---
type: resource-type
title: UserPool
description: aws resource type AWS::Cognito::UserPool
name: UserPool
lexicon: aws
resource_type: AWS::Cognito::UserPool
---
`AWS::Cognito::UserPool`, a resource type of the aws lexicon.

## Properties

- `AccountRecoverySetting` (`UserPool_AccountRecoverySetting`, optional)
- `AdminCreateUserConfig` (`UserPool_AdminCreateUserConfig`, optional)
- `AliasAttributes` (`string[]`, optional)
- `Arn` (`string`, optional)
- `AutoVerifiedAttributes` (`string[]`, optional)
- `DeletionProtection` (`string`, optional)
- `DeviceConfiguration` (`UserPool_DeviceConfiguration`, optional)
- `EmailAuthenticationMessage` (`string`, optional)
- `EmailAuthenticationSubject` (`string`, optional)
- `EmailConfiguration` (`UserPool_EmailConfiguration`, optional)
- `EmailVerificationMessage` (`string`, optional)
- `EmailVerificationSubject` (`string`, optional)
- `EnabledMfas` (`string[]`, optional)
- `IssuerConfiguration` (`UserPool_IssuerConfiguration`, optional)
- `KeyConfiguration` (`UserPool_KeyConfiguration`, optional)
- `LambdaConfig` (`UserPool_LambdaConfig`, optional)
- `MfaConfiguration` (`string`, optional)
- `Policies` (`UserPool_Policies`, optional)
- `ProviderName` (`string`, optional)
- `ProviderURL` (`string`, optional)
- `Schema` (`UserPool_SchemaAttribute[]`, optional)
- `SmsAuthenticationMessage` (`string`, optional)
- `SmsConfiguration` (`UserPool_SmsConfiguration`, optional)
- `SmsVerificationMessage` (`string`, optional)
- `UserAttributeUpdateSettings` (`UserPool_UserAttributeUpdateSettings`, optional)
- `UsernameAttributes` (`string[]`, optional)
- `UsernameConfiguration` (`UserPool_UsernameConfiguration`, optional)
- `UserPoolAddOns` (`UserPool_UserPoolAddOns`, optional)
- `UserPoolId` (`string`, optional)
- `UserPoolName` (`string`, optional)
- `UserPoolTags` (`Record<string, unknown>`, optional)
- `UserPoolTier` (`"ESSENTIALS" | "LITE" | "PLUS"`, optional)
- `VerificationMessageTemplate` (`UserPool_VerificationMessageTemplate`, optional)
- `WebAuthnFactorConfiguration` (`"MULTI_FACTOR_WITH_USER_VERIFICATION" | "SINGLE_FACTOR"`, optional)
- `WebAuthnRelyingPartyID` (`string`, optional)
- `WebAuthnUserVerification` (`string`, optional)

## Attributes

- `Arn`
- `ProviderName`
- `ProviderURL`
- `UserPoolId`

## Governed by

- [WAW050](/rules/WAW050.md): Cognito UserPool does not have advanced security (risk-based auth) enabled
- [WAW051](/rules/WAW051.md): Cognito UserPoolClient allows the deprecated implicit OAuth grant
- [WAW052](/rules/WAW052.md): Cognito UserPool does not require MFA (full tier)