AWS cognito medium security documentation change
Summary
Added clarification on attribute retention and deletion for federated users
Security assessment
The change explicitly documents how mapped attributes persist unless explicitly cleared via IdP signals or API calls. This addresses potential security risks where stale attributes might grant unintended access if not properly managed.
Diff
diff --git a/cognito/latest/developerguide/cognito-user-pools-specifying-attribute-mapping.md b/cognito/latest/developerguide/cognito-user-pools-specifying-attribute-mapping.md index daf7d2fb7..f11d401c9 100644 --- a//cognito/latest/developerguide/cognito-user-pools-specifying-attribute-mapping.md +++ b//cognito/latest/developerguide/cognito-user-pools-specifying-attribute-mapping.md @@ -49,0 +50,6 @@ In case-insensitive user pools, your Lambda triggers that process the username m + * The destination attribute retains any value that your attribute-mapping rules assign to it unless a sign-in or administrative action changes it. Amazon Cognito doesn't remove attributes from users when the source attribute is no longer sent in the provider token or SAML assertion. The following actions remove the value of an attribute from a user pool profile for a federated user: + + 1. The IdP sends a blank value for the source attribute and a mapping rule applies the blank value to the destination attribute. + + 2. You clear the value of the mapped attribute with an [DeleteUserAttributes](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserAttributes.html) or [AdminDeleteUserAttributes](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUserAttributes.html) request. +