AWS cli high security documentation change

Service: cli · 2026-02-28 · Security-related high

File: cli/latest/reference/cognito-idp/describe-user-pool-client.md

Summary

Updated CLI version references, added --cli-error-format option, increased minimum token validity length from 1 to 24, and clarified HTTPS requirements for callback URLs with specific localhost/loopback exceptions

Security assessment

The change from min:1 to min:24 for token validity indicates stronger security requirements for token durations. The HTTPS callback URL clarification restricts insecure HTTP usage to specific loopback addresses only, reducing potential MITM risks in production environments.

Diff

diff --git a/cli/latest/reference/cognito-idp/describe-user-pool-client.md b/cli/latest/reference/cognito-idp/describe-user-pool-client.md
index 792320c0a..803695342 100644
--- a//cli/latest/reference/cognito-idp/describe-user-pool-client.md
+++ b//cli/latest/reference/cognito-idp/describe-user-pool-client.md
@@ -15 +15 @@
-  * [AWS CLI 2.33.29 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.0 Command Reference](../../index.html) »
@@ -100,0 +101 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
+    [--cli-error-format <value>]
@@ -159,0 +161 @@ The formatting style for command output.
+  * off
@@ -225,0 +228,13 @@ Disable automatically prompt for CLI input parameters.
+`--cli-error-format` (string)
+
+The formatting style for error output. By default, errors are displayed in enhanced format.
+
+  * legacy
+  * json
+  * yaml
+  * text
+  * table
+  * enhanced
+
+
+
@@ -357 +372 @@ UserPoolClient -> (structure)
->>   * min: `1`
+>>   * min: `24`
@@ -564 +579 @@ UserPoolClient -> (structure)
->> Amazon Cognito requires HTTPS over HTTP except for <http://localhost> for testing purposes only.
+>> Amazon Cognito requires HTTPS over HTTP for callback URLs to `http://localhost` , `http://127.0.0.1` and `http://[::1]` . These callback URLs are for testing purposes only. You can specify custom TCP ports for your callback URLs.
@@ -620 +635 @@ UserPoolClient -> (structure)
->> Amazon Cognito requires HTTPS over HTTP except for <http://localhost> for testing purposes only.
+>> Amazon Cognito requires HTTPS over HTTP for callback URLs to `http://localhost` , `http://127.0.0.1` and `http://[::1]` . These callback URLs are for testing purposes only. You can specify custom TCP ports for your callback URLs.
@@ -829 +844 @@ UserPoolClient -> (structure)
-  * [AWS CLI 2.33.29 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.0 Command Reference](../../index.html) »