AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2025-05-01 · Documentation medium

File: AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.md

Summary

Added `RefreshTokenRotation` property to configure refresh token rotation for Cognito UserPoolClient, including behavior for token issuance during session renewal.

Security assessment

The change introduces documentation for a security feature (refresh token rotation) to mitigate risks of long-lived refresh tokens. However, there is no explicit mention of a resolved vulnerability, so it is considered a proactive security enhancement rather than a direct security fix.

Diff

diff --git a/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.md b/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.md
index 9179f4e29..c467a3222 100644
--- a//AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.md
+++ b//AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpoolclient.md
@@ -39,0 +40 @@ To declare this entity in your AWS CloudFormation template, use the following sy
+          "RefreshTokenRotation" : [RefreshTokenRotation](./aws-properties-cognito-userpoolclient-refreshtokenrotation.html),
@@ -77,0 +79,2 @@ To declare this entity in your AWS CloudFormation template, use the following sy
+      RefreshTokenRotation: 
+        [RefreshTokenRotation](./aws-properties-cognito-userpoolclient-refreshtokenrotation.html)
@@ -415,0 +419,13 @@ _Required_ : No
+`RefreshTokenRotation`
+    
+
+The configuration of your app client for refresh token rotation. When enabled, your app client issues new ID, access, and refresh tokens when users renew their sessions with refresh tokens. When disabled, token refresh issues only ID and access tokens.
+
+Refresh token rotation must be completed with GetTokensFromRefreshToken. With refresh token rotation disabled, you can complete token refresh with `GetTokensFromRefreshToken` and with `REFRESH_TOKEN_AUTH` in InitiateAuthRequest$AuthFlow and AdminInitiateAuthRequest$AuthFlow.
+
+_Required_ : No
+
+ _Type_ : [RefreshTokenRotation](./aws-properties-cognito-userpoolclient-refreshtokenrotation.html)
+
+ _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+