risk_configurations

Creates, updates, deletes, gets or lists a risk_configurations resource.

Overview

Name	risk_configurations
Type	Resource
Id	aws.cognito_idp.risk_configurations

Fields

The following fields are returned by SELECT queries:

describe_risk_configuration

Name	Datatype	Description
account_takeover_risk_configuration	object	The settings for automated responses and notification templates for adaptive authentication with threat protection.
client_id	string	The app client where this configuration is applied. When this parameter isn't present, the risk configuration applies to all user pool app clients that don't have client-level settings. (pattern: <code>[\w+]+</code>)
compromised_credentials_risk_configuration	object	Settings for compromised-credentials actions and authentication types with threat protection in full-function ENFORCED mode.
last_modified_date	string (date-time)	The date and time when the item was modified. Amazon Cognito returns this timestamp in UNIX epoch time format. Your SDK might render the output in a human-readable format like ISO 8601 or a Java Date object.
risk_exception_configuration	object	Exceptions to the risk evaluation configuration, including always-allow and always-block IP address ranges.
user_pool_id	string	The ID of the user pool that has the risk configuration applied. (pattern: <code>[\w-]+_[0-9a-zA-Z]+</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_risk_configuration	select	region		Given an app client or user pool ID where threat protection is configured, describes the risk configuration. This operation returns details about adaptive authentication, compromised credentials, and IP-address allow- and denylists. For more information about threat protection, see Threat protection.
set_risk_configuration	update	region, UserPoolId		Configures threat protection for a user pool or app client. Sets configuration for the following. Responses to risks with adaptive authentication Responses to vulnerable passwords with compromised-credentials detection Notifications to users who have had risky activity detected IP-address denylist and allowlist To set the risk configuration for the user pool to defaults, send this request with only the UserPoolId parameter. To reset the threat protection settings of an app client to be inherited from the user pool, send UserPoolId and ClientId parameters only. To change threat protection to audit-only or off, update the value of UserPoolAddOns in an UpdateUserPool request. To activate this setting, your user pool must be on the Plus tier. In secondary regions for user pools with multi-region replication, only the SourceARN and From attributes of NotifyConfiguration can be modified to configure region-specific SES integration. All other risk configuration settings must match the existing values to maintain consistency across replicas.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_risk_configuration

Given an app client or user pool ID where threat protection is configured, describes the risk configuration. This operation returns details about adaptive authentication, compromised credentials, and IP-address allow- and denylists. For more information about threat protection, see Threat protection.

SELECT
account_takeover_risk_configuration,
client_id,
compromised_credentials_risk_configuration,
last_modified_date,
risk_exception_configuration,
user_pool_id
FROM aws.cognito_idp.risk_configurations
WHERE region = '{{ region }}' -- required
;

UPDATE examples

set_risk_configuration

Configures threat protection for a user pool or app client. Sets configuration for the following. Responses to risks with adaptive authentication Responses to vulnerable passwords with compromised-credentials detection Notifications to users who have had risky activity detected IP-address denylist and allowlist To set the risk configuration for the user pool to defaults, send this request with only the UserPoolId parameter. To reset the threat protection settings of an app client to be inherited from the user pool, send UserPoolId and ClientId parameters only. To change threat protection to audit-only or off, update the value of UserPoolAddOns in an UpdateUserPool request. To activate this setting, your user pool must be on the Plus tier. In secondary regions for user pools with multi-region replication, only the SourceARN and From attributes of NotifyConfiguration can be modified to configure region-specific SES integration. All other risk configuration settings must match the existing values to maintain consistency across replicas.

UPDATE aws.cognito_idp.risk_configurations
SET 
UserPoolId = '{{ UserPoolId }}',
ClientId = '{{ ClientId }}',
CompromisedCredentialsRiskConfiguration = '{{ CompromisedCredentialsRiskConfiguration }}',
AccountTakeoverRiskConfiguration = '{{ AccountTakeoverRiskConfiguration }}',
RiskExceptionConfiguration = '{{ RiskExceptionConfiguration }}'
WHERE 
region = '{{ region }}' --required
AND UserPoolId = '{{ UserPoolId }}' --required
RETURNING
risk_configuration;