aws-cognito-app-client-secret

id: aws-cognito-app-client-secret
emits: CanReadSecret
applies_to:
- aws
match_effective_permission:
  action: cognito-idp:DescribeUserPoolClient
  resource_type: AWS::Cognito::UserPoolClient
match_condition: UserPoolClient.GenerateSecret == true
emit:
  source_type: Identity
  target_type: APIKey
  source: <principal with effective cognito-idp:DescribeUserPoolClient>
  target: <App Client Secret (APIKey node; ClientSecret field)>
  permissions:
  - cognito-idp:DescribeUserPoolClient
  state_logic: ACTIVE when the principal holds effective cognito-idp:DescribeUserPoolClient on the User
    Pool Client ARN and the client has GenerateSecret=true.
  confidence: 0.95
  derived_from:
  - cognito-idp:DescribeUserPoolClient (AWS Service Authorization Reference)
  condition_note: "Only emit when GenerateSecret=true on the UserPoolClient (DescribeUserPoolClient response\
    \ field GenerateSecret). If GenerateSecret=false (no client secret), the DescribeUserPoolClient response\
    \ omits ClientSecret \u2014 do not emit CanReadSecret."
  false_positive_note: Only emit when GenerateSecret=true is confirmed on the UserPoolClient. Clients
    without GenerateSecret do not have a client secret; DescribeUserPoolClient will return no ClientSecret
    field. This secret is used in server-side OAuth token flows and is often more tightly guarded than
    user passwords.
  narrative: '{principal.name} can call cognito-idp:DescribeUserPoolClient and read the ClientSecret for
    app client {client.name} in User Pool {pool.name}; this is a long-lived symmetric secret used in server-side
    OAuth token flows.'