Amazon Cognito identity resources

Cognito classes describe user pools, clients, OAuth, recovery, schema attributes, groups, domains, and identity pools.

Source: mde/metamodels/psm/awspsm-identity.emf.

CognitoUserPool

Represents cognito user pool in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
userPoolName	String [1]	Stores the stable name/key/code used for user pool name on the cognito user pool. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Transformation role: ETL rule IdentityProvider2CognitoUserPool in mde/transformations/pim-to-awspsm/workflow-security-config.etl assigns or materializes this feature while refining CognitoUserPool. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: CognitoUserPoolExample.
mfaRationale	String [1]	Records the reasoning behind mfa rationale for the cognito user pool. This keeps the decision explicit even when the element's class or relationships remain unchanged. Semantic validation: MfaDecisionMadeForProductionCriticalPools (mfa decision made for production critical pools) in mde/validation/psm/rules/identity.evl the rule's diagnostic or remediation guidance refers to this feature. Transformation role: ETL rule IdentityProvider2CognitoUserPool in mde/transformations/pim-to-awspsm/workflow-security-config.etl assigns or materializes this feature while refining CognitoUserPool.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: The choice protects the business outcome while keeping the design independently deployable..
usernameAttributes	String [*]	Records the username attributes value for the cognito user pool. This keeps the decision explicit even when the element's class or relationships remain unchanged. Transformation role: ETL rule IdentityProvider2CognitoUserPool in mde/transformations/pim-to-awspsm/workflow-security-config.etl reads or derives this feature while refining CognitoUserPool. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A collection of values. Example: [Cognito User Pool Username Attributes, Cognito User Pool Username Attributes-2].
aliasAttributes	String [*]	Records the alias attributes value for cognito user pool. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A collection of values. Example: [Cognito User Pool Alias Attributes, Cognito User Pool Alias Attributes-2].
autoVerifiedAttributes	String [*]	Stores the auto verified attributes value on the cognito user pool. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Transformation role: ETL rule IdentityProvider2CognitoUserPool in mde/transformations/pim-to-awspsm/workflow-security-config.etl reads or derives this feature while refining CognitoUserPool. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A collection of values. Example: [Cognito User Pool Auto Verified Attributes, Cognito User Pool Auto Verified Attributes-2].
accountRecoverySettingJson	String [1]	For a cognito user pool, the model records the serialized JSON representation of account recovery setting. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: {"enabled":true}.
adminCreateUserConfigJson	String [1]	For a cognito user pool, the model records the serialized JSON representation of admin create user config. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: {"enabled":true}.
emailConfigurationJson	String [1]	Stores the serialized JSON representation of email configuration on the cognito user pool. The field preserves structured provider or contract detail as an explicit, reviewable input. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: {"enabled":true}.
smsConfigurationJson	String [1]	Records serialized JSON representation of sms configuration for cognito user pool. It keeps preserving structured provider or contract detail explicit during review and transformation, so later steps do not have to infer it. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: {"enabled":true}.
lambdaConfigJson	String [1]	Records serialized JSON representation of lambda config for cognito user pool. It keeps preserving structured provider or contract detail explicit during review and transformation, so later steps do not have to infer it. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: {"enabled":true}.
policiesJson	String [1]	Stores the serialized JSON representation of policies on the cognito user pool. The field preserves structured provider or contract detail as an explicit, reviewable input. Transformation role: ETL rule IdentityProvider2CognitoUserPool in mde/transformations/pim-to-awspsm/workflow-security-config.etl assigns or materializes this feature while refining CognitoUserPool. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: {"enabled":true}.
schemaJson	String [1]	Records the serialized JSON representation of schema for the cognito user pool. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: {"enabled":true}.
deletionProtection	Boolean [1]	Records the data-lifecycle rule for deletion protection for the cognito user pool. This keeps the decision explicit even when the element's class or relationships remain unchanged. Semantic validation: ProductionUserPoolShouldUseDeletionProtection (production user pool should use deletion protection) in mde/validation/psm/rules/identity.evl the flag must be enabled for this rule to pass. Transformation role: ETL rule IdentityProvider2CognitoUserPool in mde/transformations/pim-to-awspsm/workflow-security-config.etl assigns or materializes this feature while refining CognitoUserPool. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	Either true or false. Example: false.
mfaConfiguration	CognitoMfaConfiguration [1]	For a cognito user pool, the model records the controlled classification or strategy represented by mfa configuration. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: MfaForProductionPrivilegedPools (mfa for production privileged pools) in mde/validation/psm/rules/identity.evl the related value or object must be explicitly provided. Transformation role: ETL rule IdentityProvider2CognitoUserPool in mde/transformations/pim-to-awspsm/workflow-security-config.etl assigns or materializes this feature while refining CognitoUserPool. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	Exactly one of: OFF, ON, OPTIONAL. Example: OFF.
mfaDecision	Decision [1]	Stores the controlled classification or strategy represented by mfa decision on the cognito user pool. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Semantic validation: MfaDecisionMadeForProductionCriticalPools (mfa decision made for production critical pools) in mde/validation/psm/rules/identity.evl the related value or object must be explicitly provided. Transformation role: ETL rule IdentityProvider2CognitoUserPool in mde/transformations/pim-to-awspsm/workflow-security-config.etl assigns or materializes this feature while refining CognitoUserPool.	Exactly one of: UNDECIDED, REQUIRED, NOT_REQUIRED, ACCEPTED, NEEDS_REVIEW, GENERATOR_OWNED. Example: UNDECIDED.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
accountRecoverySetting → CognitoAccountRecoverySetting	containment, [?]	Contains the cognito account recovery setting element(s) that make up this cognito user pool; the contained objects belong to this model element.
emailConfiguration → CognitoEmailConfiguration	containment, [?]	Contains the cognito email configuration element(s) that make up this cognito user pool; the contained objects belong to this model element.
lambdaConfig → CognitoLambdaConfig	containment, [?]	Contains the cognito lambda config element(s) that make up this cognito user pool; the contained objects belong to this model element.
passwordPolicy → CognitoPasswordPolicy	containment, [?]	Contains the cognito password policy element(s) that make up this cognito user pool; the contained objects belong to this model element.
schemaAttributes → CognitoSchemaAttribute	containment, [*]	Contains the cognito schema attribute element(s) that make up this cognito user pool; the contained objects belong to this model element.
clients → CognitoUserPoolClient	reference, [*]; opposite userPool	References the cognito user pool client element(s) used as clients by this cognito user pool; the target may be shared elsewhere in the model.
groups → CognitoUserPoolGroup	reference, [*]; opposite userPool	References the cognito user pool group element(s) used as groups by this cognito user pool; the target may be shared elsewhere in the model.
domain → CognitoUserPoolDomain	reference, [?]; opposite userPool	References the cognito user pool domain element(s) used as domain by this cognito user pool; the target may be shared elsewhere in the model.

CognitoPasswordPolicy

Represents cognito password policy in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
minimumLength	Integer [1]	For a cognito password policy, the model records the minimum length value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A numeric Integer value; use the unit or boundary documented for this attribute. Example: 1.
requireUppercase	Boolean [1]	Records whether require uppercase applies to cognito password policy. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either true or false. Example: false.
requireLowercase	Boolean [1]	For a cognito password policy, the model records whether require lowercase applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either true or false. Example: false.
requireNumbers	Boolean [1]	Records whether require numbers applies to cognito password policy. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either true or false. Example: false.
requireSymbols	Boolean [1]	For a cognito password policy, the model records whether require symbols applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either true or false. Example: false.
temporaryPasswordValidityDays	Integer [1]	Records the temporary password validity days duration or limit, expressed in days for the cognito password policy. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A numeric Integer value; use the unit or boundary documented for this attribute. Example: 1.

Relationships

This class declares no direct relationships.

CognitoSchemaAttribute

Represents cognito schema attribute in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
attributeName	String [1]	Records stable name/key/code used for attribute name for cognito schema attribute. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: CognitoSchemaAttributeExample.
attributeDataType	String [1]	For a cognito schema attribute, the model records the controlled classification or strategy represented by attribute data type. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: BUSINESS.
required	Boolean [1]	Records whether required applies to cognito schema attribute. It preserves an explicit architectural or governance decision through review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either true or false. Example: true.
mutable	Boolean [1]	Records whether mutable applies to cognito schema attribute. The field records an explicit architectural or governance decision as an explicit, reviewable input. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/naming.eol.	Either true or false. Example: false.
developerOnlyAttribute	String [1]	For a cognito schema attribute, the model records the developer only attribute value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: Cognito Schema Attribute Developer Only Attribute.
minLength	String [1]	Stores the min length value on the cognito schema attribute. The field records an operational boundary explicitly instead of leaving it to provider defaults. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: Cognito Schema Attribute Min Length.
maxLength	String [1]	For a cognito schema attribute, the model records the max length value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: Cognito Schema Attribute Max Length.
minimum	String [1]	For a cognito schema attribute, the model records the minimum value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: Cognito Schema Attribute Minimum.
maximum	String [1]	Stores the maximum value on the cognito schema attribute. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: Cognito Schema Attribute Maximum.

Relationships

This class declares no direct relationships.

CognitoEmailConfiguration

Represents cognito email configuration in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
emailSendingAccount	String [1]	For a cognito email configuration, the model records the email sending account value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: operator@example.com.
from	String [1]	Records the from value for the cognito email configuration. This keeps the decision explicit even when the element's class or relationships remain unchanged. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol. The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/contracts.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: Cognito Email Configuration From.
replyToEmailAddress	String [1]	For a cognito email configuration, the model records the reply to email address value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: operator@example.com.
sourceArn	String [1]	Records origin/source selected for source arn for cognito email configuration. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: arn:aws:lambda:us-east-1:123456789012:function:orders.
configurationSet	String [1]	Records the configuration set value for the cognito email configuration. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: Cognito Email Configuration Configuration Set.

Relationships

This class declares no direct relationships.

CognitoAccountRecoverySetting

Represents cognito account recovery setting in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

This class declares no attributes of its own. It inherits the attributes of its supertype, if any.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
recoveryMechanisms → CognitoRecoveryMechanism	containment, [*]	Contains the cognito recovery mechanism element(s) that make up this cognito account recovery setting; the contained objects belong to this model element.

CognitoRecoveryMechanism

Represents cognito recovery mechanism in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
name	String [1]	A concise model name used when the element is shown in editors, diagnostics, and generated explanations. Here it is attached to the cognito recovery mechanism, so the shared meaning travels with this particular model element. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/contracts.eol. The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/naming.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: CognitoRecoveryMechanismExample.
priority	Integer [1]	Records precedence value for priority for cognito recovery mechanism. It keeps deterministic ordering or precedence explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A numeric Integer value; use the unit or boundary documented for this attribute. Example: 1.

Relationships

This class declares no direct relationships.

CognitoLambdaConfig

Represents cognito lambda config in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

This class declares no attributes of its own. It inherits the attributes of its supertype, if any.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
preSignUp → AwsResource	reference, [?]	References the aws resource element(s) used as pre sign up by this cognito lambda config; the target may be shared elsewhere in the model.
postConfirmation → AwsResource	reference, [?]	References the aws resource element(s) used as post confirmation by this cognito lambda config; the target may be shared elsewhere in the model.
preAuthentication → AwsResource	reference, [?]	References the aws resource element(s) used as pre authentication by this cognito lambda config; the target may be shared elsewhere in the model.
postAuthentication → AwsResource	reference, [?]	References the aws resource element(s) used as post authentication by this cognito lambda config; the target may be shared elsewhere in the model.
customMessage → AwsResource	reference, [?]	References the aws resource element(s) used as custom message by this cognito lambda config; the target may be shared elsewhere in the model.
defineAuthChallenge → AwsResource	reference, [?]	References the aws resource element(s) used as define auth challenge by this cognito lambda config; the target may be shared elsewhere in the model.
createAuthChallenge → AwsResource	reference, [?]	References the aws resource element(s) used as create auth challenge by this cognito lambda config; the target may be shared elsewhere in the model.
verifyAuthChallengeResponse → AwsResource	reference, [?]	References the aws resource element(s) used as verify auth challenge response by this cognito lambda config; the target may be shared elsewhere in the model.
preTokenGeneration → AwsResource	reference, [?]	References the aws resource element(s) used as pre token generation by this cognito lambda config; the target may be shared elsewhere in the model.
userMigration → AwsResource	reference, [?]	References the aws resource element(s) used as user migration by this cognito lambda config; the target may be shared elsewhere in the model.

CognitoUserPoolClient

Represents cognito user pool client in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
clientName	String [1]	Records the stable name/key/code used for client name for the cognito user pool client. This keeps the decision explicit even when the element's class or relationships remain unchanged. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: CognitoUserPoolClientExample.
generateSecret	Boolean [1]	For a cognito user pool client, the model records whether generate secret applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	Either true or false. Example: false.
explicitAuthFlows	String [*]	Stores the explicit auth flows value on the cognito user pool client. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A collection of values. Example: [Cognito User Pool Client Explicit Auth Flows, Cognito User Pool Client Explicit Auth Flows-2].
supportedIdentityProviders	String [*]	Records the supported identity providers value for cognito user pool client. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A collection of values. Example: [Cognito User Pool Client Supported Identity Providers, Cognito User Pool Client Supported Identity Providers-2].
callbackUrls	String [*]	Stores the callback urls value on the cognito user pool client. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Semantic validation: OAuthClientHasCallbackUrls (oauth client has callback urls) in mde/validation/psm/rules/identity.evl the collection or referenced set must not be empty.	A collection of values. Example: [Cognito User Pool Client Callback Urls, Cognito User Pool Client Callback Urls-2].
logoutUrls	String [*]	Records the logout urls value for the cognito user pool client. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A collection of values. Example: [Cognito User Pool Client Logout Urls, Cognito User Pool Client Logout Urls-2].
allowedOAuthFlows	String [*]	Records the allowed oauth flows value for the cognito user pool client. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A collection of values. Example: [Cognito User Pool Client Allowed Oauth Flows, Cognito User Pool Client Allowed Oauth Flows-2].
allowedOAuthScopes	String [*]	Records boundary within which allowed oauth scopes is interpreted for cognito user pool client. It keeps isolation and ownership decisions explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A collection of values. Example: [orders, orders-2].
allowedOAuthFlowsUserPoolClient	Boolean [1]	Records whether allowed oauth flows user pool client applies to cognito user pool client. This keeps the decision explicit even when the element's class or relationships remain unchanged. Semantic validation: OAuthClientHasCallbackUrls (oauth client has callback urls) in mde/validation/psm/rules/identity.evl the flag must be enabled for this rule to pass.	Either true or false. Example: true.
accessTokenValidity	Integer [1]	For a cognito user pool client, the model records the access token validity value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A numeric Integer value; use the unit or boundary documented for this attribute. Example: 1.
idTokenValidity	Integer [1]	Records the id token validity value for the cognito user pool client. This keeps the decision explicit even when the element's class or relationships remain unchanged. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A numeric Integer value; use the unit or boundary documented for this attribute. Example: 1.
refreshTokenValidity	Integer [1]	Records the refresh token validity value for cognito user pool client. It keeps an operational boundary that should not be left to provider defaults explicit during review and transformation, so later steps do not have to infer it. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A numeric Integer value; use the unit or boundary documented for this attribute. Example: 1.
tokenValidityUnitsJson	String [1]	Records the serialized JSON representation of token validity units for the cognito user pool client. This keeps the decision explicit even when the element's class or relationships remain unchanged. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: {"enabled":true}.
preventUserExistenceErrors	String [1]	Records the prevent user existence errors value for the cognito user pool client. This keeps the decision explicit even when the element's class or relationships remain unchanged. Semantic validation: PreventUserExistenceErrorsRecommended (prevent user existence errors recommended) in mde/validation/psm/rules/identity.evl the value must be present and non-blank. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: Cognito User Pool Client Prevent User Existence Errors.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
oauthConfiguration → CognitoOAuthConfiguration	containment, [?]	Contains the cognito oauth configuration element(s) that make up this cognito user pool client; the contained objects belong to this model element.
userPool → CognitoUserPool	reference, [1]; opposite clients	References the cognito user pool element(s) used as user pool by this cognito user pool client; the target may be shared elsewhere in the model.

CognitoOAuthConfiguration

Represents cognito oauth configuration in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
callbackUrls	String [*]	Records the callback urls value for the cognito oauth configuration. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A collection of values. Example: [Cognito Oauth Configuration Callback Urls, Cognito Oauth Configuration Callback Urls-2].
logoutUrls	String [*]	For a cognito oauth configuration, the model records the logout urls value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A collection of values. Example: [Cognito Oauth Configuration Logout Urls, Cognito Oauth Configuration Logout Urls-2].
allowedOAuthFlows	String [*]	For a cognito oauth configuration, the model records the allowed oauth flows value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A collection of values. Example: [Cognito Oauth Configuration Allowed Oauth Flows, Cognito Oauth Configuration Allowed Oauth Flows-2].
allowedOAuthScopes	String [*]	Stores the boundary within which allowed oauth scopes is interpreted on the cognito oauth configuration. The field records isolation and ownership decisions as an explicit, reviewable input. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A collection of values. Example: [orders, orders-2].
allowedOAuthFlowsUserPoolClient	Boolean [1]	For a cognito oauth configuration, the model records whether allowed oauth flows user pool client applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either true or false. Example: true.
supportedIdentityProviders	String [*]	Stores the supported identity providers value on the cognito oauth configuration. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A collection of values. Example: [Cognito Oauth Configuration Supported Identity Providers, Cognito Oauth Configuration Supported Identity Providers-2].

Relationships

This class declares no direct relationships.

CognitoUserPoolGroup

Represents cognito user pool group in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
groupName	String [1]	Records the stable name/key/code used for group name for the cognito user pool group. This keeps the decision explicit even when the element's class or relationships remain unchanged. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: CognitoUserPoolGroupExample.
descriptionText	String [1]	Stores the human explanation of description text on the cognito user pool group. The field records human review and generated guidance as an explicit, reviewable input. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: Orders processing.
precedence	Integer [1]	Records the precedence value for precedence for the cognito user pool group. This keeps the decision explicit even when the element's class or relationships remain unchanged. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A numeric Integer value; use the unit or boundary documented for this attribute. Example: 1.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
userPool → CognitoUserPool	reference, [1]; opposite groups	References the cognito user pool element(s) used as user pool by this cognito user pool group; the target may be shared elsewhere in the model.
role → IamRole	reference, [?]	References the iam role element(s) used as role by this cognito user pool group; the target may be shared elsewhere in the model.

CognitoUserPoolDomain

Represents cognito user pool domain in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
domain	String [1]	For a cognito user pool domain, the model records the domain value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: orders.example.com.
certificateArn	String [1]	For a cognito user pool domain, the model records the AWS ARN used for certificate. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: arn:aws:lambda:us-east-1:123456789012:function:orders.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
userPool → CognitoUserPool	reference, [1]; opposite domain	References the cognito user pool element(s) used as user pool by this cognito user pool domain; the target may be shared elsewhere in the model.

CognitoIdentityPool

Represents cognito identity pool in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
identityPoolName	String [1]	For a cognito identity pool, the model records the stable name/key/code used for identity pool name. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: CognitoIdentityPoolExample.
allowUnauthenticatedIdentities	Boolean [1]	Records whether allow unauthenticated identities applies to cognito identity pool. The field records an explicit architectural or governance decision as an explicit, reviewable input. Semantic validation: UnauthenticatedIdentitiesRequireReview (unauthenticated identities require review) in mde/validation/psm/rules/identity.evl the value must satisfy a numeric or ordering boundary. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	Either true or false. Example: true.
cognitoIdentityProvidersJson	String [1]	For a cognito identity pool, the model records the serialized JSON representation of cognito identity providers. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in mde/generation/awspsm-to-artifacts/lib/cfn.eol.	A free-form String, subject to this class's semantic meaning and any EVL constraints. Example: {"enabled":true}.

Relationships

This class declares no direct relationships.