**To set the threat protection risk configuration**
The following ``set-risk-configuration`` example configures threat protection messages and actions, compromised credentials, and IP address exceptions in the requested app client. Because of the complexity of the NotifyConfiguration object, JSON input is a best practice for this command. ::
aws cognito-idp set-risk-configuration \
--cli-input-json file://set-risk-configuration.json
Contents of ``set-risk-configuration.json``::
{
"AccountTakeoverRiskConfiguration": {
"Actions": {
"HighAction": {
"EventAction": "MFA_REQUIRED",
"Notify": true
},
"LowAction": {
"EventAction": "NO_ACTION",
"Notify": true
},
"MediumAction": {
"EventAction": "MFA_IF_CONFIGURED",
"Notify": true
}
},
"NotifyConfiguration": {
"BlockEmail": {
"HtmlBody": "\n\n\n\tHTML email context\n\t\n\n\nWe blocked an unrecognized sign-in to your account with this information:\n
\n- Time: {login-time}
\n- Device: {device-name}
\n- Location: {city}, {country}
\n
\nIf this sign-in was not by you, you should change your password and notify us by clicking on this link\nIf this sign-in was by you, you can follow this link to let us know\n\n",
"Subject": "Blocked sign-in attempt",
"TextBody": "We blocked an unrecognized sign-in to your account with this information:\nTime: {login-time}\nDevice: {device-name}\nLocation: {city}, {country}\nIf this sign-in was not by you, you should change your password and notify us by clicking on {one-click-link-invalid}\nIf this sign-in was by you, you can follow {one-click-link-valid} to let us know"
},
"From": "admin@example.com",
"MfaEmail": {
"HtmlBody": "\n\n\n\tHTML email context\n\t\n\n\nWe required you to use multi-factor authentication for the following sign-in attempt:\n
\n- Time: {login-time}
\n- Device: {device-name}
\n- Location: {city}, {country}
\n
\nIf this sign-in was not by you, you should change your password and notify us by clicking on this link\nIf this sign-in was by you, you can follow this link to let us know\n\n",
"Subject": "New sign-in attempt",
"TextBody": "We required you to use multi-factor authentication for the following sign-in attempt:\nTime: {login-time}\nDevice: {device-name}\nLocation: {city}, {country}\nIf this sign-in was not by you, you should change your password and notify us by clicking on {one-click-link-invalid}\nIf this sign-in was by you, you can follow {one-click-link-valid} to let us know"
},
"NoActionEmail": {
"HtmlBody": "\n\n\n\tHTML email context\n\t\n\n\nWe observed an unrecognized sign-in to your account with this information:\n
\n- Time: {login-time}
\n- Device: {device-name}
\n- Location: {city}, {country}
\n
\nIf this sign-in was not by you, you should change your password and notify us by clicking on this link\nIf this sign-in was by you, you can follow this link to let us know\n\n",
"Subject": "New sign-in attempt",
"TextBody": "We observed an unrecognized sign-in to your account with this information:\nTime: {login-time}\nDevice: {device-name}\nLocation: {city}, {country}\nIf this sign-in was not by you, you should change your password and notify us by clicking on {one-click-link-invalid}\nIf this sign-in was by you, you can follow {one-click-link-valid} to let us know"
},
"ReplyTo": "admin@example.com",
"SourceArn": "arn:aws:ses:us-west-2:123456789012:identity/admin@example.com"
}
},
"ClientId": "1example23456789",
"CompromisedCredentialsRiskConfiguration": {
"Actions": {
"EventAction": "BLOCK"
},
"EventFilter": [
"PASSWORD_CHANGE",
"SIGN_UP",
"SIGN_IN"
]
},
"RiskExceptionConfiguration": {
"BlockedIPRangeList": [
"192.0.2.1/32",
"192.0.2.2/32"
],
"SkippedIPRangeList": [
"203.0.113.1/32",
"203.0.113.2/32"
]
},
"UserPoolId": "us-west-2_EXAMPLE"
}
Output::
{
"RiskConfiguration": {
"AccountTakeoverRiskConfiguration": {
"Actions": {
"HighAction": {
"EventAction": "MFA_REQUIRED",
"Notify": true
},
"LowAction": {
"EventAction": "NO_ACTION",
"Notify": true
},
"MediumAction": {
"EventAction": "MFA_IF_CONFIGURED",
"Notify": true
}
},
"NotifyConfiguration": {
"BlockEmail": {
"HtmlBody": "\n\n\n\tHTML email context\n\t\n\n\nWe blocked an unrecognized sign-in to your account with this information:\n
\n- Time: {login-time}
\n- Device: {device-name}
\n- Location: {city}, {country}
\n
\nIf this sign-in was not by you, you should change your password and notify us by clicking on this link\nIf this sign-in was by you, you can follow this link to let us know\n\n",
"Subject": "Blocked sign-in attempt",
"TextBody": "We blocked an unrecognized sign-in to your account with this information:\nTime: {login-time}\nDevice: {device-name}\nLocation: {city}, {country}\nIf this sign-in was not by you, you should change your password and notify us by clicking on {one-click-link-invalid}\nIf this sign-in was by you, you can follow {one-click-link-valid} to let us know"
},
"From": "admin@example.com",
"MfaEmail": {
"HtmlBody": "\n\n\n\tHTML email context\n\t\n\n\nWe required you to use multi-factor authentication for the following sign-in attempt:\n
\n- Time: {login-time}
\n- Device: {device-name}
\n- Location: {city}, {country}
\n
\nIf this sign-in was not by you, you should change your password and notify us by clicking on this link\nIf this sign-in was by you, you can follow this link to let us know\n\n",
"Subject": "New sign-in attempt",
"TextBody": "We required you to use multi-factor authentication for the following sign-in attempt:\nTime: {login-time}\nDevice: {device-name}\nLocation: {city}, {country}\nIf this sign-in was not by you, you should change your password and notify us by clicking on {one-click-link-invalid}\nIf this sign-in was by you, you can follow {one-click-link-valid} to let us know"
},
"NoActionEmail": {
"HtmlBody": "\n\n\n\tHTML email context\n\t\n\n\nWe observed an unrecognized sign-in to your account with this information:\n
\n- Time: {login-time}
\n- Device: {device-name}
\n- Location: {city}, {country}
\n
\nIf this sign-in was not by you, you should change your password and notify us by clicking on this link\nIf this sign-in was by you, you can follow this link to let us know\n\n",
"Subject": "New sign-in attempt",
"TextBody": "We observed an unrecognized sign-in to your account with this information:\nTime: {login-time}\nDevice: {device-name}\nLocation: {city}, {country}\nIf this sign-in was not by you, you should change your password and notify us by clicking on {one-click-link-invalid}\nIf this sign-in was by you, you can follow {one-click-link-valid} to let us know"
},
"ReplyTo": "admin@example.com",
"SourceArn": "arn:aws:ses:us-west-2:123456789012:identity/admin@example.com"
}
},
"ClientId": "1example23456789",
"CompromisedCredentialsRiskConfiguration": {
"Actions": {
"EventAction": "BLOCK"
},
"EventFilter": [
"PASSWORD_CHANGE",
"SIGN_UP",
"SIGN_IN"
]
},
"RiskExceptionConfiguration": {
"BlockedIPRangeList": [
"192.0.2.1/32",
"192.0.2.2/32"
],
"SkippedIPRangeList": [
"203.0.113.1/32",
"203.0.113.2/32"
]
},
"UserPoolId": "us-west-2_EXAMPLE"
}
}
For more information, see `Threat protection `__ in the *Amazon Cognito Developer Guide*.