{
  "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/list_cognito-idp.html",
  "name": "Amazon Cognito User Pools",
  "prefix": "cognito-idp",
  "timestamp": "1786363206",
  "actions": [
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AddCustomAttributes.html",
      "name": "AddCustomAttributes",
      "description": "Grants permission to add user attributes to the user pool schema",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AddUserPoolClientSecret.html",
      "name": "AddUserPoolClientSecret",
      "description": "Grants permission to add a new secret to a confidential client",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminAddUserToGroup.html",
      "name": "AdminAddUserToGroup",
      "description": "Grants permission to add any user to any group",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminConfirmSignUp.html",
      "name": "AdminConfirmSignUp",
      "description": "Grants permission to confirm any user's registration without a confirmation code",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminCreateUser.html",
      "name": "AdminCreateUser",
      "description": "Grants permission to create new users and send welcome messages via email or SMS",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUser.html",
      "name": "AdminDeleteUser",
      "description": "Grants permission to delete any user",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDeleteUserAttributes.html",
      "name": "AdminDeleteUserAttributes",
      "description": "Grants permission to delete attributes from any user",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDisableProviderForUser.html",
      "name": "AdminDisableProviderForUser",
      "description": "Grants permission to unlink any user pool user from a third-party identity provider (IdP) user",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminDisableUser.html",
      "name": "AdminDisableUser",
      "description": "Grants permission to deactivate any user",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminEnableUser.html",
      "name": "AdminEnableUser",
      "description": "Grants permission to activate any user",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminForgetDevice.html",
      "name": "AdminForgetDevice",
      "description": "Grants permission to deregister any user's devices",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetDevice.html",
      "name": "AdminGetDevice",
      "description": "Grants permission to get information about any user's devices",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.html",
      "name": "AdminGetUser",
      "description": "Grants permission to look up any user by user name",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUserAuthFactors.html",
      "name": "AdminGetUserAuthFactors",
      "description": "Grants permission to look up any user's configured auth factors",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminInitiateAuth.html",
      "name": "AdminInitiateAuth",
      "description": "Grants permission to authenticate any user",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminLinkProviderForUser.html",
      "name": "AdminLinkProviderForUser",
      "description": "Grants permission to link any user pool user to a third-party IdP user",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListDevices.html",
      "name": "AdminListDevices",
      "description": "Grants permission to list any user's remembered devices",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListGroupsForUser.html",
      "name": "AdminListGroupsForUser",
      "description": "Grants permission to list the groups that any user belongs to",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminListUserAuthEvents.html",
      "name": "AdminListUserAuthEvents",
      "description": "Grants permission to lists sign-in events for any user",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRemoveUserFromGroup.html",
      "name": "AdminRemoveUserFromGroup",
      "description": "Grants permission to remove any user from any group",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminResetUserPassword.html",
      "name": "AdminResetUserPassword",
      "description": "Grants permission to reset any user's password",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminRespondToAuthChallenge.html",
      "name": "AdminRespondToAuthChallenge",
      "description": "Grants permission to respond to an authentication challenge during the authentication of any user",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserMFAPreference.html",
      "name": "AdminSetUserMFAPreference",
      "description": "Grants permission to set any user's preferred MFA method",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserPassword.html",
      "name": "AdminSetUserPassword",
      "description": "Grants permission to set any user's password",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserSettings.html",
      "name": "AdminSetUserSettings",
      "description": "Grants permission to set user settings for any user",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateAuthEventFeedback.html",
      "name": "AdminUpdateAuthEventFeedback",
      "description": "Grants permission to update advanced security feedback for any user's authentication event",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateDeviceStatus.html",
      "name": "AdminUpdateDeviceStatus",
      "description": "Grants permission to update the status of any user's remembered devices",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUpdateUserAttributes.html",
      "name": "AdminUpdateUserAttributes",
      "description": "Grants permission to updates any user's standard or custom attributes",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.html",
      "name": "AdminUserGlobalSignOut",
      "description": "Grants permission to sign out any user from all sessions",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AssociateSoftwareToken.html",
      "name": "AssociateSoftwareToken",
      "description": "Grants permission to return a unique generated shared secret key code for the user",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/${UserGuideDocPage}user-pool-waf.html",
      "name": "AssociateWebACL",
      "description": "Grants permission to associate the user pool with an AWS WAF web ACL",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        },
        {
          "name": "webacl",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ChangePassword.html",
      "name": "ChangePassword",
      "description": "Grants permission to change the password for a specified user in a user pool",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmDevice.html",
      "name": "ConfirmDevice",
      "description": "Grants permission to confirm tracking of the device. This API call is the call that begins device tracking",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmForgotPassword.html",
      "name": "ConfirmForgotPassword",
      "description": "Grants permission to allow a user to enter a confirmation code to reset a forgotten password",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ConfirmSignUp.html",
      "name": "ConfirmSignUp",
      "description": "Grants permission to confirm registration of a user and handles the existing alias from a previous user",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateGroup.html",
      "name": "CreateGroup",
      "description": "Grants permission to create new user pool groups",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateIdentityProvider.html",
      "name": "CreateIdentityProvider",
      "description": "Grants permission to add identity providers to user pools",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateManagedLoginBranding.html",
      "name": "CreateManagedLoginBranding",
      "description": "Grants permission to create a branding settings for managed login and associate it with an app client",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateResourceServer.html",
      "name": "CreateResourceServer",
      "description": "Grants permission to create and configure scopes for OAuth 2.0 resource servers",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateTerms.html",
      "name": "CreateTerms",
      "description": "Grants permission to create terms and associate it with an app client",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserImportJob.html",
      "name": "CreateUserImportJob",
      "description": "Grants permission to create user CSV import jobs",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPool.html",
      "name": "CreateUserPool",
      "description": "Grants permission to create and set password policy for user pools",
      "access": "Write",
      "resources": [],
      "conditions": [
        "aws:RequestTag/${TagKey}",
        "aws:ResourceTag/${TagKey}",
        "aws:TagKeys"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolClient.html",
      "name": "CreateUserPoolClient",
      "description": "Grants permission to create user pool app clients",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolDomain.html",
      "name": "CreateUserPoolDomain",
      "description": "Grants permission to add user pool domains",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolReplica.html",
      "name": "CreateUserPoolReplica",
      "description": "Grants permission to create a replica of a user pool",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteGroup.html",
      "name": "DeleteGroup",
      "description": "Grants permission to delete any empty user pool group",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteIdentityProvider.html",
      "name": "DeleteIdentityProvider",
      "description": "Grants permission to delete any identity provider from user pools",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteManagedLoginBranding.html",
      "name": "DeleteManagedLoginBranding",
      "description": "Grants permission to delete the managed login branding style for any app client",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteResourceServer.html",
      "name": "DeleteResourceServer",
      "description": "Grants permission to delete any OAuth 2.0 resource server from user pools",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteTerms.html",
      "name": "DeleteTerms",
      "description": "Grants permission to delete terms for an app client",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUser.html",
      "name": "DeleteUser",
      "description": "Grants permission to allow a user to delete one's self",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserAttributes.html",
      "name": "DeleteUserAttributes",
      "description": "Grants permission to delete the attributes for a user",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPool.html",
      "name": "DeleteUserPool",
      "description": "Grants permission to delete user pools",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolClient.html",
      "name": "DeleteUserPoolClient",
      "description": "Grants permission to delete any user pool app client",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolClientSecret.html",
      "name": "DeleteUserPoolClientSecret",
      "description": "Grants permission to delete a secret from a list of secrets associated with a client",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolDomain.html",
      "name": "DeleteUserPoolDomain",
      "description": "Grants permission to delete any user pool domain",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DeleteUserPoolReplica.html",
      "name": "DeleteUserPoolReplica",
      "description": "Grants permission to delete a replica of a user pool",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeIdentityProvider.html",
      "name": "DescribeIdentityProvider",
      "description": "Grants permission to describe any user pool identity provider",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeManagedLoginBranding.html",
      "name": "DescribeManagedLoginBranding",
      "description": "Grants permission to get the detailed information about the branding style of managed login",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeManagedLoginBrandingByClient.html",
      "name": "DescribeManagedLoginBrandingByClient",
      "description": "Grants permission to get the detailed information about the branding style of managed login associated with an appclient",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeResourceServer.html",
      "name": "DescribeResourceServer",
      "description": "Grants permission to describe any OAuth 2.0 resource server",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeRiskConfiguration.html",
      "name": "DescribeRiskConfiguration",
      "description": "Grants permission to describe the risk configuration settings of user pools and app clients",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeTerms.html",
      "name": "DescribeTerms",
      "description": "Grants permission to get the detailed information about terms for an app client",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserImportJob.html",
      "name": "DescribeUserImportJob",
      "description": "Grants permission to describe any user import job",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPool.html",
      "name": "DescribeUserPool",
      "description": "Grants permission to describe user pools",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPoolClient.html",
      "name": "DescribeUserPoolClient",
      "description": "Grants permission to describe any user pool app client",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_DescribeUserPoolDomain.html",
      "name": "DescribeUserPoolDomain",
      "description": "Grants permission to describe any user pool domain",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/${UserGuideDocPage}user-pool-waf.html",
      "name": "DisassociateWebACL",
      "description": "Grants permission to disassociate the user pool with an AWS WAF web ACL",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgetDevice.html",
      "name": "ForgetDevice",
      "description": "Grants permission to forget the specified device",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ForgotPassword.html",
      "name": "ForgotPassword",
      "description": "Grants permission to send a message to the end user with a confirmation code that is required to change the user's password",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetCSVHeader.html",
      "name": "GetCSVHeader",
      "description": "Grants permission to generate headers for a user import .csv file",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetDevice.html",
      "name": "GetDevice",
      "description": "Grants permission to get the device",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetGroup.html",
      "name": "GetGroup",
      "description": "Grants permission to describe a user pool group",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetIdentityProviderByIdentifier.html",
      "name": "GetIdentityProviderByIdentifier",
      "description": "Grants permission to correlate a user pool IdP identifier to the IdP Name",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetLogDeliveryConfiguration.html",
      "name": "GetLogDeliveryConfiguration",
      "description": "Grants permission to get the detailed activity logging configuration for a user pool",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetProvisionedLimit.html",
      "name": "GetProvisionedLimit",
      "description": "Grants permission to get a provisioned limit for the AWS account",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetSigningCertificate.html",
      "name": "GetSigningCertificate",
      "description": "Grants permission to look up signing certificates for user pools",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetTokensFromRefreshToken.html",
      "name": "GetTokensFromRefreshToken",
      "description": "Grants permission to update user tokens with refresh tokens",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUICustomization.html",
      "name": "GetUICustomization",
      "description": "Grants permission to get UI customization information for the hosted UI of any app client",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUser.html",
      "name": "GetUser",
      "description": "Grants permission to get the user attributes and metadata for a user",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserAttributeVerificationCode.html",
      "name": "GetUserAttributeVerificationCode",
      "description": "Grants permission to get the user attribute verification code for the specified attribute name",
      "access": "Read",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUserPoolMfaConfig.html",
      "name": "GetUserPoolMfaConfig",
      "description": "Grants permission to look up the MFA configuration of user pools",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/${UserGuideDocPage}user-pool-waf.html",
      "name": "GetWebACLForResource",
      "description": "Grants permission to get the AWS WAF web ACL that is associated with an Amazon Cognito user pool",
      "access": "Read",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GlobalSignOut.html",
      "name": "GlobalSignOut",
      "description": "Grants permission to sign out users from all devices",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_InitiateAuth.html",
      "name": "InitiateAuth",
      "description": "Grants permission to initiate the authentication flow",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListDevices.html",
      "name": "ListDevices",
      "description": "Grants permission to list the devices",
      "access": "List",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListGroups.html",
      "name": "ListGroups",
      "description": "Grants permission to list all groups in user pools",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListIdentityProviders.html",
      "name": "ListIdentityProviders",
      "description": "Grants permission to list all identity providers in user pools",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListResourceServers.html",
      "name": "ListResourceServers",
      "description": "Grants permission to list all resource servers in user pools",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/service-authorization/latest/reference/${UserGuideDocPage}user-pool-waf.html",
      "name": "ListResourcesForWebACL",
      "description": "Grants permission to list the user pools that are associated with an AWS WAF web ACL",
      "access": "List",
      "resources": [
        {
          "name": "webacl",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListTagsForResource.html",
      "name": "ListTagsForResource",
      "description": "Grants permission to list the tags that are assigned to an Amazon Cognito user pool",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": false
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListTerms.html",
      "name": "ListTerms",
      "description": "Grants permission to list all terms for a user pool",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserImportJobs.html",
      "name": "ListUserImportJobs",
      "description": "Grants permission to list all user import jobs",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPoolClientSecrets.html",
      "name": "ListUserPoolClientSecrets",
      "description": "Grants permission to list all secrets associated with a client",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPoolClients.html",
      "name": "ListUserPoolClients",
      "description": "Grants permission to list all app clients in user pools",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPoolReplicas.html",
      "name": "ListUserPoolReplicas",
      "description": "Grants permission to list replicas of a user pool",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUserPools.html",
      "name": "ListUserPools",
      "description": "Grants permission to list all user pools",
      "access": "List",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html",
      "name": "ListUsers",
      "description": "Grants permission to list all user pool users",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsersInGroup.html",
      "name": "ListUsersInGroup",
      "description": "Grants permission to list the users in any group",
      "access": "List",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ResendConfirmationCode.html",
      "name": "ResendConfirmationCode",
      "description": "Grants permission to resend the confirmation (for confirmation of registration) to a specific user in the user pool",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RespondToAuthChallenge.html",
      "name": "RespondToAuthChallenge",
      "description": "Grants permission to respond to the authentication challenge",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_RevokeToken.html",
      "name": "RevokeToken",
      "description": "Grants permission to revoke all of the access tokens generated by the specified refresh token",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetLogDeliveryConfiguration.html",
      "name": "SetLogDeliveryConfiguration",
      "description": "Grants permission to set up or modify the detailed activity logging configuration of a user pool",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetRiskConfiguration.html",
      "name": "SetRiskConfiguration",
      "description": "Grants permission to set risk configuration for user pools and app clients",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUICustomization.html",
      "name": "SetUICustomization",
      "description": "Grants permission to customize the hosted UI for any app client",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserMFAPreference.html",
      "name": "SetUserMFAPreference",
      "description": "Grants permission to set MFA preference for the user in the userpool",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserPoolMfaConfig.html",
      "name": "SetUserPoolMfaConfig",
      "description": "Grants permission to set user pool MFA configuration",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SetUserSettings.html",
      "name": "SetUserSettings",
      "description": "Grants permission to set the user settings like multi-factor authentication (MFA)",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_SignUp.html",
      "name": "SignUp",
      "description": "Grants permission to register the user in the specified user pool and creates a user name, password, and user attributes",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StartUserImportJob.html",
      "name": "StartUserImportJob",
      "description": "Grants permission to start any user import job",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_StopUserImportJob.html",
      "name": "StopUserImportJob",
      "description": "Grants permission to stop any user import job",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_TagResource.html",
      "name": "TagResource",
      "description": "Grants permission to tag a user pool",
      "access": "Tagging",
      "resources": [
        {
          "name": "userpool",
          "is_required": false
        }
      ],
      "conditions": [
        "aws:RequestTag/${TagKey}",
        "aws:TagKeys"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UntagResource.html",
      "name": "UntagResource",
      "description": "Grants permission to untag a user pool",
      "access": "Tagging",
      "resources": [
        {
          "name": "userpool",
          "is_required": false
        }
      ],
      "conditions": [
        "aws:TagKeys"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateAuthEventFeedback.html",
      "name": "UpdateAuthEventFeedback",
      "description": "Grants permission to update the feedback for the user authentication event",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateDeviceStatus.html",
      "name": "UpdateDeviceStatus",
      "description": "Grants permission to update the device status",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateGroup.html",
      "name": "UpdateGroup",
      "description": "Grants permission to update the configuration of any group",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateIdentityProvider.html",
      "name": "UpdateIdentityProvider",
      "description": "Grants permission to update the configuration of any user pool IdP",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateManagedLoginBranding.html",
      "name": "UpdateManagedLoginBranding",
      "description": "Grants permission to update the branding settings of a managed login",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateProvisionedLimit.html",
      "name": "UpdateProvisionedLimit",
      "description": "Grants permission to update a provisioned limit for the AWS account",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateResourceServer.html",
      "name": "UpdateResourceServer",
      "description": "Grants permission to update the configuration of any OAuth 2.0 resource server",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateTerms.html",
      "name": "UpdateTerms",
      "description": "Grants permission to update terms for an app client",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserAttributes.html",
      "name": "UpdateUserAttributes",
      "description": "Grants permission to allow a user to update a specific attribute (one at a time)",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPool.html",
      "name": "UpdateUserPool",
      "description": "Grants permission to updates the configuration of user pools",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": [
        "aws:RequestTag/${TagKey}",
        "aws:TagKeys"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolClient.html",
      "name": "UpdateUserPoolClient",
      "description": "Grants permission to update any user pool client",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolDomain.html",
      "name": "UpdateUserPoolDomain",
      "description": "Grants permission to replace the certificate for any custom domain",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_UpdateUserPoolReplica.html",
      "name": "UpdateUserPoolReplica",
      "description": "Grants permission to update a replica of a user pool",
      "access": "Write",
      "resources": [
        {
          "name": "userpool",
          "is_required": true
        }
      ],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifySoftwareToken.html",
      "name": "VerifySoftwareToken",
      "description": "Grants permission to register a user's entered TOTP code and mark the user's software token MFA status as verified if successful",
      "access": "Write",
      "resources": [],
      "conditions": []
    },
    {
      "url": "https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_VerifyUserAttribute.html",
      "name": "VerifyUserAttribute",
      "description": "Grants permission to verify a user attribute using a one time verification code",
      "access": "Write",
      "resources": [],
      "conditions": []
    }
  ],
  "resources": [
    {
      "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools.html",
      "name": "userpool",
      "arn": "arn:${Partition}:cognito-idp:${Region}:${Account}:userpool/${UserPoolId}",
      "conditions": [
        "aws:ResourceTag/${TagKey}"
      ]
    },
    {
      "url": "https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html",
      "name": "webacl",
      "arn": "arn:${Partition}:wafv2:${Region}:${Account}:${Scope}/webacl/${Name}/${Id}",
      "conditions": []
    }
  ],
  "conditions": [
    {
      "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag",
      "name": "aws:RequestTag/${TagKey}",
      "description": "Filters access by the presence of tag key-value pairs in the request",
      "type": "String"
    },
    {
      "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag",
      "name": "aws:ResourceTag/${TagKey}",
      "description": "Filters access by tag key-value pairs attached to the resource",
      "type": "String"
    },
    {
      "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys",
      "name": "aws:TagKeys",
      "description": "Filters access by a key that is present in the request",
      "type": "ArrayOfString"
    }
  ]
}