AWS cognito medium security documentation change
Summary
Expanded documentation about client secret management including rotation APIs and multiple secrets support
Security assessment
Adds detailed security documentation about secret rotation procedures and API operations for credential management
Diff
diff --git a/cognito/latest/developerguide/user-pool-settings-client-apps.md b/cognito/latest/developerguide/user-pool-settings-client-apps.md index 6c52d61d0..a512321ee 100644 --- a//cognito/latest/developerguide/user-pool-settings-client-apps.md +++ b//cognito/latest/developerguide/user-pool-settings-client-apps.md @@ -51 +51 @@ A client secret, or client password, is a fixed string that your app must use in -You can't change secrets after you create an app. You can create a new app with a new secret if you want to rotate the secret. You can also delete an app to block access from apps that use that app client ID. +Each app client can have up to two secrets at a time, enabling secret rotation without downtime. When you create an app client, you can either let Amazon Cognito generate a secret value or provide your own custom secret value. You can't change secrets after you create an app. You can add a second secret with the [AddUserPoolClientSecret](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AddUserPoolClientSecret.html) API operation to rotate secrets. When you add a secret, you can either let Amazon Cognito generate a secret value or provide your own custom secret value. To delete a secret, use the [DeleteUserPoolClientSecret](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolClientSecret.html) API operation. You cannot delete the only secret associated with an app client. You can also delete an app to block access from apps that use that app client ID.