Skip to content
AWS for Query.Farm

aws.cognito_idp.describe_risk_configuration

Example SQL Queries

SELECT * FROM
aws.cognito_idp.describe_risk_configuration
WHERE
"user_pool_id" = 'VALUE';

Description

Describes the risk configuration.

Table Definition

Column NameColumn Data Type
user_pool_id Required Input Column

The user pool ID.

VARCHAR
client_id Input Column

The app client ID.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
risk_configuration

The risk configuration.

STRUCT(
    "user_pool_id" VARCHAR,
    "client_id" VARCHAR,
    "compromised_credentials_risk_configuration" STRUCT(
        "event_filter" VARCHAR[],
        "actions" STRUCT(
            "event_action" VARCHAR
        )
    ),
    "account_takeover_risk_configuration" STRUCT(
        "notify_configuration" STRUCT(
            "from" VARCHAR,
            "reply_to" VARCHAR,
            "source_arn" VARCHAR,
            "block_email" STRUCT(
                "subject" VARCHAR,
                "html_body" VARCHAR,
                "text_body" VARCHAR
            ),
            "no_action_email" STRUCT(
                "subject" VARCHAR,
                "html_body" VARCHAR,
                "text_body" VARCHAR
            ),
            "mfa_email" STRUCT(
                "subject" VARCHAR,
                "html_body" VARCHAR,
                "text_body" VARCHAR
            )
        ),
        "actions" STRUCT(
            "low_action" STRUCT(
                "notify" BOOLEAN,
                "event_action" VARCHAR
            ),
            "medium_action" STRUCT(
                "notify" BOOLEAN,
                "event_action" VARCHAR
            ),
            "high_action" STRUCT(
                "notify" BOOLEAN,
                "event_action" VARCHAR
            )
        )
    ),
    "risk_exception_configuration" STRUCT(
        "blocked_ip_range_list" VARCHAR[],
        "skipped_ip_range_list" VARCHAR[]
    ),
    "last_modified_date" TIMESTAMP_S
)
Show child fields
risk_configuration.account_takeover_risk_configuration

The account takeover risk configuration object, including the NotifyConfiguration object and Actions to take if there is an account takeover.

Show child fields
risk_configuration.account_takeover_risk_configuration.actions

Account takeover risk configuration actions.

Show child fields
risk_configuration.account_takeover_risk_configuration.actions.high_action

Action to take for a high risk.

Show child fields
risk_configuration.account_takeover_risk_configuration.actions.high_action.event_action

The action to take in response to the account takeover action. Valid values are as follows:

  • BLOCK Choosing this action will block the request.

  • MFA_IF_CONFIGURED Present an MFA challenge if user has configured it, else allow the request.

  • MFA_REQUIRED Present an MFA challenge if user has configured it, else block the request.

  • NO_ACTION Allow the user to sign in.

risk_configuration.account_takeover_risk_configuration.actions.high_action.notify

Flag specifying whether to send a notification.

risk_configuration.account_takeover_risk_configuration.actions.low_action

Action to take for a low risk.

Show child fields
risk_configuration.account_takeover_risk_configuration.actions.low_action.event_action

The action to take in response to the account takeover action. Valid values are as follows:

  • BLOCK Choosing this action will block the request.

  • MFA_IF_CONFIGURED Present an MFA challenge if user has configured it, else allow the request.

  • MFA_REQUIRED Present an MFA challenge if user has configured it, else block the request.

  • NO_ACTION Allow the user to sign in.

risk_configuration.account_takeover_risk_configuration.actions.low_action.notify

Flag specifying whether to send a notification.

risk_configuration.account_takeover_risk_configuration.actions.medium_action

Action to take for a medium risk.

Show child fields
risk_configuration.account_takeover_risk_configuration.actions.medium_action.event_action

The action to take in response to the account takeover action. Valid values are as follows:

  • BLOCK Choosing this action will block the request.

  • MFA_IF_CONFIGURED Present an MFA challenge if user has configured it, else allow the request.

  • MFA_REQUIRED Present an MFA challenge if user has configured it, else block the request.

  • NO_ACTION Allow the user to sign in.

risk_configuration.account_takeover_risk_configuration.actions.medium_action.notify

Flag specifying whether to send a notification.

risk_configuration.account_takeover_risk_configuration.notify_configuration

The notify configuration used to construct email notifications.

Show child fields
risk_configuration.account_takeover_risk_configuration.notify_configuration.block_email

Email template used when a detected risk event is blocked.

Show child fields
risk_configuration.account_takeover_risk_configuration.notify_configuration.block_email.html_body

The email HTML body.

risk_configuration.account_takeover_risk_configuration.notify_configuration.block_email.subject

The email subject.

risk_configuration.account_takeover_risk_configuration.notify_configuration.block_email.text_body

The email text body.

risk_configuration.account_takeover_risk_configuration.notify_configuration.from

The email address that is sending the email. The address must be either individually verified with Amazon Simple Email Service, or from a domain that has been verified with Amazon SES.

risk_configuration.account_takeover_risk_configuration.notify_configuration.mfa_email

The multi-factor authentication (MFA) email template used when MFA is challenged as part of a detected risk.

Show child fields
risk_configuration.account_takeover_risk_configuration.notify_configuration.mfa_email.html_body

The email HTML body.

risk_configuration.account_takeover_risk_configuration.notify_configuration.mfa_email.subject

The email subject.

risk_configuration.account_takeover_risk_configuration.notify_configuration.mfa_email.text_body

The email text body.

risk_configuration.account_takeover_risk_configuration.notify_configuration.no_action_email

The email template used when a detected risk event is allowed.

Show child fields
risk_configuration.account_takeover_risk_configuration.notify_configuration.no_action_email.html_body

The email HTML body.

risk_configuration.account_takeover_risk_configuration.notify_configuration.no_action_email.subject

The email subject.

risk_configuration.account_takeover_risk_configuration.notify_configuration.no_action_email.text_body

The email text body.

risk_configuration.account_takeover_risk_configuration.notify_configuration.reply_to

The destination to which the receiver of an email should reply to.

risk_configuration.account_takeover_risk_configuration.notify_configuration.source_arn

The Amazon Resource Name (ARN) of the identity that is associated with the sending authorization policy. This identity permits Amazon Cognito to send for the email address specified in the From parameter.

risk_configuration.client_id

The app client ID.

risk_configuration.compromised_credentials_risk_configuration

The compromised credentials risk configuration object, including the EventFilter and the EventAction.

Show child fields
risk_configuration.compromised_credentials_risk_configuration.actions

The compromised credentials risk configuration actions.

Show child fields
risk_configuration.compromised_credentials_risk_configuration.actions.event_action

The event action.

risk_configuration.compromised_credentials_risk_configuration.event_filter[]
risk_configuration.last_modified_date

The date and time when the item was modified. Amazon Cognito returns this timestamp in UNIX epoch time format. Your SDK might render the output in a human-readable format like ISO 8601 or a Java Date object.

risk_configuration.risk_exception_configuration

The configuration to override the risk decision.

Show child fields
risk_configuration.risk_exception_configuration.blocked_ip_range_list[]
risk_configuration.risk_exception_configuration.skipped_ip_range_list[]
risk_configuration.user_pool_id

The user pool ID.