Amazon Cognito enhances client secret management with secret rotation and custom secrets

Amazon Cognito Client Secret Lifecycle Management

Amazon Cognito has introduced enhancements to client secret lifecycle management for app clients of Cognito user pools, including client secret rotation and support for custom client secrets. This update allows for secure sign-in and access control for users, AI agents, and microservices.

• New Features: Option to bring your own custom client secrets for new or existing app clients and rotate client secrets on-demand.
• Benefits: Address needs for organizations with periodic credential rotation requirements, improve security posture, and facilitate migration from other authentication systems to Cognito.
• Active Secrets: Maintain up to two active client secrets per app client to allow a gradual transition to the new secret without application downtime.

What to do

• Use the new capabilities through the AWS Management Console, AWS CLI, AWS SDKs, or AWS CloudFormation.
• Refer to the Amazon Cognito Developer Guide for more information.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.