feat(cognito): support refresh token rotation

packages/aws-cdk-lib/aws-cognito/lib/user-pool-client.ts

@@ -234,6 +234,23 @@ export class UserPoolClientIdentityProvider {
   }
 }
 
+/**
+ * The configuration of your app client for refresh token rotation.
+ */
+export interface RefreshTokenRotation {
+  /**
+   * The state of refresh token rotation for the current app client.
+   * @default - undefined (CloudFormation defaults to DISABLED)
+   */
+  readonly feature?: 'ENABLED' | 'DISABLED';
+
+  /**
+   * Grace period for the original refresh token (0-60 seconds).
+   * @default - undefined (CloudFormation defaults value)
+   */
+  readonly retryGracePeriodSeconds?: number;
+}
+
 /**
  * Options to create a UserPoolClient
  */
@@ -321,6 +338,13 @@ export interface UserPoolClientOptions {
    */
   readonly accessTokenValidity?: Duration;
 
+  /**
+   * Configuration for refresh token rotation
+   * @see https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-the-refresh-token.html#using-the-refresh-token-rotation
+   * @default - undefined (refresh token rotation is disabled)
+   */
+  refreshTokenRotation?: RefreshTokenRotation;
+
   /**
    * The set of attributes this client will be able to read.
    * @see https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-attribute-permissions-and-scopes