set_risk_configuration ¶

def set_risk_configuration(
    self,
    user_pool_id: "capo_cognito_identity_provider.types.user_pool_id_type.UserPoolIdType",
    *,
    config_overrides: Optional[CognitoIdentityProviderClientConfig] = None,
    client_id: Optional[
        "capo_cognito_identity_provider.types.client_id_type.ClientIdType"
    ] = None,
    compromised_credentials_risk_configuration: Optional[
        "capo_cognito_identity_provider.types.compromised_credentials_risk_configuration_type.CompromisedCredentialsRiskConfigurationType"
    ] = None,
    account_takeover_risk_configuration: Optional[
        "capo_cognito_identity_provider.types.account_takeover_risk_configuration_type.AccountTakeoverRiskConfigurationType"
    ] = None,
    risk_exception_configuration: Optional[
        "capo_cognito_identity_provider.types.risk_exception_configuration_type.RiskExceptionConfigurationType"
    ] = None,
) -> "capo_cognito_identity_provider.types.set_risk_configuration_response.SetRiskConfigurationResponse":
    """<p>Configures threat protection for a user pool or app client. Sets configuration for the following.</p> <ul> <li> <p>Responses to risks with adaptive authentication</p> </li> <li> <p>Responses to vulnerable passwords with compromised-credentials detection</p> </li> <li> <p>Notifications to users who have had risky activity detected</p> </li> <li> <p>IP-address denylist and allowlist</p> </li> </ul> <p>To set the risk configuration for the user pool to defaults, send this request with only the <code>UserPoolId</code> parameter. To reset the threat protection settings of an app client to be inherited from the user pool, send <code>UserPoolId</code> and <code>ClientId</code> parameters only. To change threat protection to audit-only or off, update the value of <code>UserPoolAddOns</code> in an <code>UpdateUserPool</code> request. To activate this setting, your user pool must be on the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-plus.html"> Plus tier</a>.</p> <p>In secondary regions for user pools with multi-region replication, only the <code>SourceARN</code> and <code>From</code> attributes of <code>NotifyConfiguration</code> can be modified to configure region-specific SES integration. All other risk configuration settings must match the existing values to maintain consistency across replicas.</p>

    Args:
        user_pool_id: <p>The ID of the user pool where you want to set a risk configuration. If you include <code>UserPoolId</code> in your request, don't include <code>ClientId</code>. When the client ID is null, the same risk configuration is applied to all the clients in the userPool. When you include both <code>ClientId</code> and <code>UserPoolId</code>, Amazon Cognito maps the configuration to the app client only.</p>
        client_id: <p>The ID of the app client where you want to set a risk configuration. If <code>ClientId</code> is null, then the risk configuration is mapped to <code>UserPoolId</code>. When the client ID is null, the same risk configuration is applied to all the clients in the userPool.</p> <p>When you include a <code>ClientId</code> parameter, Amazon Cognito maps the configuration to the app client. When you include both <code>ClientId</code> and <code>UserPoolId</code>, Amazon Cognito maps the configuration to the app client only.</p>
        compromised_credentials_risk_configuration: <p>The configuration of automated reactions to detected compromised credentials. Includes settings for blocking future sign-in requests and for the types of password-submission events you want to monitor.</p>
        account_takeover_risk_configuration: <p>The settings for automated responses and notification templates for adaptive authentication with threat protection.</p>
        risk_exception_configuration: <p>A set of IP-address overrides to threat protection. You can set up IP-address always-block and always-allow lists.</p>

    Raises:
        capo_cognito_identity_provider.errors.code_delivery_failure_exception.CodeDeliveryFailureException: <p>This exception is thrown when a verification code fails to deliver successfully.</p>
        capo_cognito_identity_provider.errors.internal_error_exception.InternalErrorException: <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>
        capo_cognito_identity_provider.errors.invalid_email_role_access_policy_exception.InvalidEmailRoleAccessPolicyException: <p>This exception is thrown when Amazon Cognito isn't allowed to use your email identity. HTTP status code: 400.</p>
        capo_cognito_identity_provider.errors.invalid_parameter_exception.InvalidParameterException: <p>This exception is thrown when the Amazon Cognito service encounters an invalid parameter.</p>
        capo_cognito_identity_provider.errors.not_authorized_exception.NotAuthorizedException: <p>This exception is thrown when a user isn't authorized.</p>
        capo_cognito_identity_provider.errors.operation_not_enabled_exception.OperationNotEnabledException: <p>This exception is thrown when an operation is not available in the current region or for the current user pool configuration. This can occur when attempting to perform operations that are not supported in secondary replica regions.</p>
        capo_cognito_identity_provider.errors.resource_not_found_exception.ResourceNotFoundException: <p>This exception is thrown when the Amazon Cognito service can't find the requested resource.</p>
        capo_cognito_identity_provider.errors.too_many_requests_exception.TooManyRequestsException: <p>This exception is thrown when the user has made too many requests for a given operation.</p>
        capo_cognito_identity_provider.errors.user_pool_add_on_not_enabled_exception.UserPoolAddOnNotEnabledException: <p>This exception is thrown when user pool add-ons aren't enabled.</p>
        capo_cognito_identity_provider.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_cognito_identity_provider.types.set_risk_configuration_request.SetRiskConfigurationRequest]",
    ) -> OperationResponse[
        "capo_cognito_identity_provider.types.set_risk_configuration_response.SetRiskConfigurationResponse"
    ]:
        import capo_cognito_identity_provider._operations.aws_cognito_identity_provider_service.set_risk_configuration

        output, http_response = (
            capo_cognito_identity_provider._operations.aws_cognito_identity_provider_service.set_risk_configuration.set_risk_configuration(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    def _redact_input(
        input_: "capo_cognito_identity_provider.types.set_risk_configuration_request.SetRiskConfigurationRequest",
    ) -> dict[str, Any]:
        import capo_cognito_identity_provider.types.set_risk_configuration_request

        return capo_cognito_identity_provider.types.set_risk_configuration_request.redact_sensitive(
            input_
        )

    def _redact_output(
        output: "capo_cognito_identity_provider.types.set_risk_configuration_response.SetRiskConfigurationResponse",
    ) -> dict[str, Any]:
        import capo_cognito_identity_provider.types.set_risk_configuration_response

        return capo_cognito_identity_provider.types.set_risk_configuration_response.redact_sensitive(
            output
        )

    interceptors_, options_ = self.operation_options(
        config_overrides,
        OperationLogging(
            "SetRiskConfiguration",
            redact_input=_redact_input,
            redact_output=_redact_output,
        ),
    )
    input_: capo_cognito_identity_provider.types.set_risk_configuration_request.SetRiskConfigurationRequest = {
        "user_pool_id": user_pool_id
    }
    if client_id is not None:
        input_["client_id"] = client_id
    if compromised_credentials_risk_configuration is not None:
        input_["compromised_credentials_risk_configuration"] = (
            compromised_credentials_risk_configuration
        )
    if account_takeover_risk_configuration is not None:
        input_["account_takeover_risk_configuration"] = (
            account_takeover_risk_configuration
        )
    if risk_exception_configuration is not None:
        input_["risk_exception_configuration"] = risk_exception_configuration

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output