Cognito Identity

eventName	Description	Sample	Rule
any	Catch-all entry for Cognito Identity rules that match the service but not a specific eventName.	N	N
GetCredentialsForIdentity	Returns temporary AWS credentials for a Cognito identity (identity-pool credential vending).	Y	Y
CreateIdentityPool	Creates a new identity pool.	Y	N
DeleteIdentities	Deletes identities from an identity pool.	Y	N
DeleteIdentityPool	Deletes an identity pool.	Y	N
DescribeIdentity	Returns metadata related to the given identity, including when the identity was created and any associated linked logins.	N	N
DescribeIdentityPool	Gets details about a particular identity pool, including the pool name, ID description, creation date, and current number of users.	Y	N
GetId	Generates (or retrieves) IdentityID.	N	N
GetIdentityPoolRoles	Gets the roles for an identity pool.	Y	N
GetOpenIdToken	Gets an OpenID token, using a known Cognito ID.	N	N
GetOpenIdTokenForDeveloperIdentity	Registers (or retrieves) a Cognito IdentityId and an OpenID Connect token for a user authenticated by your backend authentication process.	N	N
GetPrincipalTagAttributeMap	Use GetPrincipalTagAttributeMap to list all mappings between PrincipalTags and user attributes.	Y	N
ListIdentities	Lists the identities in an identity pool.	Y	N
ListIdentityPools	Lists all of the Cognito identity pools registered for your account.	Y	N
ListTagsForResource	Lists the tags that are assigned to an Amazon Cognito identity pool.	Y	N
LookupDeveloperIdentity	Retrieves the IdentityID associated with a DeveloperUserIdentifier or the list of DeveloperUserIdentifier values associated with an IdentityId for an existing identity.	Y	N
MergeDeveloperIdentities	Merges two users having different IdentityIds, existing in the same identity pool, and identified by the same developer provider.	Y	N
SetIdentityPoolRoles	Sets the roles for an identity pool.	Y	N
SetPrincipalTagAttributeMap	You can use this operation to use default (username and clientID) attribute or custom attribute mappings.	Y	N
TagResource	Assigns a set of tags to the specified Amazon Cognito identity pool.	Y	N
UnlinkDeveloperIdentity	Unlinks a DeveloperUserIdentifier from an existing identity.	Y	N
UnlinkIdentity	Unlinks a federated identity from an existing account.	N	N
UntagResource	Removes the specified tags from the specified Amazon Cognito identity pool.	Y	N
UpdateIdentityPool	Updates the configuration of an identity pool.	Y	N

any: Cognito Identity (catch-all)

Service: cognito-identity

Description

Catch-all entry for Cognito Identity rules that match the service but not a specific eventName.

GetCredentialsForIdentity

Service: cognito-identity

Description

Returns temporary AWS credentials for a Cognito identity (identity-pool credential vending).

Example CloudTrail Event #

{
  "eventVersion": "1.11",
  "userIdentity": {
    "type": "Unknown"
  },
  "eventTime": "2026-07-28T21:18:42Z",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventName": "GetCredentialsForIdentity",
  "awsRegion": "us-west-1",
  "sourceIPAddress": "203.0.113.5",
  "userAgent": "aws-cli/2.34.28 md/awscrt#0.31.2 ua/2.1 os/linux#6.1.0-51-amd64 md/arch#x86_64 lang/python#3.14.3 md/pyimpl#CPython m/Z,E,n,b cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#cognito-identity.get-credentials-for-identity",
  "requestParameters": {
    "identityId": "us-west-1:da2e8294-e31d-ca44-5905-e70e6baeb9bf"
  },
  "responseElements": {
    "credentials": {
      "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
      "sessionToken": "HIDDEN_DUE_TO_SECURITY_REASONS",
      "expiration": "2026-07-28T22:18:42Z"
    },
    "identityId": "us-west-1:da2e8294-e31d-ca44-5905-e70e6baeb9bf"
  },
  "requestID": "333e9d12-aa5f-4d0f-8382-2d52f40d7522",
  "eventID": "3f86aec4-ae74-433d-b78c-97acc9b7842c",
  "readOnly": false,
  "resources": [
    {
      "accountId": "123456789012",
      "type": "AWS::Cognito::IdentityPool",
      "ARN": "arn:aws:cognito-identity:us-west-1:123456789012:identitypool/us-west-1:3b1e80c0-f251-4b4d-863b-8632101213b2"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "123456789012",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`aws::errorCode` (sigma rule field)	eq	`accessdenied`	1 rule	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Attempt To Get Credentials For Identity source medium: Returns credentials for the provided identity ID. Any provided logins will be validated against supported login providers.T1078, T1078.004
Get Credentials For Identity source high: Returns credentials for the provided identity ID. Any provided logins will be validated against supported login providers.T1078, T1078.004

Elastic #

AWS Cognito Unauthenticated Identity Pool Credentials Issued source medium: Identifies AWS CloudTrail data events where an unauthenticated identity successfully retrieves temporary AWS credentials from a Cognito Identity Pool via GetCredentialsForIdentity. Cognito Identity Pools can be configured to allow unauthenticated (guest) access, intended for scenarios like anonymous app analytics, but a pool that grants those anonymous identities meaningful IAM permissions becomes a public, unauthenticated path to real AWS credentials. Adversaries who discover an identity pool ID (often embedded in mobile app binaries, web app JavaScript, or public source repositories) can call GetId followed by GetCredentialsForIdentity with no login token at all to obtain temporary credentials, then use them to access whatever the pool's unauthenticated role permits. This is a New Terms rule that limits alerting to identity pools that have not been observed issuing credentials to an unauthenticated caller before, since some applications intentionally and continuously use guest access as part of normal operation.T1078, T1078.004, T1552

CreateIdentityPool

Service: cognito-identity

Description

Creates a new identity pool.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "f08ed03c-1026-42db-905d-b6ad57616e8c",
  "eventName": "CreateIdentityPool",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T20:53:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "ba229f2c-d092-493b-9b3d-a55b81057572",
  "requestParameters": {
    "allowUnauthenticatedIdentities": false,
    "developerProviderName": "dwfix.sample",
    "identityPoolName": "dwfixsample",
    "identityPoolTags": {
      "project": "dwfix-sample"
    }
  },
  "responseElements": {
    "allowUnauthenticatedIdentities": false,
    "developerProviderName": "dwfix.sample",
    "identityPoolId": "us-west-1:20434a45-ca3e-4c55-9952-2723c7674b81",
    "identityPoolName": "dwfixsample",
    "identityPoolTags": {
      "project": "dwfix-sample"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteIdentities

Service: cognito-identity

Description

Deletes identities from an identity pool.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "796755e3-2ffc-489d-8d81-e253cabf468d",
  "eventName": "DeleteIdentities",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T20:53:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f4392ba0-67dd-4a59-a246-010fdf1f9d32",
  "requestParameters": {
    "identityIdsToDelete": [
      "us-west-1:da2e8294-e33c-cc25-14e4-e7bd393fa21b",
      "us-west-1:da2e8294-e346-c190-fe82-f4285845bcbb"
    ]
  },
  "responseElements": {
    "unprocessedIdentityIds": []
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteIdentityPool

Service: cognito-identity

Description

Deletes an identity pool.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'ddddd' at 'identityPoolId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\w-]+:[0-9a-f-]+",
  "eventCategory": "Management",
  "eventID": "6dd696f9-8e0b-4dd9-b02f-fb8eebeae392",
  "eventName": "DeleteIdentityPool",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T19:22:16Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "3ccd23ef-aad1-4194-9024-84866b0326ab",
  "requestParameters": {
    "identityPoolId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeIdentity

Service: cognito-identity

Description

Returns metadata related to the given identity, including when the identity was created and any associated linked logins.

DescribeIdentityPool

Service: cognito-identity

Description

Gets details about a particular identity pool, including the pool name, ID description, creation date, and current number of users.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'ddddd' at 'identityPoolId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\w-]+:[0-9a-f-]+",
  "eventCategory": "Management",
  "eventID": "8b66bef5-ff9f-41bb-b6b1-47e6a8182420",
  "eventName": "DescribeIdentityPool",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T18:43:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ff3cbd74-df85-4024-a8f2-659d433a1643",
  "requestParameters": {
    "identityPoolId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetId

Service: cognito-identity

Description

Generates (or retrieves) IdentityID.

GetIdentityPoolRoles

Service: cognito-identity

Description

Gets the roles for an identity pool.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'ddddd' at 'identityPoolId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\w-]+:[0-9a-f-]+",
  "eventCategory": "Management",
  "eventID": "165bd5bc-20b8-41fb-b1dc-b2c5eb26b455",
  "eventName": "GetIdentityPoolRoles",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T18:43:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5db9d1d3-6070-49aa-92ae-2a2bebfb55c7",
  "requestParameters": {
    "identityPoolId": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetOpenIdToken

Service: cognito-identity

Description

Gets an OpenID token, using a known Cognito ID.

GetOpenIdTokenForDeveloperIdentity

Service: cognito-identity

Description

Registers (or retrieves) a Cognito IdentityId and an OpenID Connect token for a user authenticated by your backend authentication process.

GetPrincipalTagAttributeMap

Service: cognito-identity

Description

Use GetPrincipalTagAttributeMap to list all mappings between PrincipalTags and user attributes.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'ddddd' at 'identityPoolId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\w-]+:[0-9a-f-]+",
  "eventCategory": "Management",
  "eventID": "c1ead282-3799-4888-a21a-83c5fa4e4298",
  "eventName": "GetPrincipalTagAttributeMap",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T18:43:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "7d6256ab-d726-482b-ad72-7e7fd84dbdc1",
  "requestParameters": {
    "identityPoolId": "ddddd",
    "identityProviderName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListIdentities

Service: cognito-identity

Description

Lists the identities in an identity pool.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'ddddd' at 'identityPoolId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\w-]+:[0-9a-f-]+",
  "eventCategory": "Management",
  "eventID": "009c5f5d-89fc-4cad-bfb9-1a75f3a523aa",
  "eventName": "ListIdentities",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T18:43:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3b00ab99-35b2-495d-9f5d-cf4cc964f7eb",
  "requestParameters": {
    "hideDisabled": false,
    "identityPoolId": "ddddd",
    "maxResults": 1
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListIdentityPools

Service: cognito-identity

Description

Lists all of the Cognito identity pools registered for your account.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventID": "33da7afb-4ae8-4071-b007-311efb7ade3b",
  "eventName": "ListIdentityPools",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2018-10-21T16:25:42Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "f444aeb9-d54d-11e8-abed-222098a4a245",
  "requestParameters": {
    "maxResults": 1
  },
  "responseElements": null,
  "sourceIPAddress": "9.245.1.85",
  "userAgent": "Boto3/1.7.4 Python/3.6.6 Linux/4.16.0-kali2-amd64 Botocore/1.10.4",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListTagsForResource

Service: cognito-identity

Description

Lists the tags that are assigned to an Amazon Cognito identity pool.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to access this resource",
  "eventCategory": "Management",
  "eventID": "5faed761-d28c-48ef-aa93-7cb315f349da",
  "eventName": "ListTagsForResource",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T18:43:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "5a37091e-c74d-4e18-85ff-54a17d564580",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

LookupDeveloperIdentity

Service: cognito-identity

Description

Retrieves the IdentityID associated with a DeveloperUserIdentifier or the list of DeveloperUserIdentifier values associated with an IdentityId for an existing identity.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "2 validation errors detected: Value 'ddddd' at 'identityPoolId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\w-]+:[0-9a-f-]+; Value '0' at 'maxResults' failed to satisfy constraint: Member must have value greater than or equal to 1",
  "eventCategory": "Management",
  "eventID": "c97e4faf-2de2-448c-b7ac-a9e7b5a71374",
  "eventName": "LookupDeveloperIdentity",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T18:43:03Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "aaae474f-b6f4-4c80-8e7c-24d3d33437fc",
  "requestParameters": {
    "identityPoolId": "ddddd",
    "maxResults": 0
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

MergeDeveloperIdentities

Service: cognito-identity

Description

Merges two users having different IdentityIds, existing in the same identity pool, and identified by the same developer provider.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "21805172-9373-405c-a7ac-7210f8d56e68",
  "eventName": "MergeDeveloperIdentities",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T20:53:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "dec72919-797d-4644-ac41-6722810ff26f",
  "requestParameters": {
    "destinationUserIdentifier": "dwfix-user-002",
    "developerProviderName": "dwfix.sample",
    "identityPoolId": "us-west-1:20434a45-ca3e-4c55-9952-2723c7674b81",
    "sourceUserIdentifier": "dwfix-user-001"
  },
  "responseElements": {
    "identityId": "us-west-1:da2e8294-e33c-cc25-14e4-e7bd393fa21b"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

SetIdentityPoolRoles

Service: cognito-identity

Description

Sets the roles for an identity pool.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "25977861-d2ad-40b0-b020-c216fa764258",
  "eventName": "SetIdentityPoolRoles",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T20:53:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "4d137666-f9a2-4be2-8890-1b4874029848",
  "requestParameters": {
    "identityPoolId": "us-west-1:20434a45-ca3e-4c55-9952-2723c7674b81",
    "roles": {}
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

SetPrincipalTagAttributeMap

Service: cognito-identity

Description

You can use this operation to use default (username and clientID) attribute or custom attribute mappings.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "InvalidParameterException",
  "errorMessage": "Provider dwfix.sample not configured for Identity Pool",
  "eventCategory": "Management",
  "eventID": "007ae68e-19c9-4397-b71b-973e15c460f4",
  "eventName": "SetPrincipalTagAttributeMap",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T20:53:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "5c0b5fe9-4bc8-4943-9abb-687d2411160c",
  "requestParameters": {
    "identityPoolId": "us-west-1:20434a45-ca3e-4c55-9952-2723c7674b81",
    "identityProviderName": "dwfix.sample",
    "useDefaults": true
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: cognito-identity

Description

Assigns a set of tags to the specified Amazon Cognito identity pool.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "d49ec967-2309-46b5-bfb6-3b78065e4af2",
  "eventName": "TagResource",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T20:53:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "73e736f4-0a69-491d-8fd8-41cb55c3a561",
  "requestParameters": {
    "resourceArn": "arn:aws:cognito-identity:us-west-1:123456789012:identitypool/us-west-1:20434a45-ca3e-4c55-9952-2723c7674b81",
    "tags": {
      "env": "dwfix-test",
      "purpose": "sample-collection"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UnlinkDeveloperIdentity

Service: cognito-identity

Description

Unlinks a DeveloperUserIdentifier from an existing identity.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "ef57afba-33ca-497b-9b9e-9d2148b4c37c",
  "eventName": "UnlinkDeveloperIdentity",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T20:53:02Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "20fa417b-45cf-43b4-8cd3-ef3e9a9e4809",
  "requestParameters": {
    "developerProviderName": "dwfix.sample",
    "developerUserIdentifier": "dwfix-user-003",
    "identityId": "us-west-1:da2e8294-e346-c190-fe82-f4285845bcbb",
    "identityPoolId": "us-west-1:20434a45-ca3e-4c55-9952-2723c7674b81"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b,n cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UnlinkIdentity

Service: cognito-identity

Description

Unlinks a federated identity from an existing account.

UntagResource

Service: cognito-identity

Description

Removes the specified tags from the specified Amazon Cognito identity pool.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::123456789012:user/sample-user is not authorized to access this resource",
  "eventCategory": "Management",
  "eventID": "c816ce5c-82f2-4939-80e4-158bde688644",
  "eventName": "UntagResource",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T19:22:16Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "91e20ae6-4bff-4c9e-ad81-d4777d1b8cb0",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateIdentityPool

Service: cognito-identity

Description

Updates the configuration of an identity pool.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "1 validation error detected: Value 'ddddd' at 'identityPoolId' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\w-]+:[0-9a-f-]+",
  "eventCategory": "Management",
  "eventID": "6f2f549a-0b0f-4994-a538-0a897594a2d0",
  "eventName": "UpdateIdentityPool",
  "eventSource": "cognito-identity.amazonaws.com",
  "eventTime": "2026-06-29T19:22:17Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "f4d290da-1619-4222-b012-920cfc2fd9c8",
  "requestParameters": {
    "allowUnauthenticatedIdentities": false,
    "identityPoolId": "ddddd",
    "identityPoolName": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "cognito-identity.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}