AWS singlesignon documentation change
Summary
Added new 'OIDC service request quotas' section with rate limits for authentication-related APIs
Security assessment
Documents rate limits for authentication operations which helps prevent abuse/DoS attacks, but does not indicate a specific security issue being fixed
Diff
diff --git a/singlesignon/latest/userguide/limits.md b/singlesignon/latest/userguide/limits.md index e93168675..47936f108 100644 --- a//singlesignon/latest/userguide/limits.md +++ b//singlesignon/latest/userguide/limits.md @@ -5 +5 @@ -Application quotasAWS account quotasActive Directory quotasIAM Identity Center identity store quotasIAM Identity Center throttle limitsAdditional quotas +Application quotasAWS account quotasActive Directory quotasIAM Identity Center identity store quotasIAM Identity Center throttle limitsOIDC service request quotasAdditional quotas @@ -62,0 +63,10 @@ SCIM APIs | [SCIM APIs](https://docs.aws.amazon.com/singlesignon/latest/develope +## OIDC service request quotas + +Resource | Default value (requests per second) | Can be increased +---|---|--- +Request rate from a remote address to register a public OAuth client Applies to: [ RegisterClient ](https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_RegisterClient.html) | 20 | Yes +Request rate from a public client registered with the OIDC service Applies to: [ CreateToken](https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_CreateToken.html), [ StartDeviceAuthorization ](https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_StartDeviceAuthorization.html) | 80 | Yes +Request rate from all public clients registered with the same IAM Identity Center instance Applies to: [ CreateToken ](https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_CreateToken.html) | 250 | Yes +Request rate from an IAM Identity Center application registered with the IAM Identity Center instance Applies to: [ CreateTokenWithIAM ](https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_CreateTokenWithIAM.html) | 80 | Yes +Token generation rate from all IAM Identity Center applications registered with the same IAM Identity Center instance with JWT Bearer grant Applies to: [ CreateTokenWithIAM ](https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/API_CreateTokenWithIAM.html) | 10 | Contact AWS Support +