AWS Security ChangesHomeSearch

AWS cli high security documentation change

Service: cli · 2026-02-28 · Security-related high

File: cli/latest/reference/cognito-idp/get-tokens-from-refresh-token.md

Summary

Updated CLI version from 2.33.29 to 2.34.0, added --cli-error-format parameter, increased refresh token minimum length from 1 to 24, expanded ClientMetadata documentation regarding Lambda triggers

Security assessment

The change increasing refresh token minimum length from 1 to 24 directly addresses security by enforcing stronger token requirements. Extremely short tokens (min=1) would be cryptographically insecure and vulnerable to brute-force attacks.

Diff

diff --git a/cli/latest/reference/cognito-idp/get-tokens-from-refresh-token.md b/cli/latest/reference/cognito-idp/get-tokens-from-refresh-token.md
index fd8fc51ef..181eb5ec8 100644
--- a//cli/latest/reference/cognito-idp/get-tokens-from-refresh-token.md
+++ b//cli/latest/reference/cognito-idp/get-tokens-from-refresh-token.md
@@ -15 +15 @@
-  * [AWS CLI 2.33.29 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.0 Command Reference](../../index.html) »
@@ -91,0 +92 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
+    [--cli-error-format <value>]
@@ -124 +125 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
->   * min: `1`
+>   * min: `24`
@@ -146 +147 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
-> A map of custom key-value pairs that you can provide as input for certain custom workflows that this action triggers.
+> A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers. You create custom workflows by assigning Lambda functions to user pool triggers.
@@ -148 +149 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
-> You create custom workflows by assigning Lambda functions to user pool triggers. When you use the `GetTokensFromRefreshToken` API action, Amazon Cognito invokes the Lambda function the pre token generation trigger.
+> When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the function receives as input. This payload contains a `clientMetadata` attribute that provides the data that you assigned to the ClientMetadata parameter in your request. In your function code, you can process the `clientMetadata` value to enhance your workflow for your specific needs.
@@ -150 +151 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
-> For more information, see [Using Lambda triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html) in the _Amazon Cognito Developer Guide_ .
+> To review the Lambda trigger types that Amazon Cognito invokes at runtime with API requests, see [Connecting API actions to Lambda triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event) in the _Amazon Cognito Developer Guide_ .
@@ -223,0 +225 @@ The formatting style for command output.
+  * off
@@ -289,0 +292,13 @@ Disable automatically prompt for CLI input parameters.
+`--cli-error-format` (string)
+
+The formatting style for error output. By default, errors are displayed in enhanced format.
+
+  * legacy
+  * json
+  * yaml
+  * text
+  * table
+  * enhanced
+
+
+
@@ -378 +393 @@ AuthenticationResult -> (structure)
-  * [AWS CLI 2.33.29 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.0 Command Reference](../../index.html) »