user_pool_client_secrets

Creates, updates, deletes, gets or lists a user_pool_client_secrets resource.

Overview

Name	user_pool_client_secrets
Type	Resource
Id	aws.cognito_idp.user_pool_client_secrets

Fields

The following fields are returned by SELECT queries:

list_user_pool_client_secrets

Name	Datatype	Description
client_secrets	array	A list of client secret descriptors containing the identifier and creation date for each secret. For security reasons, the response never reveals the actual secret value in ClientSecretValue.
next_token	string	The identifier that Amazon Cognito returned with the previous request to this operation. When you include a pagination token in your request, Amazon Cognito returns the next set of items in the list. By use of this token, you can paginate through the full list of items. (pattern: <code>[\S]+</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_user_pool_client_secrets	select	region		Lists all client secrets associated with a user pool app client. Returns metadata about the secrets. The response does not include pagination tokens as there are only 2 secrets at any given time and we return both with every ListUserPoolClientSecrets call. For security reasons, the response never reveals the actual secret value in ClientSecretValue.
add_user_pool_client_secret	update	region, UserPoolId, ClientId		Creates a new client secret for an existing confidential user pool app client. Supports up to 2 active secrets per app client for zero-downtime credential rotation workflows.
delete_user_pool_client_secret	delete	region		Deletes a specific client secret from a user pool app client. You cannot delete the last remaining secret for an app client.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

list_user_pool_client_secrets

Lists all client secrets associated with a user pool app client. Returns metadata about the secrets. The response does not include pagination tokens as there are only 2 secrets at any given time and we return both with every ListUserPoolClientSecrets call. For security reasons, the response never reveals the actual secret value in ClientSecretValue.

SELECT
client_secrets,
next_token
FROM aws.cognito_idp.user_pool_client_secrets
WHERE region = '{{ region }}' -- required
;

UPDATE examples

add_user_pool_client_secret

Creates a new client secret for an existing confidential user pool app client. Supports up to 2 active secrets per app client for zero-downtime credential rotation workflows.

UPDATE aws.cognito_idp.user_pool_client_secrets
SET 
UserPoolId = '{{ UserPoolId }}',
ClientId = '{{ ClientId }}',
ClientSecret = '{{ ClientSecret }}'
WHERE 
region = '{{ region }}' --required
AND UserPoolId = '{{ UserPoolId }}' --required
AND ClientId = '{{ ClientId }}' --required
RETURNING
client_secret_descriptor;

DELETE examples

delete_user_pool_client_secret

Deletes a specific client secret from a user pool app client. You cannot delete the last remaining secret for an app client.

DELETE FROM aws.cognito_idp.user_pool_client_secrets
WHERE region = '{{ region }}' --required
;