AWS cognito documentation change
Summary
Added documentation about automatic user group creation for identity providers
Security assessment
Clarifies group management mechanics without addressing security vulnerabilities or introducing security controls
Diff
diff --git a/cognito/latest/developerguide/cognito-user-pools-user-groups.md b/cognito/latest/developerguide/cognito-user-pools-user-groups.md index 634f49d05..5ed617cf2 100644 --- a//cognito/latest/developerguide/cognito-user-pools-user-groups.md +++ b//cognito/latest/developerguide/cognito-user-pools-user-groups.md @@ -12,0 +13,2 @@ You can use groups to create a collection of users in a user pool, which is ofte +Amazon Cognito creates a user group for each OIDC, SAMl, and social [identity provider](./cognito-user-pools-identity-federation.html#cognito-user-pools-identity-federation-how-it-works) (IdP) that you add to your user pool. The name of the group is in the format `[user pool ID]_[IdP name]`, for example `us-east-1_EXAMPLE_MYSSO` or `us-east-1_EXAMPLE_Google`. Each unique automatically-generated IdP user profile is automatically added to this group. [Linked users](./cognito-user-pools-identity-federation-consolidate-users.html) aren't automatically added to this group, but you can add their profiles to the group in a separate process. +