AWS cli documentation change

Service: cli · 2026-01-31 · Documentation low

File: cli/latest/reference/cognito-idp/update-user-pool.md

Summary

Added documentation for a new 'InboundFederation' Lambda trigger configuration that transforms federated user attributes during authentication with external identity providers.

Security assessment

The change introduces documentation for a new authentication trigger that processes federated identity attributes. While this relates to authentication security, there's no evidence of addressing a specific vulnerability. It enhances security capabilities by allowing custom attribute transformation.

Diff

diff --git a/cli/latest/reference/cognito-idp/update-user-pool.md b/cli/latest/reference/cognito-idp/update-user-pool.md
index 41bb4f70b..a0e96a6bf 100644
--- a//cli/latest/reference/cognito-idp/update-user-pool.md
+++ b//cli/latest/reference/cognito-idp/update-user-pool.md
@@ -15 +15 @@
-  * [AWS CLI 2.33.8 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.12 Command Reference](../../index.html) »
@@ -493,0 +494,28 @@ JSON Syntax:
+> 
+> InboundFederation -> (structure)
+>
+>> The configuration of an inbound federation Lambda trigger. This trigger can transform federated user attributes during the authentication with external identity providers.
+>> 
+>> LambdaVersion -> (string) [required]
+>>
+>>> The user pool trigger version of the request that Amazon Cognito sends to your Lambda function. Higher-numbered versions add fields that support new features.
+>>> 
+>>> You must use a `LambdaVersion` of `V1_0` with an inbound federation function.
+>>> 
+>>> Possible values:
+>>> 
+>>>   * `V1_0`
+>>> 
+
+>> 
+>> LambdaArn -> (string) [required]
+>>
+>>> The Amazon Resource Name (ARN) of the function that you want to assign to your Lambda trigger.
+>>> 
+>>> Constraints:
+>>> 
+>>>   * min: `20`
+>>>   * max: `2048`
+>>>   * pattern: `arn:[\w+=/,.@-]+:[\w+=/,.@-]+:([\w+=/,.@-]*)?:[0-9]+:[\w+=/,.@-]+(:[\w+=/,.@-]+)?(:[\w+=/,.@-]+)?`
+>>> 
+
@@ -498 +526 @@ Shorthand Syntax:
-    PreSignUp=string,CustomMessage=string,PostConfirmation=string,PreAuthentication=string,PostAuthentication=string,DefineAuthChallenge=string,CreateAuthChallenge=string,VerifyAuthChallengeResponse=string,PreTokenGeneration=string,UserMigration=string,PreTokenGenerationConfig={LambdaVersion=string,LambdaArn=string},CustomSMSSender={LambdaVersion=string,LambdaArn=string},CustomEmailSender={LambdaVersion=string,LambdaArn=string},KMSKeyID=string
+    PreSignUp=string,CustomMessage=string,PostConfirmation=string,PreAuthentication=string,PostAuthentication=string,DefineAuthChallenge=string,CreateAuthChallenge=string,VerifyAuthChallengeResponse=string,PreTokenGeneration=string,UserMigration=string,PreTokenGenerationConfig={LambdaVersion=string,LambdaArn=string},CustomSMSSender={LambdaVersion=string,LambdaArn=string},CustomEmailSender={LambdaVersion=string,LambdaArn=string},KMSKeyID=string,InboundFederation={LambdaVersion=string,LambdaArn=string}
@@ -527 +555,5 @@ JSON Syntax:
-      "KMSKeyID": "string"
+      "KMSKeyID": "string",
+      "InboundFederation": {
+        "LambdaVersion": "V1_0",
+        "LambdaArn": "string"
+      }
@@ -1352 +1384 @@ None
-  * [AWS CLI 2.33.8 Command Reference](../../index.html) »
+  * [AWS CLI 2.33.12 Command Reference](../../index.html) »