| action | Desired outcome: apply, plan or destroy | no | apply |
| name | Cognito User Pool name - will be used as the Name tag | yes | — |
| callback_urls | Comma-separated list of callback URLs for OAuth | no | https://example.com/callback |
| logout_urls | Comma-separated list of logout URLs for OAuth | no | https://example.com |
| allowed_domains | Comma-separated list of allowed email domains for pre-sign-up validation (leave blank to disable) | no | "" |
| enable_managed_login_branding | Enable managed login branding with customizable assets (use background_asset_path, logo_asset_path, favicon_asset_path) | no | false |
| login_position | Login form horizontal position: START, CENTER, or END (only works when enable_managed_login_branding is true) | no | CENTER |
| form_vertical_position | Login form vertical position: TOP, CENTER, or BOTTOM (only works when enable_managed_login_branding is true) | no | CENTER |
| primary_color | Primary branding color (6-digit hex without #, e.g. 0972d3). Applied to buttons and links. | no | 0972d3 |
| primary_color_hover | Hover state color for primary elements (6-digit hex without #) | no | 033160 |
| form_border_radius | Border radius for form container and inputs (pixels) | no | 8 |
| color_scheme_mode | Display mode: LIGHT, DARK, or ADAPTIVE (follows browser preference) | no | LIGHT |
| idp | List of identity providers to enable (e.g., "google", "cognito", or "google\ncognito") | no | cognito |
| google_client_id | Google OAuth 2.0 client ID (required when idp includes "google") | no | "" |
| google_client_secret | Google OAuth 2.0 client secret (required when idp includes "google") | no | "" |
| background_asset_path | Path to background image asset relative to workspace root (supported: png, jpg, jpeg, svg) | no | "" |
| logo_asset_path | Path to logo image asset relative to workspace root (supported: png, jpg, jpeg, svg) | no | "" |
| favicon_asset_path | Path to favicon asset relative to workspace root (supported: ico, png) | no | "" |
| self_registration | Allow users to sign themselves up (true) or require admin to create users (false) | no | false |
| admin_email | Email address for the admin user (if provided, admin user will be created) | no | "" |
| case_sensitive | Whether usernames are case sensitive (true) or case insensitive (false). Default is true (case sensitive) | no | true |
| permissions | List of permissions following Github standard of service: read or write. In YML format (e.g., "s3: write\ndynamodb: read") | no | "" |