AWS cli documentation change

Service: cli · 2026-06-04 · Documentation medium

File: cli/latest/reference/cognito-idp/update-user-pool.md

Summary

Added --key-configuration (encryption key management) and --issuer-configuration (token issuer settings) parameters. Updated documentation about multi-region replication constraints.

Security assessment

The changes explicitly document security features: customer-managed encryption keys (--key-configuration) and secure token issuer endpoints (--issuer-configuration). While not fixing vulnerabilities, they enhance security documentation for encryption and authentication mechanisms.

Diff

diff --git a/cli/latest/reference/cognito-idp/update-user-pool.md b/cli/latest/reference/cognito-idp/update-user-pool.md
index 3ab25f6e3..e50401827 100644
--- a//cli/latest/reference/cognito-idp/update-user-pool.md
+++ b//cli/latest/reference/cognito-idp/update-user-pool.md
@@ -15 +15 @@
-  * [AWS CLI 2.34.57 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.61 Command Reference](../../index.html) »
@@ -64 +64,3 @@ Updates the configuration of a user pool. To avoid setting parameters to Amazon
-With the exception of `UserPoolTier` , if you don’t provide a value for an attribute, Amazon Cognito sets it to its default value.
+If you don’t provide a value for an attribute, Amazon Cognito sets it to its default value.
+
+In secondary regions for user pools with multi-region replication, regional configurations for email, SMS, Lambda functions, and tags can be updated. Both global and regional settings must be provided as inputs, with global settings required to match existing values to maintain consistency across replicas.
@@ -109,0 +112,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cognit
+    [--key-configuration <value>]
+    [--issuer-configuration <value>]
@@ -1237,0 +1242,91 @@ JSON Syntax:
+`--key-configuration` (structure)
+
+> The key configuration for the user pool. In secondary regions, this parameter must match the existing configuration and cannot be modified.
+> 
+> KeyType -> (string)
+>
+>> The type of encryption key used for the user pool.
+>>
+>>> AWS_OWNED_KEY
+>> 
+>> A key owned by Amazon Web Services in Key Management Service.
+>>
+>>> CUSTOMER_MANAGED_KEY
+>> 
+>> A key managed by the customer in Key Management Service. You must use a multi-region key to enable multi-region replication for a user pool.
+>> 
+>> Possible values:
+>> 
+>>   * `AWS_OWNED_KEY`
+>>   * `CUSTOMER_MANAGED_KEY`
+>> 
+
+> 
+> KmsKeyArn -> (string)
+>
+>> The Amazon Resource Name (ARN) of the KMS key used for encryption. If not specified, Amazon Web Services managed keys are used.
+>> 
+>> Constraints:
+>> 
+>>   * min: `20`
+>>   * max: `2048`
+>>   * pattern: `arn:[\w+=/,.@-]+:[\w+=/,.@-]+:([\w+=/,.@-]*)?:[0-9]+:[\w+=/,.@-]+(:[\w+=/,.@-]+)?(:[\w+=/,.@-]+)?`
+>> 
+
+
+Shorthand Syntax:
+    
+    
+    KeyType=string,KmsKeyArn=string
+    
+
+JSON Syntax:
+    
+    
+    {
+      "KeyType": "AWS_OWNED_KEY"|"CUSTOMER_MANAGED_KEY",
+      "KmsKeyArn": "string"
+    }
+    
+
+`--issuer-configuration` (structure)
+
+> The issuer configuration for the user pool. In secondary regions, this parameter must match the existing configuration and cannot be modified.
+> 
+> Type -> (string)
+>
+>> The type of issuer configuration. Determines the token issuing behavior for the user pool.
+>>
+>>> ORIGINAL
+>> 
+>> The original issuer configuration for user pools. The issuer URL is hosted in the user pool’s region and provides OIDC endpoints specific to that region.
+>> 
+>> Original issuers have the format of `https://cognito-idp.[region].amazonaws.com/[userPoolId]`
+>>
+>>> UPDATED
+>> 
+>> Recommended for all user pools, including for multi-Region replication. Updated issuers host the same JWKS content in multiple regions, resulting in improved resilience and efficiency.
+>> 
+>> Updated issuers have the format of `https://issuer-cognito-idp.[region].amazonaws.com/[userPoolId]` , where region is the primary Amazon Web Services Region of your user pool.
+>> 
+>> Possible values:
+>> 
+>>   * `ORIGINAL`
+>>   * `UPDATED`
+>> 
+
+
+Shorthand Syntax:
+    
+    
+    Type=string
+    
+
+JSON Syntax:
+    
+    
+    {
+      "Type": "ORIGINAL"|"UPDATED"
+    }
+    
+
@@ -1399 +1494 @@ None
-  * [AWS CLI 2.34.57 Command Reference](../../index.html) »
+  * [AWS CLI 2.34.61 Command Reference](../../index.html) »