the users in any group	userpool*	aws:ResourceTag/${TagKey}	List
ResendConfirmationCode	Grants permission to resend the confirmation (for confirmation of registration) to a specific user in the user pool			Write
RespondToAuthChallenge	Grants permission to respond to the authentication challenge			Write
RevokeToken	Grants permission to revoke all of the access tokens generated by the specified refresh token			Write
SetLogDeliveryConfiguration	Grants permission to set up or modify the detailed activity logging configuration of a user pool	userpool*	aws:ResourceTag/${TagKey}	Write
SetRiskConfiguration	Grants permission to set risk configuration for user pools and app clients	userpool*	aws:ResourceTag/${TagKey}	Write
SetUICustomization	Grants permission to customize the hosted UI for any app client	userpool*	aws:ResourceTag/${TagKey}	Write
SetUserMFAPreference	Grants permission to set MFA preference for the user in the userpool			Write
SetUserPoolMfaConfig	Grants permission to set user pool MFA configuration	userpool*	aws:ResourceTag/${TagKey}	Write
SetUserSettings	Grants permission to set the user settings like multi-factor authentication (MFA)			Write
SignUp	Grants permission to register the user in the specified user pool and creates a user name, password, and user attributes			Write
StartUserImportJob	Grants permission to start any user import job	userpool*	aws:ResourceTag/${TagKey}	Write
StopUserImportJob	Grants permission to stop any user import job	userpool*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a user pool	userpool	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to untag a user pool	userpool	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateAuthEventFeedback	Grants permission to update the feedback for the user authentication event	userpool*	aws:ResourceTag/${TagKey}	Write
UpdateDeviceStatus	Grants permission to update the device status			Write
UpdateGroup	Grants permission to update the configuration of any group	userpool*	aws:ResourceTag/${TagKey}	Write
UpdateIdentityProvider	Grants permission to update the configuration of any user pool IdP	userpool*	aws:ResourceTag/${TagKey}	Write
UpdateManagedLoginBranding	Grants permission to update the branding settings of a managed login	userpool*	aws:ResourceTag/${TagKey}	Write
UpdateProvisionedLimit	Grants permission to update a provisioned limit for the AWS account			Write
UpdateResourceServer	Grants permission to update the configuration of any OAuth 2.0 resource server	userpool*	aws:ResourceTag/${TagKey}	Write
UpdateTerms	Grants permission to update terms for an app client	userpool*	aws:ResourceTag/${TagKey}	Write
UpdateUserAttributes	Grants permission to allow a user to update a specific attribute (one at a time)			Write
UpdateUserPool	Grants permission to updates the configuration of user pools	userpool*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateUserPoolClient	Grants permission to update any user pool client	userpool*	aws:ResourceTag/${TagKey}	Write
UpdateUserPoolDomain	Grants permission to replace the certificate for any custom domain	userpool*	aws:ResourceTag/${TagKey}	Write
UpdateUserPoolReplica	Grants permission to update a replica of a user pool	userpool*	aws:ResourceTag/${TagKey}	Write
VerifySoftwareToken	Grants permission to register a user's entered TOTP code and mark the user's software token MFA status as verified if successful			Write
VerifyUserAttribute	Grants permission to verify a user attribute using a one time verification code			Write

Permission-only actions for Amazon Cognito User Pools

The following actions are defined by Amazon Cognito User Pools but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateWebACL	Grants permission to associate the user pool with an AWS WAF web ACL	userpool*	aws:ResourceTag/${TagKey}	Write
AssociateWebACL		webacl*		Write
DisassociateWebACL	Grants permission to disassociate the user pool with an AWS WAF web ACL	userpool*	aws:ResourceTag/${TagKey}	Write
GetWebACLForResource	Grants permission to get the AWS WAF web ACL that is associated with an Amazon Cognito user pool	userpool*	aws:ResourceTag/${TagKey}	Read
ListResourcesForWebACL	Grants permission to list the user pools that are associated with an AWS WAF web ACL	webacl*		List

Resource types defined by Amazon Cognito User Pools

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
userpool	arn:${Partition}:cognito-idp:${Region}:${Account}:userpool/${UserPoolId}	aws:ResourceTag/${TagKey}
webacl	arn:${Partition}:wafv2:${Region}:${Account}:${Scope}/webacl/${Name}/${Id}

Condition keys for Amazon Cognito User Pools

Amazon Cognito User Pools defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by a key that is present in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Cognito Sync (cognito-sync)

Amazon Comprehend (comprehend)