AWS cognito: Grammar cleanup in Cognito user group precedence docs
Summary
Multiple tense/grammar edits ("will be chosen" to "is chosen", "will have its IAM role applied" to "has its IAM role applied", "automatically-generated" to "automatically generated") in the user groups and group precedence documentation.
Security assessment
The changes are purely stylistic tense/grammar corrections. The described behavior of group precedence determining which IAM role is applied to the cognito:preferred_role claim is unchanged, so there is no new security guidance or vulnerability remediation.
Evidence
+ * You can assign precedence values to each group. The group with the better (lower) precedence is chosen and its associated IAM role is applied.
Diff
diff --git a/cognito/latest/developerguide/cognito-user-pools-user-groups.md b/cognito/latest/developerguide/cognito-user-pools-user-groups.md index 08f0ccf..77122b1 100644 --- a//cognito/latest/developerguide/cognito-user-pools-user-groups.md +++ b//cognito/latest/developerguide/cognito-user-pools-user-groups.md @@ -15 +15 @@ You can use groups to create a collection of users in a user pool, which is ofte -Amazon Cognito creates a user group for each OIDC, SAMl, and social [identity provider](./cognito-user-pools-identity-federation.html#cognito-user-pools-identity-federation-how-it-works) (IdP) that you add to your user pool. The name of the group is in the format `[user pool ID]_[IdP name]`, for example `us-east-1_EXAMPLE_MYSSO` or `us-east-1_EXAMPLE_Google`. Each unique automatically-generated IdP user profile is automatically added to this group. [Linked users](./cognito-user-pools-identity-federation-consolidate-users.html) aren't automatically added to this group, but you can add their profiles to the group in a separate process. +Amazon Cognito creates a user group for each OIDC, SAMl, and social [identity provider](./cognito-user-pools-identity-federation.html#cognito-user-pools-identity-federation-how-it-works) (IdP) that you add to your user pool. The name of the group is in the format `[user pool ID]_[IdP name]`, for example `us-east-1_EXAMPLE_MYSSO` or `us-east-1_EXAMPLE_Google`. Each unique automatically generated IdP user profile is automatically added to this group. [Linked users](./cognito-user-pools-identity-federation-consolidate-users.html) aren't automatically added to this group, but you can add their profiles to the group in a separate process. @@ -29 +29 @@ Individual users can be in multiple groups. As a developer, you have the followi - * You can assign precedence values to each group. The group with the better (lower) precedence will be chosen and its associated IAM role will be applied. + * You can assign precedence values to each group. The group with the better (lower) precedence is chosen and its associated IAM role is applied. @@ -40 +40 @@ A user can belong to more than one group. In the user's access and ID tokens, th -Because a user can belong to more than one group, each group can be assigned a precedence. This is a non-negative number that specifies the precedence of this group relative to the other groups that a user belongs to in the user pool. Zero is the top precedence value. Groups with lower precedence values take precedence over groups with higher or null precedence values. If a user belongs to two or more groups, the group with the lowest precedence value will have its IAM role applied to the `cognito:preferred_role` claim in the user's ID token. +Because a user can belong to more than one group, each group can be assigned a precedence. This is a non-negative number that specifies the precedence of this group relative to the other groups that a user belongs to in the user pool. Zero is the top precedence value. Groups with lower precedence values take precedence over groups with higher or null precedence values. If a user belongs to two or more groups, the group with the lowest precedence value has its IAM role applied to the `cognito:preferred_role` claim in the user's ID token. @@ -85 +85 @@ Use the following procedure to create a new group. - * **Precedence** \- Amazon Cognito evaluates and applies all group permissions for a given user based on which groups that they belong to has a lower precedence value. The group with the lower precedence will be chosen and its associated IAM role will be applied. For more information, see Assigning precedence values to groups. + * **Precedence** \- Amazon Cognito evaluates and applies all group permissions for a given user based on which groups that they belong to has a lower precedence value. The group with the lower precedence is chosen and its associated IAM role is applied. For more information, see Assigning precedence values to groups.