title: What does the `aws.cognito.signin.user.admin` scope mean in Amazon Cognito?
body: <p>Amazon Cognito has a number of system-reserved scopes:</p>
  
  <ul>
  <li>openid</li>
  <li>email</li>
  <li>phone</li>
  <li>profile</li>
  <li>aws.cognito.signin.user.admin</li>
  </ul>
  
  <p>But doesn't document what they give access to.</p>
  
  <p>The first 3 are fairly self-explanatory. I would expect profile to mean the user profile.</p>
  
  <p>I've found by trial-and-error that I need <code>aws.cognito.signin.user.admin</code> to use the Amazon Cognito <a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_GetUser.html" rel="noreferrer">Get User API call</a>. I would have expected this to be <code>profile</code> instead, but OK, fine.</p>
  
  <p>What I'm concerned about is what <strong>else</strong> <code>aws.cognito.signin.user.admin</code> might do. If I let 3rd party clients request this scope, what am I giving them access to?</p>