AWS cli medium security documentation change

Service: cli · 2026-01-31 · Security-related medium

File: cli/latest/reference/cognito-idp/create-user-pool.md

Summary

Added documentation for InboundFederation Lambda trigger configuration in LambdaConfig section. This trigger transforms federated user attributes during external identity provider authentication.

Security assessment

The change adds a security feature for transforming federated user attributes during authentication. This helps mitigate risks of attribute manipulation from external identity providers by allowing custom validation logic. Security impact: Enables attribute normalization/validation to prevent privilege escalation or injection attacks via federated identities.

Diff

diff --git a/cli/latest/reference/cognito-idp/create-user-pool.md b/cli/latest/reference/cognito-idp/create-user-pool.md
index 305c9fbf3..908b20dce 100644
--- a//cli/latest/reference/cognito-idp/create-user-pool.md
+++ b//cli/latest/reference/cognito-idp/create-user-pool.md
@@ -15 +15 @@
-  * [AWS CLI 2.33.8 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.12 Command Reference](../../index.html) »
@@ -496,0 +497,28 @@ JSON Syntax:
+> 
+> InboundFederation -> (structure)
+>
+>> The configuration of an inbound federation Lambda trigger. This trigger can transform federated user attributes during the authentication with external identity providers.
+>> 
+>> LambdaVersion -> (string) [required]
+>>
+>>> The user pool trigger version of the request that Amazon Cognito sends to your Lambda function. Higher-numbered versions add fields that support new features.
+>>> 
+>>> You must use a `LambdaVersion` of `V1_0` with an inbound federation function.
+>>> 
+>>> Possible values:
+>>> 
+>>>   * `V1_0`
+>>> 
+
+>> 
+>> LambdaArn -> (string) [required]
+>>
+>>> The Amazon Resource Name (ARN) of the function that you want to assign to your Lambda trigger.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `20`
+>>>   * max: `2048`
+>>>   * pattern: `arn:[\w+=/,.@-]+:[\w+=/,.@-]+:([\w+=/,.@-]*)?:[0-9]+:[\w+=/,.@-]+(:[\w+=/,.@-]+)?(:[\w+=/,.@-]+)?`
+>>> 
+
@@ -501 +529 @@ Shorthand Syntax:
-    PreSignUp=string,CustomMessage=string,PostConfirmation=string,PreAuthentication=string,PostAuthentication=string,DefineAuthChallenge=string,CreateAuthChallenge=string,VerifyAuthChallengeResponse=string,PreTokenGeneration=string,UserMigration=string,PreTokenGenerationConfig={LambdaVersion=string,LambdaArn=string},CustomSMSSender={LambdaVersion=string,LambdaArn=string},CustomEmailSender={LambdaVersion=string,LambdaArn=string},KMSKeyID=string
+    PreSignUp=string,CustomMessage=string,PostConfirmation=string,PreAuthentication=string,PostAuthentication=string,DefineAuthChallenge=string,CreateAuthChallenge=string,VerifyAuthChallengeResponse=string,PreTokenGeneration=string,UserMigration=string,PreTokenGenerationConfig={LambdaVersion=string,LambdaArn=string},CustomSMSSender={LambdaVersion=string,LambdaArn=string},CustomEmailSender={LambdaVersion=string,LambdaArn=string},KMSKeyID=string,InboundFederation={LambdaVersion=string,LambdaArn=string}
@@ -530 +558,5 @@ JSON Syntax:
-      "KMSKeyID": "string"
+      "KMSKeyID": "string",
+      "InboundFederation": {
+        "LambdaVersion": "V1_0",
+        "LambdaArn": "string"
+      }
@@ -2383,0 +2416,28 @@ UserPool -> (structure)
+>> 
+>> InboundFederation -> (structure)
+>>
+>>> The configuration of an inbound federation Lambda trigger. This trigger can transform federated user attributes during the authentication with external identity providers.
+>>> 
+>>> LambdaVersion -> (string) [required]
+>>>
+>>>> The user pool trigger version of the request that Amazon Cognito sends to your Lambda function. Higher-numbered versions add fields that support new features.
+>>>> 
+>>>> You must use a `LambdaVersion` of `V1_0` with an inbound federation function.
+>>>> 
+>>>> Possible values:
+>>>> 
+>>>>   * `V1_0`
+>>>> 
+
+>>> 
+>>> LambdaArn -> (string) [required]
+>>>
+>>>> The Amazon Resource Name (ARN) of the function that you want to assign to your Lambda trigger.
+>>>> 
+>>>> Constraints:
+>>>> 
+>>>>   * min: `20`
+>>>>   * max: `2048`
+>>>>   * pattern: `arn:[\w+=/,.@-]+:[\w+=/,.@-]+:([\w+=/,.@-]*)?:[0-9]+:[\w+=/,.@-]+(:[\w+=/,.@-]+)?(:[\w+=/,.@-]+)?`
+>>>> 
+
@@ -3153 +3213 @@ UserPool -> (structure)
-  * [AWS CLI 2.33.8 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.12 Command Reference](../../index.html) »