Skip to content
Aurykle
Back to Aurykle

Supported-resource matrix

Auth0 and Amazon Cognito beta coverage

Aurykle currently observes nine Auth0 configuration families and four Amazon Cognito configuration families through dedicated read-only connections. This page is the public source of truth for beta coverage.

Last updated 31 August 2026

Read-only means read-only

The production collectors implement Auth0 Management API reads and Amazon Cognito configuration reads using only the permissions listed below. Do not grant Aurykle create, update, or delete access. Aurykle does not automatically remediate or otherwise change a connected customer tenant or AWS account.

Provider availability

Auth0 and Amazon Cognito are available in the current beta. Microsoft Entra ID, Okta, Keycloak, and Clerk are on the roadmap but are not currently supported. Roadmap status does not represent a committed release date.

Auth0 resource families

Applications

read:clients

Client settings, grants, callbacks, origins, and token settings.

Connections

read:connections + read:connections_options

Database, social, and enterprise connection configuration.

APIs

read:resource_servers

Resource servers, scopes, signing algorithms, and token lifetimes.

Client grants

read:client_grants

Machine-to-machine grants and their approved scopes.

Actions

read:actions

Deployed Action versions and safe runtime metadata; never source code or secrets.

Organizations

read:organizations

Organization settings, enabled connections, and member-facing configuration.

Roles

read:roles

Tenant role definitions and descriptive metadata.

MFA

read:guardian_factors + read:mfa_policies

Guardian factors and tenant MFA policy.

Attack protection

read:attack_protection

Bot Detection, Breached Password Detection, Brute-force Protection, and Suspicious IP Throttling.

Amazon Cognito resource families

Cognito resources are observed through scheduled configuration collection. The current beta reports what changed and when it was first observed, but does not ingest CloudTrail events or attribute the change to an AWS actor.

User pools

ListUserPools + DescribeUserPool + GetUserPoolMfaConfig

User-pool settings, account and password policies, recovery configuration, Lambda triggers, and MFA configuration.

App clients

ListUserPoolClients + DescribeUserPoolClient

App-client authentication flows, callback and logout URLs, OAuth settings, token validity, and supported identity providers.

Identity providers

ListIdentityProviders + DescribeIdentityProvider

SAML, OIDC, social, and other user-pool identity-provider settings with secret-bearing fields removed.

Resource servers

ListResourceServers + DescribeResourceServer

Resource-server identifiers, names, and custom OAuth scopes.

Required Auth0 Management API scopes

Grant this exact configuration-read set to the dedicated collector application:

read:clients
read:connections
read:connections_options
read:resource_servers
read:client_grants
read:actions
read:organizations
read:roles
read:guardian_factors
read:mfa_policies
read:attack_protection

Optional event-attribution scope

read:logs enables bounded Management Log checkpoint polling as a fallback for delayed or missed Log Stream delivery. It is not required for baseline or scheduled configuration collection.

Required Amazon Cognito IAM actions

Grant these configuration-read actions to the fixed AurykleCognitoReadOnly role. Aurykle assumes the role using a workspace-specific external ID and never requests permission to read users or app-client secrets.

cognito-idp:ListUserPools
cognito-idp:DescribeUserPool
cognito-idp:GetUserPoolMfaConfig
cognito-idp:ListUserPoolClients
cognito-idp:DescribeUserPoolClient
cognito-idp:ListIdentityProviders
cognito-idp:DescribeIdentityProvider
cognito-idp:ListResourceServers
cognito-idp:DescribeResourceServer

Known exclusions and limitations

  • Auth0 CAPTCHA-provider configuration is not currently collected.
  • Auth0 Phone Provider Protection is not currently collected.
  • Amazon Cognito is observed through scheduled configuration collection. CloudTrail actor attribution is not currently included.
  • Amazon Cognito users and app-client secrets are deliberately never collected.
  • Secret-bearing, signing-key, implementation-code, and other unsafe fields are deliberately excluded.
  • Auth0 Management Log polling is optional change-attribution evidence; it never replaces a complete configuration snapshot.
  • Microsoft Entra ID, Okta, Keycloak, and Clerk are roadmap providers and are not part of current beta coverage.
  • Terraform ingestion, automatic remediation, and AI analysis are outside the current beta.

Completeness and comparison rules

Each resource family has its own collection status. Aurykle retains a partial collection for diagnosis, but it never uses one as a comparison baseline, interprets a failed read as a deletion, or resolves findings from incomplete evidence. Newly supported resource families establish baseline coverage rather than appearing as customer changes.

Coverage changes during beta

Coverage may expand, contract, or change as provider APIs and the Aurykle beta evolve. Material changes will update this page and its last-updated date. If a required provider, resource, or field is not listed, treat it as unsupported and contact support before relying on it.