# CfnUserPoolRiskConfigurationAttachmentProps

Properties for defining a `CfnUserPoolRiskConfigurationAttachment`.

Extends: CfnUserPoolRiskConfigurationAttachmentProps
Used as props by: CfnUserPoolRiskConfigurationAttachment

- Source: Generated code
- Type last changed: v2.227.0 · 21 Nov 2025

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_cognito as cognito } from 'aws-cdk-lib';
const cfnUserPoolRiskConfigurationAttachmentProps: cognito.CfnUserPoolRiskConfigurationAttachmentProps = {
  clientId: 'clientId',
  userPoolId: 'userPoolId',

  // the properties below are optional
  accountTakeoverRiskConfiguration: {
    actions: {
      highAction: {
        eventAction: 'eventAction',
        notify: false,
      },
      lowAction: {
        eventAction: 'eventAction',
        notify: false,
      },
      mediumAction: {
        eventAction: 'eventAction',
        notify: false,
      },
    },

    // the properties below are optional
    notifyConfiguration: {
      sourceArn: 'sourceArn',

      // the properties below are optional
      blockEmail: {
        subject: 'subject',

        // the properties below are optional
        htmlBody: 'htmlBody',
        textBody: 'textBody',
      },
      from: 'from',
      mfaEmail: {
        subject: 'subject',

        // the properties below are optional
        htmlBody: 'htmlBody',
        textBody: 'textBody',
      },
      noActionEmail: {
        subject: 'subject',

        // the properties below are optional
        htmlBody: 'htmlBody',
        textBody: 'textBody',
      },
      replyTo: 'replyTo',
    },
  },
  compromisedCredentialsRiskConfiguration: {
    actions: {
      eventAction: 'eventAction',
    },

    // the properties below are optional
    eventFilter: ['eventFilter'],
  },
  riskExceptionConfiguration: {
    blockedIpRangeList: ['blockedIpRangeList'],
    skippedIpRangeList: ['skippedIpRangeList'],
  },
};
```

## Properties

- `accountTakeoverRiskConfiguration`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnUserPoolRiskConfigurationAttachment.AccountTakeoverRiskConfigurationTypeProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.CfnUserPoolRiskConfigurationAttachment.AccountTakeoverRiskConfigurationTypeProperty.html) — The settings for automated responses and notification templates for adaptive authentication with threat protection.

- `clientId`: string (required) — The app client where this configuration is applied.

  When this parameter isn't present, the risk configuration applies to all user pool app clients that don't have client-level settings.

- `compromisedCredentialsRiskConfiguration`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnUserPoolRiskConfigurationAttachment.CompromisedCredentialsRiskConfigurationTypeProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.CfnUserPoolRiskConfigurationAttachment.CompromisedCredentialsRiskConfigurationTypeProperty.html) — Settings for compromised-credentials actions and authentication types with threat protection in full-function `ENFORCED` mode.

- `riskExceptionConfiguration`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnUserPoolRiskConfigurationAttachment.RiskExceptionConfigurationTypeProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.CfnUserPoolRiskConfigurationAttachment.RiskExceptionConfigurationTypeProperty.html) — Exceptions to the risk evaluation configuration, including always-allow and always-block IP address ranges.

- `userPoolId`: string | [IUserPoolRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_cognito.IUserPoolRef.html) (required) — The ID of the user pool that has the risk configuration applied.