AmazonCognitoIdpServiceRolePolicy version history

Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions. 1 change is recorded.Back to AmazonCognitoIdpServiceRolePolicy.

v1 to v2

Detected 2026-11-13; AWS edit time of v2 2026-11-10T19:27:00Z. 8 added, 0 removed.

Actions added (8)

secretsmanager:DeleteSecret
secretsmanager:DescribeSecret
secretsmanager:PutSecretValue
secretsmanager:RemoveRegionsFromReplication
secretsmanager:ReplicateSecretToRegions
secretsmanager:RestoreSecret
secretsmanager:RotateSecret
secretsmanager:UpdateSecretVersionStage

Document diff

--- v1
+++ v2
@@ -7,6 +7,29 @@
         "cognito-idp:Describe*"
       ],
       "Resource": "*"
+    },
+    {
+      "Sid": "SecretsManagerSecret",
+      "Effect": "Allow",
+      "Action": [
+        "secretsmanager:DeleteSecret",
+        "secretsmanager:RestoreSecret",
+        "secretsmanager:DescribeSecret",
+        "secretsmanager:PutSecretValue",
+        "secretsmanager:UpdateSecretVersionStage",
+        "secretsmanager:RotateSecret",
+        "secretsmanager:ReplicateSecretToRegions",
+        "secretsmanager:RemoveRegionsFromReplication"
+      ],
+      "Resource": [
+        "arn:aws:secretsmanager:*:*:secret:cognito-idp!*"
+      ],
+      "Condition": {
+        "StringEquals": {
+          "secretsmanager:ResourceTag/aws:secretsmanager:owningService": "cognito-idp",
+          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+        }
+      }
     }
   ]
 }