Cognito User Pools
Prefix cognito-idp, 139 actions · Domain Security, Identity & Compliance
5 AWS managed policies. 0 have reviewed guidance; the rest have authoritative permission data pending editorial review. 1 are service-linked role policies, shown with permission data only.
User access (1)
Operator and limited (3)
- AmazonCognitoReadOnlyOperator
- AmazonESCognitoAccessOperator
- AmazonOpenSearchServiceCognitoAccessOperator
Service-linked roles (1)
Also grants Cognito User Pools actions (34)
- AdministratorAccess
- AdministratorAccess-Amplify
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AmazonConnectServiceLinkedRolePolicy
- AmazonEKSLoadBalancingPolicy
- AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy
- AmazonSageMakerFullAccess
- AmazonSageMakerReadOnly
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSAuditManagerServiceRolePolicy
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSMcpServiceActionsFullAccess
- AWSPartnerLedSupportReadOnlyAccess
- AWSResourceExplorerServiceRolePolicy
- AWSSupportServiceRolePolicy
- AWSWAFConsoleFullAccess
- AWSWAFConsoleReadOnlyAccess
- AWSWAFFullAccess
- AWSWAFReadOnlyAccess
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- CloudWatchOmniAWSIntegrationPolicy
- ElasticLoadBalancingFullAccess
- NetworkSecurityManagerServiceRolePolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- SecurityAudit
- SupportUser
- ViewOnlyAccess
- WellArchitectedAgentResourceScanning
addcustomattributes adduserpoolclientsecret adminaddusertogroup adminconfirmsignup admincreateuser admindeletesoftwaretoken admindeleteuser admindeleteuserattributes admindisableproviderforuser admindisableuser adminenableuser adminforgetdevice admingetdevice admingetuser admingetuserauthfactors admininitiateauth adminlinkproviderforuser adminlistdevices adminlistgroupsforuser adminlistuserauthevents adminlistusersessions adminremoveuserfromgroup adminresetuserpassword adminrespondtoauthchallenge adminrevokeusersession adminsetusermfapreference adminsetuserpassword adminsetusersettings adminupdateautheventfeedback adminupdatedevicestatus adminupdateuserattributes adminuserglobalsignout associatesoftwaretoken associatewebacl changepassword confirmdevice confirmforgotpassword confirmsignup creategroup createidentityprovider createmanagedloginbranding createresourceserver createterms createuserimportjob createuserpool createuserpoolclient createuserpooldomain createuserpoolreplica deletegroup deleteidentityprovider deletemanagedloginbranding deleteresourceserver deleteterms deleteuser deleteuserattributes deleteuserpool deleteuserpoolclient deleteuserpoolclientsecret deleteuserpooldomain deleteuserpoolreplica describeidentityprovider describemanagedloginbranding describemanagedloginbrandingbyclient describeresourceserver describeriskconfiguration describeterms describetermsbyclient describeuserimportjob describeuserpool describeuserpoolclient describeuserpooldomain disassociatewebacl forgetdevice forgotpassword getcsvheader getclienttoken getdevice getgroup getidentityproviderbyidentifier getlogdeliveryconfiguration getprovisionedlimit getsigningcertificate gettokensfromrefreshtoken getuicustomization getuser getuserattributeverificationcode getuserpoolclientsessionconfiguration getuserpoolmfaconfig getuserpoolsessionconfiguration getwebaclforresource globalsignout initiateauth listdevices listgroups listidentityproviders listresourceservers listresourcesforwebacl listtagsforresource listterms listuserimportjobs listuserpoolclientsecrets listuserpoolclients listuserpoolreplicas listuserpools listusersessions listusers listusersingroup resendconfirmationcode respondtoauthchallenge revoketoken revokeusersession setlogdeliveryconfiguration setriskconfiguration setuicustomization setusermfapreference setuserpoolclientsessionconfiguration setuserpoolmfaconfig setuserpoolsessionconfiguration setusersettings signup startuserimportjob stopuserimportjob tagresource untagresource updateautheventfeedback updatedevicestatus updategroup updateidentityprovider updatemanagedloginbranding updateprovisionedlimit updateresourceserver updateterms updateuserattributes updateuserpool updateuserpoolclient updateuserpooldomain updateuserpoolreplica verifysoftwaretoken verifyuserattribute
Actions (139)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| cognito-idp:AddCustomAttributes | Write | 5 | 1 |
| cognito-idp:AddUserPoolClientSecret | Write | 5 | 1 |
| cognito-idp:AdminAddUserToGroup | Write | 7 | 1 |
| cognito-idp:AdminConfirmSignUp | Write | 6 | 1 |
| cognito-idp:AdminCreateUser | Write | 7 | 1 |
| cognito-idp:AdminDeleteSoftwareToken | Write | 5 | 1 |
| cognito-idp:AdminDeleteUser | Write | 7 | 1 |
| cognito-idp:AdminDeleteUserAttributes | Write | 5 | 1 |
| cognito-idp:AdminDisableProviderForUser | Write | 5 | 1 |
| cognito-idp:AdminDisableUser | Write | 7 | 1 |
| cognito-idp:AdminEnableUser | Write | 7 | 1 |
| cognito-idp:AdminForgetDevice | Write | 5 | 1 |
| cognito-idp:AdminGetDevice | Read | 7 | 1 |
| cognito-idp:AdminGetUser | Read | 11 | 1 |
| cognito-idp:AdminGetUserAuthFactors | Read | 7 | 1 |
| cognito-idp:AdminInitiateAuth | Write | 6 | 2 |
| cognito-idp:AdminLinkProviderForUser | Write | 5 | 1 |
| cognito-idp:AdminListDevices | List | 7 | 1 |
| cognito-idp:AdminListGroupsForUser | List | 13 | 1 |
| cognito-idp:AdminListUserAuthEvents | Read | 8 | 1 |
| cognito-idp:AdminListUserSessions | List | 7 | 1 |
| cognito-idp:AdminRemoveUserFromGroup | Write | 7 | 1 |
| cognito-idp:AdminResetUserPassword | Write | 6 | 1 |
| cognito-idp:AdminRespondToAuthChallenge | Write | 5 | 1 |
| cognito-idp:AdminRevokeUserSession | Write | 5 | 1 |
| cognito-idp:AdminSetUserMFAPreference | Write | 5 | 1 |
| cognito-idp:AdminSetUserPassword | Write | 6 | 1 |
| cognito-idp:AdminSetUserSettings | Write | 5 | 1 |
| cognito-idp:AdminUpdateAuthEventFeedback | Write | 5 | 1 |
| cognito-idp:AdminUpdateDeviceStatus | Write | 5 | 1 |
| cognito-idp:AdminUpdateUserAttributes | Write | 6 | 1 |
| cognito-idp:AdminUserGlobalSignOut | Write | 6 | 2 |
| cognito-idp:AssociateSoftwareToken | Write | 5 | 1 |
| cognito-idp:AssociateWebACL | Write | 5 | 3 |
| cognito-idp:ChangePassword | Write | 5 | 1 |
| cognito-idp:ConfirmDevice | Write | 5 | 1 |
| cognito-idp:ConfirmForgotPassword | Write | 5 | 1 |
| cognito-idp:ConfirmSignUp | Write | 5 | 1 |
| cognito-idp:CreateGroup | Write | 7 | 2 |
| cognito-idp:CreateIdentityProvider | Write | 5 | 1 |
| cognito-idp:CreateManagedLoginBranding | Write | 5 | 1 |
| cognito-idp:CreateResourceServer | Write | 5 | 1 |
| cognito-idp:CreateTerms | Write | 5 | 1 |
| cognito-idp:CreateUserImportJob | Write | 5 | 1 |
| cognito-idp:CreateUserPool | Write | 7 | 2 |
| cognito-idp:CreateUserPoolClient | Write | 8 | 3 |
| cognito-idp:CreateUserPoolDomain | Write | 6 | 2 |
| cognito-idp:CreateUserPoolReplica | Write | 5 | 1 |
| cognito-idp:DeleteGroup | Write | 6 | 2 |
| cognito-idp:DeleteIdentityProvider | Write | 5 | 1 |
| cognito-idp:DeleteManagedLoginBranding | Write | 5 | 1 |
| cognito-idp:DeleteResourceServer | Write | 5 | 1 |
| cognito-idp:DeleteTerms | Write | 5 | 1 |
| cognito-idp:DeleteUser | Write | 6 | 1 |
| cognito-idp:DeleteUserAttributes | Write | 5 | 1 |
| cognito-idp:DeleteUserPool | Write | 6 | 2 |
| cognito-idp:DeleteUserPoolClient | Write | 6 | 4 |
| cognito-idp:DeleteUserPoolClientSecret | Write | 5 | 1 |
| cognito-idp:DeleteUserPoolDomain | Write | 5 | 2 |
| cognito-idp:DeleteUserPoolReplica | Write | 5 | 1 |
| cognito-idp:DescribeIdentityProvider | Read | 18 | 3 |
| cognito-idp:DescribeManagedLoginBranding | Read | 13 | 1 |
| cognito-idp:DescribeManagedLoginBrandingByClient | Read | 10 | 1 |
| cognito-idp:DescribeResourceServer | Read | 18 | 3 |
| cognito-idp:DescribeRiskConfiguration | Read | 14 | 1 |
| cognito-idp:DescribeTerms | Read | 13 | 2 |
| cognito-idp:DescribeTermsByClient | Read | 9 | 1 |
| cognito-idp:DescribeUserImportJob | Read | 14 | 1 |
| cognito-idp:DescribeUserPool | Read | 24 | 6 |
| cognito-idp:DescribeUserPoolClient | Read | 21 | 5 |
| cognito-idp:DescribeUserPoolDomain | Read | 18 | 2 |
| cognito-idp:DisassociateWebACL | Write | 5 | 3 |
| cognito-idp:ForgetDevice | Write | 5 | 1 |
| cognito-idp:ForgotPassword | Write | 5 | 1 |
| cognito-idp:GetCSVHeader | Read | 8 | 1 |
| cognito-idp:GetClientToken | Write | 7 | 1 |
| cognito-idp:GetDevice | Read | 7 | 1 |
| cognito-idp:GetGroup | Read | 15 | 3 |
| cognito-idp:GetIdentityProviderByIdentifier | Read | 7 | 1 |
| cognito-idp:GetLogDeliveryConfiguration | Read | 14 | 2 |
| cognito-idp:GetProvisionedLimit | Read | 7 | 1 |
| cognito-idp:GetSigningCertificate | Read | 7 | 1 |
| cognito-idp:GetTokensFromRefreshToken | Write | 7 | 1 |
| cognito-idp:GetUICustomization | Read | 14 | 2 |
| cognito-idp:GetUser | Read | 7 | 1 |
| cognito-idp:GetUserAttributeVerificationCode | Read | 7 | 1 |
| cognito-idp:GetUserPoolClientSessionConfiguration | Read | 7 | 1 |
| cognito-idp:GetUserPoolMfaConfig | Read | 16 | 3 |
| cognito-idp:GetUserPoolSessionConfiguration | Read | 7 | 1 |
| cognito-idp:GetWebACLForResource | Read | 11 | 5 |
| cognito-idp:GlobalSignOut | Write | 5 | 1 |
| cognito-idp:InitiateAuth | Write | 5 | 1 |
| cognito-idp:ListDevices | List | 11 | 1 |
| cognito-idp:ListGroups | List | 21 | 3 |
| cognito-idp:ListIdentityProviders | List | 21 | 3 |
| cognito-idp:ListResourceServers | List | 19 | 3 |
| cognito-idp:ListResourcesForWebACL | List | 16 | 1 |
| cognito-idp:ListTagsForResource | List | 16 | 2 |
| cognito-idp:ListTerms | List | 14 | 2 |
| cognito-idp:ListUserImportJobs | List | 13 | 1 |
| cognito-idp:ListUserPoolClientSecrets | List | 10 | 1 |
| cognito-idp:ListUserPoolClients | List | 23 | 5 |
| cognito-idp:ListUserPoolReplicas | List | 11 | 1 |
| cognito-idp:ListUserPools | List | 24 | 3 |
| cognito-idp:ListUserSessions | List | 10 | 1 |
| cognito-idp:ListUsers | List | 14 | 1 |
| cognito-idp:ListUsersInGroup | List | 13 | 1 |
| cognito-idp:ResendConfirmationCode | Write | 5 | 1 |
| cognito-idp:RespondToAuthChallenge | Write | 5 | 1 |
| cognito-idp:RevokeToken | Write | 5 | 1 |
| cognito-idp:RevokeUserSession | Write | 5 | 1 |
| cognito-idp:SetLogDeliveryConfiguration | Write | 5 | 1 |
| cognito-idp:SetRiskConfiguration | Write | 5 | 1 |
| cognito-idp:SetUICustomization | Write | 5 | 1 |
| cognito-idp:SetUserMFAPreference | Write | 5 | 1 |
| cognito-idp:SetUserPoolClientSessionConfiguration | Write | 5 | 1 |
| cognito-idp:SetUserPoolMfaConfig | Write | 5 | 2 |
| cognito-idp:SetUserPoolSessionConfiguration | Write | 5 | 1 |
| cognito-idp:SetUserSettings | Write | 5 | 1 |
| cognito-idp:SignUp | Write | 5 | 1 |
| cognito-idp:StartUserImportJob | Write | 5 | 1 |
| cognito-idp:StopUserImportJob | Write | 5 | 1 |
| cognito-idp:TagResource | Tagging | 6 | 3 |
| cognito-idp:UntagResource | Tagging | 6 | 1 |
| cognito-idp:UpdateAuthEventFeedback | Write | 5 | 1 |
| cognito-idp:UpdateDeviceStatus | Write | 5 | 1 |
| cognito-idp:UpdateGroup | Write | 5 | 1 |
| cognito-idp:UpdateIdentityProvider | Write | 5 | 1 |
| cognito-idp:UpdateManagedLoginBranding | Write | 5 | 1 |
| cognito-idp:UpdateProvisionedLimit | Write | 5 | 1 |
| cognito-idp:UpdateResourceServer | Write | 5 | 1 |
| cognito-idp:UpdateTerms | Write | 5 | 1 |
| cognito-idp:UpdateUserAttributes | Write | 5 | 1 |
| cognito-idp:UpdateUserPool | Write | 7 | 2 |
| cognito-idp:UpdateUserPoolClient | Write | 7 | 4 |
| cognito-idp:UpdateUserPoolDomain | Write | 5 | 1 |
| cognito-idp:UpdateUserPoolReplica | Write | 5 | 1 |
| cognito-idp:VerifySoftwareToken | Write | 5 | 1 |
| cognito-idp:VerifyUserAttribute | Write | 5 | 1 |