AWS cli high security documentation change

Service: cli · 2026-02-28 · Security-related high

File: cli/latest/reference/cognito-idp/create-user-pool-client.md

Summary

Added client-secret parameter with validation constraints, updated HTTPS requirements for callback URLs, clarified testing endpoints, and added error formatting options

Security assessment

The addition of client-secret parameter with explicit length/pattern requirements (24-64 chars) and clarification of HTTPS enforcement for callback URLs (excluding localhost variants) directly impacts authentication security. These changes enforce stronger client secret policies and clarify secure transport requirements.

Diff

diff --git a/cli/latest/reference/cognito-idp/create-user-pool-client.md b/cli/latest/reference/cognito-idp/create-user-pool-client.md
index 8971bf2c1..11b1c6c5a 100644
--- a//cli/latest/reference/cognito-idp/create-user-pool-client.md
+++ b//cli/latest/reference/cognito-idp/create-user-pool-client.md
@@ -15 +15 @@
-  * [AWS CLI 2.33.29 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.0 Command Reference](../../index.html) »
@@ -87,0 +88 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
+    [--client-secret <value>]
@@ -127,0 +129 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
+    [--cli-error-format <value>]
@@ -159,0 +162,12 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
+`--client-secret` (string)
+
+> A custom client secret that you want to use for the app client. You cannot specify both GenerateSecret as true and provide a ClientSecret value.
+> 
+> Constraints:
+> 
+>   * min: `24`
+>   * max: `64`
+>   * pattern: `[\w+]+`
+> 
+
+
@@ -393 +407 @@ Syntax:
-> Amazon Cognito requires HTTPS over HTTP except for <http://localhost> for testing purposes only.
+> Amazon Cognito requires HTTPS over HTTP except for callback URLs to `http://localhost` , `http://127.0.0.1` and `http://[::1]` . These callback URLs are for testing purposes only. You can specify custom TCP ports for your callback URLs.
@@ -395 +409 @@ Syntax:
-> App callback URLs such as myapp://example are also supported.
+> App callback URLs such as `myapp://example` are also supported.
@@ -717,0 +732 @@ The formatting style for command output.
+  * off
@@ -783,0 +799,13 @@ Disable automatically prompt for CLI input parameters.
+`--cli-error-format` (string)
+
+The formatting style for error output. By default, errors are displayed in enhanced format.
+
+  * legacy
+  * json
+  * yaml
+  * text
+  * table
+  * enhanced
+
+
+
@@ -939 +967 @@ UserPoolClient -> (structure)
->>   * min: `1`
+>>   * min: `24`
@@ -1146 +1174 @@ UserPoolClient -> (structure)
->> Amazon Cognito requires HTTPS over HTTP except for <http://localhost> for testing purposes only.
+>> Amazon Cognito requires HTTPS over HTTP for callback URLs to `http://localhost` , `http://127.0.0.1` and `http://[::1]` . These callback URLs are for testing purposes only. You can specify custom TCP ports for your callback URLs.
@@ -1202 +1230 @@ UserPoolClient -> (structure)
->> Amazon Cognito requires HTTPS over HTTP except for <http://localhost> for testing purposes only.
+>> Amazon Cognito requires HTTPS over HTTP for callback URLs to `http://localhost` , `http://127.0.0.1` and `http://[::1]` . These callback URLs are for testing purposes only. You can specify custom TCP ports for your callback URLs.
@@ -1411 +1439 @@ UserPoolClient -> (structure)
-  * [AWS CLI 2.33.29 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.0 Command Reference](../../index.html) »