AWS cli documentation change
Summary
Updated documentation for ClientMetadata parameter usage in Lambda triggers, added --cli-error-format option, and general CLI version updates
Security assessment
The changes clarify how ClientMetadata is passed to Lambda triggers and reference security-sensitive user pool triggers (Pre signup, Pre authentication). While this improves documentation accuracy, there's no evidence of addressing a specific security vulnerability. The added details help developers implement secure custom workflows but don't introduce new security features.
Diff
diff --git a/cli/latest/reference/cognito-idp/initiate-auth.md b/cli/latest/reference/cognito-idp/initiate-auth.md index be151e8bf..2bb5f9294 100644 --- a//cli/latest/reference/cognito-idp/initiate-auth.md +++ b//cli/latest/reference/cognito-idp/initiate-auth.md @@ -15 +15 @@ - * [AWS CLI 2.33.29 Command Reference](../../index.html) » + * [AWS CLI 2.34.0 Command Reference](../../index.html) » @@ -104,0 +105 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit + [--cli-error-format <value>] @@ -222 +223 @@ JSON Syntax: -> A map of custom key-value pairs that you can provide as input for certain custom workflows that this action triggers. +> A map of custom key-value pairs that you can provide as input for any custom workflows that this action triggers. You create custom workflows by assigning Lambda functions to user pool triggers. @@ -224 +225 @@ JSON Syntax: -> You create custom workflows by assigning Lambda functions to user pool triggers. When you send an `InitiateAuth` request, Amazon Cognito invokes the Lambda functions that are specified for various triggers. The `ClientMetadata` value is passed as input to the functions for only the following triggers. +> When Amazon Cognito invokes any of these functions, it passes a JSON payload, which the function receives as input. This payload contains a `clientMetadata` attribute that provides the data that you assigned to the ClientMetadata parameter in your request. In your function code, you can process the `clientMetadata` value to enhance your workflow for your specific needs. @@ -226 +227,5 @@ JSON Syntax: -> * Pre sign-up +> To review the Lambda trigger types that Amazon Cognito invokes at runtime with API requests, see [Connecting API actions to Lambda triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-working-with-lambda-triggers.html#lambda-triggers-by-event) in the _Amazon Cognito Developer Guide_ . +> +> The `ClientMetadata` value is passed as input to the functions for only the following triggers: +> +> * Pre signup @@ -232,3 +237 @@ JSON Syntax: -> When Amazon Cognito invokes the functions for these triggers, it passes a JSON payload as input to the function. This payload contains a `validationData` attribute with the data that you assigned to the `ClientMetadata` parameter in your `InitiateAuth` request. In your function, `validationData` can contribute to operations that require data that isn’t in the default payload. -> ->> `InitiateAuth` requests invokes the following triggers without `ClientMetadata` as input. +> This request also invokes the functions for the following triggers, but doesn’t pass `ClientMetadata` : @@ -245,2 +247,0 @@ JSON Syntax: -> -> For more information, see [Using Lambda triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html) in the _Amazon Cognito Developer Guide_ . @@ -414,0 +416 @@ The formatting style for command output. + * off @@ -480,0 +483,13 @@ Disable automatically prompt for CLI input parameters. +`--cli-error-format` (string) + +The formatting style for error output. By default, errors are displayed in enhanced format. + + * legacy + * json + * yaml + * text + * table + * enhanced + + + @@ -726 +741 @@ AvailableChallenges -> (list) - * [AWS CLI 2.33.29 Command Reference](../../index.html) » + * [AWS CLI 2.34.0 Command Reference](../../index.html) »