AWS cognito documentation change
Summary
Updated pre token generation documentation documentation to include machine-to-machine client credentials grants support
Security assessment
Added documentation about access token customization for machine identities, which enhances security documentation but does not indicate resolution of a specific security vulnerability.
Diff
diff --git a/cognito/latest/developerguide/feature-plans-features-essentials.md index 0de1cf35b..53a1c61a5 100644 --- a/cognito/latest/developerguide/feature-plans-features-essentials.md +++ b/cognito/latest/developerguide/feature-plans-features-essentials.md @@ -40 +40 @@ User pool [access tokens](https://datatracker.ietf.org/doc/html/rfc6749#section- -The Essentials plan adds to the existing functions of a [pre token generation trigger](./user-pool-lambda-pre-token-generation.html). With lower-tier plans, you can customize ID tokens with additional claims, roles, and group membership. With Essentials, you can additionally customize access tokens with claims, roles, group membership, and OAuth scopes. Access token customization isn't available to machine-to-machine (M2M) [client credentials grants](./federation-endpoints-oauth-grants.html). +The Essentials plan adds to the existing functions of a [pre token generation trigger](./user-pool-lambda-pre-token-generation.html). With lower-tier plans, you can customize ID tokens with additional claims, roles, and group membership. Essentials adds new versions of the trigger input event that customize access token claims, roles, group membership, and scopes. Access token customization is available to machine-to-machine (M2M) [client credentials grants](./federation-endpoints-oauth-grants.html) with event version three. @@ -50 +50 @@ The Essentials plan adds to the existing functions of a [pre token generation tr - 4. Assign your new function as a [version 2](./user-pool-lambda-pre-token-generation.html#user-pool-lambda-pre-token-generation-event-versions) pre token generation trigger. + 4. Assign your new function as a [version two or three](./user-pool-lambda-pre-token-generation.html#user-pool-lambda-pre-token-generation-event-versions) pre token generation trigger. Version two events customize access tokens for user identities. Version three customizes access tokens for user and machine identities.