View a markdown version of this page

AWS::Cognito::UserPoolDomain CustomDomainConfigType - AWS CloudFormation
SyntaxProperties

This is the new CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.

AWS::Cognito::UserPoolDomain CustomDomainConfigType

The configuration for a hosted UI custom domain.

Syntax

To declare this entity in your CloudFormation template, use the following syntax:

JSON

{
  "CertificateArn" : String,
  "SecurityPolicy" : String
}

YAML

  CertificateArn: String
  SecurityPolicy: String

Properties

CertificateArn

The Amazon Resource Name (ARN) of an AWS Certificate Manager SSL certificate. You use this certificate for the subdomain of your custom domain.

Required: No

Type: String

Pattern: arn:[\w+=/,.@-]+:[\w+=/,.@-]+:([\w+=/,.@-]*)?:[0-9]+:[\w+=/,.@-]+(:[\w+=/,.@-]+)?(:[\w+=/,.@-]+)?

Minimum: 20

Maximum: 2048

Update requires: No interruption

SecurityPolicy

The security policy for the custom domain. Defines the minimum TLS version and cipher suites that Amazon CloudFront supports when communicating with clients. For specific guidance, see Supported protocols and ciphers between viewers and CloudFront. Valid values are as follows:

  • TLS_V1_3_2025 (strictest): A post-quantum-ready policy requiring TLS 1.3. It provides the strongest security posture and is ideal for workloads where all clients and browsers are updated to the latest versions. Supported protocols and ciphers for TLSv1.3_2025.

  • TLS_V1_2_2021 (recommended): A post-quantum-ready policy which prefers TLS 1.3 but allows fallback to TLS 1.2 to accommodate older clients. It is the recommended minimum for typical commercial-grade consumer applications. Supported protocols and ciphers for TLSv1.2_2021.

  • TLS_V1 (strongly discouraged): Permits fallback to TLS 1.0. It offers the broadest compatibility, including support for legacy clients that are more than a decade old. This compatibility comes at the expense of allowing TLS versions and cryptographic algorithms that are no longer considered safe for commercial use. Supported protocols and ciphers for TLSv1.

Required: No

Type: String

Allowed values: TLS_V1 | TLS_V1_2_2021 | TLS_V1_3_2025

Update requires: No interruption