Add prevent_user_existence_errors to cognito user pool client.

aws/resource_aws_cognito_user_pool_client.go

@@ -144,6 +144,12 @@ func resourceAwsCognitoUserPoolClient() *schema.Resource {
 				},
 			},
 
+			"prevent_user_existence_errors": {
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+			},
+
 			"supported_identity_providers": {
 				Type:     schema.TypeSet,
 				Optional: true,
@@ -242,6 +248,10 @@ func resourceAwsCognitoUserPoolClientCreate(d *schema.ResourceData, meta interfa
 		params.AnalyticsConfiguration = expandAwsCognitoUserPoolClientAnalyticsConfig(v.([]interface{}))
 	}
 
+	if v, ok := d.GetOk("prevent_user_existence_errors"); ok {
+		params.PreventUserExistenceErrors = aws.String(v.(string))
+	}
+
 	log.Printf("[DEBUG] Creating Cognito User Pool Client: %s", params)
 
 	resp, err := conn.CreateUserPoolClient(params)
@@ -290,6 +300,7 @@ func resourceAwsCognitoUserPoolClientRead(d *schema.ResourceData, meta interface
 	d.Set("callback_urls", flattenStringSet(resp.UserPoolClient.CallbackURLs))
 	d.Set("default_redirect_uri", resp.UserPoolClient.DefaultRedirectURI)
 	d.Set("logout_urls", flattenStringSet(resp.UserPoolClient.LogoutURLs))
+	d.Set("prevent_user_existence_errors", resp.UserPoolClient.PreventUserExistenceErrors)
 	d.Set("supported_identity_providers", flattenStringSet(resp.UserPoolClient.SupportedIdentityProviders))
 
 	if err := d.Set("analytics_configuration", flattenAwsCognitoUserPoolClientAnalyticsConfig(resp.UserPoolClient.AnalyticsConfiguration)); err != nil {
@@ -351,6 +362,10 @@ func resourceAwsCognitoUserPoolClientUpdate(d *schema.ResourceData, meta interfa
 		params.LogoutURLs = expandStringSet(v.(*schema.Set))
 	}
 
+	if v, ok := d.GetOk("prevent_user_existence_errors"); ok {
+		params.PreventUserExistenceErrors = aws.String(v.(string))
+	}
+
 	if v, ok := d.GetOk("supported_identity_providers"); ok {
 		params.SupportedIdentityProviders = expandStringSet(v.(*schema.Set))
 	}

aws/resource_aws_cognito_user_pool_client_test.go

@@ -152,6 +152,7 @@ func TestAccAWSCognitoUserPoolClient_allFields(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "default_redirect_uri", "https://www.example.com/redirect"),
 					resource.TestCheckResourceAttr(resourceName, "logout_urls.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "logout_urls.2102268273", "https://www.example.com/login"),
+					resource.TestCheckResourceAttr(resourceName, "prevent_user_existence_errors", "LEGACY"),
 				),
 			},
 			{
@@ -210,6 +211,7 @@ func TestAccAWSCognitoUserPoolClient_allFieldsUpdatingOneField(t *testing.T) {
 					resource.TestCheckResourceAttr(resourceName, "default_redirect_uri", "https://www.example.com/redirect"),
 					resource.TestCheckResourceAttr(resourceName, "logout_urls.#", "1"),
 					resource.TestCheckResourceAttr(resourceName, "logout_urls.2102268273", "https://www.example.com/login"),
+					resource.TestCheckResourceAttr(resourceName, "prevent_user_existence_errors", "LEGACY"),
 				),
 			},
 			{
@@ -451,7 +453,8 @@ resource "aws_cognito_user_pool_client" "test" {
   read_attributes  = ["email"]
   write_attributes = ["email"]
 
-  refresh_token_validity = %d
+  refresh_token_validity        = %d
+  prevent_user_existence_errors = "LEGACY"
 
   allowed_oauth_flows                  = ["code", "implicit"]
   allowed_oauth_flows_user_pool_client = "true"

website/docs/r/cognito_user_pool_client.markdown

@@ -123,6 +123,7 @@ The following arguments are supported:
 * `generate_secret` - (Optional) Should an application secret be generated.
 * `logout_urls` - (Optional) List of allowed logout URLs for the identity providers.
 * `name` - (Required) The name of the application client.
+* `prevent_user_existence_errors` - (Optional) Choose which errors and responses are returned by Cognito APIs during authentication, account confirmation, and password recovery when the user does not exist in the user pool. When set to `ENABLED` and the user does not exist, authentication returns an error indicating either the username or password was incorrect, and account confirmation and password recovery return a response indicating a code was sent to a simulated destination. When set to `LEGACY`, those APIs will return a `UserNotFoundException` exception if the user does not exist in the user pool.
 * `read_attributes` - (Optional) List of user pool attributes the application client can read from.
 * `refresh_token_validity` - (Optional) The time limit in days refresh tokens are valid for.
 * `supported_identity_providers` - (Optional) List of provider names for the identity providers that are supported on this client.