diff --git a/clients/client-cognito-identity/src/commands/GetCredentialsForIdentityCommand.ts b/clients/client-cognito-identity/src/commands/GetCredentialsForIdentityCommand.ts
index 58698a5e8fb7..bba3c7630393 100644
--- a/clients/client-cognito-identity/src/commands/GetCredentialsForIdentityCommand.ts
+++ b/clients/client-cognito-identity/src/commands/GetCredentialsForIdentityCommand.ts
@@ -6,7 +6,12 @@ import { MetadataBearer as __MetadataBearer } from "@smithy/types";
 
 import { CognitoIdentityClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../CognitoIdentityClient";
 import { commonParams } from "../endpoint/EndpointParameters";
-import { GetCredentialsForIdentityInput, GetCredentialsForIdentityResponse } from "../models/models_0";
+import {
+  GetCredentialsForIdentityInput,
+  GetCredentialsForIdentityInputFilterSensitiveLog,
+  GetCredentialsForIdentityResponse,
+  GetCredentialsForIdentityResponseFilterSensitiveLog,
+} from "../models/models_0";
 import { de_GetCredentialsForIdentityCommand, se_GetCredentialsForIdentityCommand } from "../protocols/Aws_json1_1";
 
 /**
@@ -118,7 +123,7 @@ export class GetCredentialsForIdentityCommand extends $Command
   })
   .s("AWSCognitoIdentityService", "GetCredentialsForIdentity", {})
   .n("CognitoIdentityClient", "GetCredentialsForIdentityCommand")
-  .f(void 0, void 0)
+  .f(GetCredentialsForIdentityInputFilterSensitiveLog, GetCredentialsForIdentityResponseFilterSensitiveLog)
   .ser(se_GetCredentialsForIdentityCommand)
   .de(de_GetCredentialsForIdentityCommand)
   .build() {}
diff --git a/clients/client-cognito-identity/src/commands/GetIdCommand.ts b/clients/client-cognito-identity/src/commands/GetIdCommand.ts
index bab1a078bf40..42b48bb57f9f 100644
--- a/clients/client-cognito-identity/src/commands/GetIdCommand.ts
+++ b/clients/client-cognito-identity/src/commands/GetIdCommand.ts
@@ -6,7 +6,7 @@ import { MetadataBearer as __MetadataBearer } from "@smithy/types";
 
 import { CognitoIdentityClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../CognitoIdentityClient";
 import { commonParams } from "../endpoint/EndpointParameters";
-import { GetIdInput, GetIdResponse } from "../models/models_0";
+import { GetIdInput, GetIdInputFilterSensitiveLog, GetIdResponse } from "../models/models_0";
 import { de_GetIdCommand, se_GetIdCommand } from "../protocols/Aws_json1_1";
 
 /**
@@ -109,7 +109,7 @@ export class GetIdCommand extends $Command
   })
   .s("AWSCognitoIdentityService", "GetId", {})
   .n("CognitoIdentityClient", "GetIdCommand")
-  .f(void 0, void 0)
+  .f(GetIdInputFilterSensitiveLog, void 0)
   .ser(se_GetIdCommand)
   .de(de_GetIdCommand)
   .build() {}
diff --git a/clients/client-cognito-identity/src/commands/GetOpenIdTokenCommand.ts b/clients/client-cognito-identity/src/commands/GetOpenIdTokenCommand.ts
index e0a24e1a3ee2..9b9eb865eeab 100644
--- a/clients/client-cognito-identity/src/commands/GetOpenIdTokenCommand.ts
+++ b/clients/client-cognito-identity/src/commands/GetOpenIdTokenCommand.ts
@@ -6,7 +6,12 @@ import { MetadataBearer as __MetadataBearer } from "@smithy/types";
 
 import { CognitoIdentityClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../CognitoIdentityClient";
 import { commonParams } from "../endpoint/EndpointParameters";
-import { GetOpenIdTokenInput, GetOpenIdTokenResponse } from "../models/models_0";
+import {
+  GetOpenIdTokenInput,
+  GetOpenIdTokenInputFilterSensitiveLog,
+  GetOpenIdTokenResponse,
+  GetOpenIdTokenResponseFilterSensitiveLog,
+} from "../models/models_0";
 import { de_GetOpenIdTokenCommand, se_GetOpenIdTokenCommand } from "../protocols/Aws_json1_1";
 
 /**
@@ -108,7 +113,7 @@ export class GetOpenIdTokenCommand extends $Command
   })
   .s("AWSCognitoIdentityService", "GetOpenIdToken", {})
   .n("CognitoIdentityClient", "GetOpenIdTokenCommand")
-  .f(void 0, void 0)
+  .f(GetOpenIdTokenInputFilterSensitiveLog, GetOpenIdTokenResponseFilterSensitiveLog)
   .ser(se_GetOpenIdTokenCommand)
   .de(de_GetOpenIdTokenCommand)
   .build() {}
diff --git a/clients/client-cognito-identity/src/commands/GetOpenIdTokenForDeveloperIdentityCommand.ts b/clients/client-cognito-identity/src/commands/GetOpenIdTokenForDeveloperIdentityCommand.ts
index 494ae04623a1..1e63684167b5 100644
--- a/clients/client-cognito-identity/src/commands/GetOpenIdTokenForDeveloperIdentityCommand.ts
+++ b/clients/client-cognito-identity/src/commands/GetOpenIdTokenForDeveloperIdentityCommand.ts
@@ -8,7 +8,9 @@ import { CognitoIdentityClientResolvedConfig, ServiceInputTypes, ServiceOutputTy
 import { commonParams } from "../endpoint/EndpointParameters";
 import {
   GetOpenIdTokenForDeveloperIdentityInput,
+  GetOpenIdTokenForDeveloperIdentityInputFilterSensitiveLog,
   GetOpenIdTokenForDeveloperIdentityResponse,
+  GetOpenIdTokenForDeveloperIdentityResponseFilterSensitiveLog,
 } from "../models/models_0";
 import {
   de_GetOpenIdTokenForDeveloperIdentityCommand,
@@ -129,7 +131,10 @@ export class GetOpenIdTokenForDeveloperIdentityCommand extends $Command
   })
   .s("AWSCognitoIdentityService", "GetOpenIdTokenForDeveloperIdentity", {})
   .n("CognitoIdentityClient", "GetOpenIdTokenForDeveloperIdentityCommand")
-  .f(void 0, void 0)
+  .f(
+    GetOpenIdTokenForDeveloperIdentityInputFilterSensitiveLog,
+    GetOpenIdTokenForDeveloperIdentityResponseFilterSensitiveLog
+  )
   .ser(se_GetOpenIdTokenForDeveloperIdentityCommand)
   .de(de_GetOpenIdTokenForDeveloperIdentityCommand)
   .build() {}
diff --git a/clients/client-cognito-identity/src/commands/UnlinkIdentityCommand.ts b/clients/client-cognito-identity/src/commands/UnlinkIdentityCommand.ts
index 617229796a11..c4c68362a76d 100644
--- a/clients/client-cognito-identity/src/commands/UnlinkIdentityCommand.ts
+++ b/clients/client-cognito-identity/src/commands/UnlinkIdentityCommand.ts
@@ -6,7 +6,7 @@ import { MetadataBearer as __MetadataBearer } from "@smithy/types";
 
 import { CognitoIdentityClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../CognitoIdentityClient";
 import { commonParams } from "../endpoint/EndpointParameters";
-import { UnlinkIdentityInput } from "../models/models_0";
+import { UnlinkIdentityInput, UnlinkIdentityInputFilterSensitiveLog } from "../models/models_0";
 import { de_UnlinkIdentityCommand, se_UnlinkIdentityCommand } from "../protocols/Aws_json1_1";
 
 /**
@@ -107,7 +107,7 @@ export class UnlinkIdentityCommand extends $Command
   })
   .s("AWSCognitoIdentityService", "UnlinkIdentity", {})
   .n("CognitoIdentityClient", "UnlinkIdentityCommand")
-  .f(void 0, void 0)
+  .f(UnlinkIdentityInputFilterSensitiveLog, void 0)
   .ser(se_UnlinkIdentityCommand)
   .de(de_UnlinkIdentityCommand)
   .build() {}
diff --git a/clients/client-cognito-identity/src/models/models_0.ts b/clients/client-cognito-identity/src/models/models_0.ts
index 4cd46f85c6aa..b469cf80bc85 100644
--- a/clients/client-cognito-identity/src/models/models_0.ts
+++ b/clients/client-cognito-identity/src/models/models_0.ts
@@ -1,5 +1,5 @@
 // smithy-typescript generated code
-import { ExceptionOptionType as __ExceptionOptionType } from "@smithy/smithy-client";
+import { ExceptionOptionType as __ExceptionOptionType, SENSITIVE_STRING } from "@smithy/smithy-client";
 
 import { CognitoIdentityServiceException as __BaseException } from "./CognitoIdentityServiceException";
 
@@ -1438,3 +1438,79 @@ export interface UntagResourceInput {
  * @public
  */
 export interface UntagResourceResponse {}
+
+/**
+ * @internal
+ */
+export const GetCredentialsForIdentityInputFilterSensitiveLog = (obj: GetCredentialsForIdentityInput): any => ({
+  ...obj,
+  ...(obj.Logins && { Logins: SENSITIVE_STRING }),
+});
+
+/**
+ * @internal
+ */
+export const CredentialsFilterSensitiveLog = (obj: Credentials): any => ({
+  ...obj,
+  ...(obj.SecretKey && { SecretKey: SENSITIVE_STRING }),
+});
+
+/**
+ * @internal
+ */
+export const GetCredentialsForIdentityResponseFilterSensitiveLog = (obj: GetCredentialsForIdentityResponse): any => ({
+  ...obj,
+  ...(obj.Credentials && { Credentials: CredentialsFilterSensitiveLog(obj.Credentials) }),
+});
+
+/**
+ * @internal
+ */
+export const GetIdInputFilterSensitiveLog = (obj: GetIdInput): any => ({
+  ...obj,
+  ...(obj.Logins && { Logins: SENSITIVE_STRING }),
+});
+
+/**
+ * @internal
+ */
+export const GetOpenIdTokenInputFilterSensitiveLog = (obj: GetOpenIdTokenInput): any => ({
+  ...obj,
+  ...(obj.Logins && { Logins: SENSITIVE_STRING }),
+});
+
+/**
+ * @internal
+ */
+export const GetOpenIdTokenResponseFilterSensitiveLog = (obj: GetOpenIdTokenResponse): any => ({
+  ...obj,
+  ...(obj.Token && { Token: SENSITIVE_STRING }),
+});
+
+/**
+ * @internal
+ */
+export const GetOpenIdTokenForDeveloperIdentityInputFilterSensitiveLog = (
+  obj: GetOpenIdTokenForDeveloperIdentityInput
+): any => ({
+  ...obj,
+  ...(obj.Logins && { Logins: SENSITIVE_STRING }),
+});
+
+/**
+ * @internal
+ */
+export const GetOpenIdTokenForDeveloperIdentityResponseFilterSensitiveLog = (
+  obj: GetOpenIdTokenForDeveloperIdentityResponse
+): any => ({
+  ...obj,
+  ...(obj.Token && { Token: SENSITIVE_STRING }),
+});
+
+/**
+ * @internal
+ */
+export const UnlinkIdentityInputFilterSensitiveLog = (obj: UnlinkIdentityInput): any => ({
+  ...obj,
+  ...(obj.Logins && { Logins: SENSITIVE_STRING }),
+});
diff --git a/codegen/sdk-codegen/aws-models/cognito-identity.json b/codegen/sdk-codegen/aws-models/cognito-identity.json
index 3dca9eb148c9..0278e637fbb6 100644
--- a/codegen/sdk-codegen/aws-models/cognito-identity.json
+++ b/codegen/sdk-codegen/aws-models/cognito-identity.json
@@ -2279,7 +2279,8 @@
         "smithy.api#length": {
           "min": 1,
           "max": 50000
-        }
+        },
+        "smithy.api#sensitive": {}
       }
     },
     "com.amazonaws.cognitoidentity#IdentityProviders": {
@@ -2907,7 +2908,10 @@
       }
     },
     "com.amazonaws.cognitoidentity#OIDCToken": {
-      "type": "string"
+      "type": "string",
+      "traits": {
+        "smithy.api#sensitive": {}
+      }
     },
     "com.amazonaws.cognitoidentity#PaginationKey": {
       "type": "string",
@@ -3099,7 +3103,10 @@
       }
     },
     "com.amazonaws.cognitoidentity#SecretKeyString": {
-      "type": "string"
+      "type": "string",
+      "traits": {
+        "smithy.api#sensitive": {}
+      }
     },
     "com.amazonaws.cognitoidentity#SessionTokenString": {
       "type": "string"