AWS cli medium security documentation change
Summary
Updated regex pattern for attribute names to allow whitespace characters and clarified affected user pools created before May 2024 in multiple regions. Added documentation for --cli-error-format CLI parameter and enhanced ClientMetadata/Lambda trigger descriptions.
Security assessment
The regex pattern change (adding \t\n\r and space) indicates a validation adjustment. The documentation explicitly states older user pools created before May 2024 in multiple regions are affected and will be updated to the new pattern, suggesting a security-related fix for attribute validation in those pools. This could address potential injection vulnerabilities via attribute values.
Diff
diff --git a/cli/latest/reference/cognito-idp/admin-create-user.md b/cli/latest/reference/cognito-idp/admin-create-user.md index dc80b9cb1..408c8046b 100644 --- a//cli/latest/reference/cognito-idp/admin-create-user.md +++ b//cli/latest/reference/cognito-idp/admin-create-user.md @@ -15 +15 @@ - * [AWS CLI 2.33.29 Command Reference](../../index.html) » + * [AWS CLI 2.34.0 Command Reference](../../index.html) » @@ -121,0 +122 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit + [--cli-error-format <value>] @@ -182 +183,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit ->>> The name of the attribute. +>>> The name of the attribute, for example `email` or `custom:department` . +>>> +>>> In some older user pools, the regex pattern for acceptable values of this parameter is `[\p{L}\p{M}\p{S}\p{N}\p{P}]+` . Older pools will eventually be updated to use the new pattern. Affected user pools are those created before May 2024 in US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Asia Pacific (Mumbai), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Stockholm), Middle East (Bahrain), and South America (São Paulo). @@ -188 +191 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit ->>> * pattern: `[\p{L}\p{M}\p{S}\p{N}\p{P}]+` +>>> * pattern: `[\p{L}\p{M}\p{S}\p{N}\p{P}\t\n\r ]+` @@ -234 +237,3 @@ JSON Syntax: ->>> The name of the attribute. +>>> The name of the attribute, for example `email` or `custom:department` . +>>> +>>> In some older user pools, the regex pattern for acceptable values of this parameter is `[\p{L}\p{M}\p{S}\p{N}\p{P}]+` . Older pools will eventually be updated to use the new pattern. Affected user pools are those created before May 2024 in US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Asia Pacific (Mumbai), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Stockholm), Middle East (Bahrain), and South America (São Paulo). @@ -240 +245 @@ JSON Syntax: ->>> * pattern: `[\p{L}\p{M}\p{S}\p{N}\p{P}]+` +>>> * pattern: `[\p{L}\p{M}\p{S}\p{N}\p{P}\t\n\r ]+` @@ -331 +336 @@ Syntax: -> A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers. +> A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers. You create custom workflows by assigning Lambda functions to user pool triggers. @@ -333 +338 @@ Syntax: -> You create custom workflows by assigning Lambda functions to user pool triggers. When you use the AdminCreateUser API action, Amazon Cognito invokes the function that is assigned to the _pre sign-up_ trigger. When Amazon Cognito invokes this function, it passes a JSON payload, which the function receives as input. This payload contains a `ClientMetadata` attribute, which provides the data that you assigned to the ClientMetadata parameter in your AdminCreateUser request. In your function code in Lambda, you can process the `clientMetadata` value to enhance your workflow for your specific needs. +> When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the function receives as input. This payload contains a `clientMetadata` attribute that provides the data that you assigned to the ClientMetadata parameter in your request. In your function code, you can process the `clientMetadata` value to enhance your workflow for your specific needs. @@ -335 +340 @@ Syntax: -> For more information, see [Using Lambda triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html) in the _Amazon Cognito Developer Guide_ . +> To review the Lambda trigger types that Amazon Cognito invokes at runtime with API requests, see [Connecting API actions to Lambda triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event) in the _Amazon Cognito Developer Guide_ . @@ -408,0 +414 @@ The formatting style for command output. + * off @@ -474,0 +481,13 @@ Disable automatically prompt for CLI input parameters. +`--cli-error-format` (string) + +The formatting style for error output. By default, errors are displayed in enhanced format. + + * legacy + * json + * yaml + * text + * table + * enhanced + + + @@ -551 +570,3 @@ User -> (structure) ->>>> The name of the attribute. +>>>> The name of the attribute, for example `email` or `custom:department` . +>>>> +>>>> In some older user pools, the regex pattern for acceptable values of this parameter is `[\p{L}\p{M}\p{S}\p{N}\p{P}]+` . Older pools will eventually be updated to use the new pattern. Affected user pools are those created before May 2024 in US East (N. Virginia), US East (Ohio), US West (N. California), US West (Oregon), Asia Pacific (Mumbai), Asia Pacific (Tokyo), Asia Pacific (Seoul), Asia Pacific (Singapore), Asia Pacific (Sydney), Canada (Central), Europe (Frankfurt), Europe (Ireland), Europe (London), Europe (Paris), Europe (Stockholm), Middle East (Bahrain), and South America (São Paulo). @@ -557 +578 @@ User -> (structure) ->>>> * pattern: `[\p{L}\p{M}\p{S}\p{N}\p{P}]+` +>>>> * pattern: `[\p{L}\p{M}\p{S}\p{N}\p{P}\t\n\r ]+` @@ -637 +658 @@ User -> (structure) ->>>> * pattern: `[\p{L}\p{M}\p{S}\p{N}\p{P}]+` +>>>> * pattern: `[\p{L}\p{M}\p{S}\p{N}\p{P}\t\n\r ]+` @@ -651 +672 @@ User -> (structure) - * [AWS CLI 2.33.29 Command Reference](../../index.html) » + * [AWS CLI 2.34.0 Command Reference](../../index.html) »