setRiskConfiguration method

Configures threat protection for a user pool or app client. Sets configuration for the following.

• Responses to risks with adaptive authentication
• Responses to vulnerable passwords with compromised-credentials detection
• Notifications to users who have had risky activity detected
• IP-address denylist and allowlist

To set the risk configuration for the user pool to defaults, send this request with only the UserPoolId parameter. To reset the threat protection settings of an app client to be inherited from the user pool, send UserPoolId and ClientId parameters only. To change threat protection to audit-only or off, update the value of UserPoolAddOns in an UpdateUserPool request. To activate this setting, your user pool must be on the Plus tier.

In secondary regions for user pools with multi-region replication, only the SourceARN and From attributes of NotifyConfiguration can be modified to configure region-specific SES integration. All other risk configuration settings must match the existing values to maintain consistency across replicas.

May throw CodeDeliveryFailureException. May throw InternalErrorException. May throw InvalidEmailRoleAccessPolicyException. May throw InvalidParameterException. May throw NotAuthorizedException. May throw OperationNotEnabledException. May throw ResourceNotFoundException. May throw TooManyRequestsException. May throw UserPoolAddOnNotEnabledException.

Parameter userPoolId : The ID of the user pool where you want to set a risk configuration. If you include UserPoolId in your request, don't include ClientId. When the client ID is null, the same risk configuration is applied to all the clients in the userPool. When you include both ClientId and UserPoolId, Amazon Cognito maps the configuration to the app client only.

Parameter accountTakeoverRiskConfiguration : The settings for automated responses and notification templates for adaptive authentication with threat protection.

Parameter clientId : The ID of the app client where you want to set a risk configuration. If ClientId is null, then the risk configuration is mapped to UserPoolId. When the client ID is null, the same risk configuration is applied to all the clients in the userPool.

When you include a ClientId parameter, Amazon Cognito maps the configuration to the app client. When you include both ClientId and UserPoolId, Amazon Cognito maps the configuration to the app client only.

Parameter compromisedCredentialsRiskConfiguration : The configuration of automated reactions to detected compromised credentials. Includes settings for blocking future sign-in requests and for the types of password-submission events you want to monitor.

Parameter riskExceptionConfiguration : A set of IP-address overrides to threat protection. You can set up IP-address always-block and always-allow lists.

Future<SetRiskConfigurationResponse> setRiskConfiguration({
  required String userPoolId,
  AccountTakeoverRiskConfigurationType? accountTakeoverRiskConfiguration,
  String? clientId,
  CompromisedCredentialsRiskConfigurationType?
      compromisedCredentialsRiskConfiguration,
  RiskExceptionConfigurationType? riskExceptionConfiguration,
}) async {
  final headers = <String, String>{
    'Content-Type': 'application/x-amz-json-1.1',
    'X-Amz-Target': 'AWSCognitoIdentityProviderService.SetRiskConfiguration'
  };
  final jsonResponse = await _protocol.send(
    method: 'POST',
    requestUri: '/',
    exceptionFnMap: _exceptionFns,
    // TODO queryParams
    headers: headers,
    payload: {
      'UserPoolId': userPoolId,
      if (accountTakeoverRiskConfiguration != null)
        'AccountTakeoverRiskConfiguration': accountTakeoverRiskConfiguration,
      if (clientId != null) 'ClientId': clientId,
      if (compromisedCredentialsRiskConfiguration != null)
        'CompromisedCredentialsRiskConfiguration':
            compromisedCredentialsRiskConfiguration,
      if (riskExceptionConfiguration != null)
        'RiskExceptionConfiguration': riskExceptionConfiguration,
    },
  );

  return SetRiskConfigurationResponse.fromJson(jsonResponse.body);
}