AWS Cognito User Pool requires manual save in console after CF template deployment

When testing my TOKEN endpoint in PostMan, I'm getting the error HTTP 400 - "invalid_grant".

In PostMan, I've configured the Authorization header (w/Basic clientId:secret) and header Content_Type. In the url encoded form, I've set the grant_type = client_credentials. All of these settings are confirmed in the instructions here: https://docs.aws.amazon.com/cognito/latest/developerguide/token-endpoint.html

After manual inspection, my CloudFormation template deploys all the settings correctly.

If I go into Cognito settings, select App Clients from the navigation and then “Save app client changes” without making any changes, I no longer get the same error in PostMan and I can retrieve a valid access code from there on. It’s almost as is the changes aren’t ‘active’ in AWS unless I re-save in the AWS Console for whatever reason.

Is something not fully committed on the AWS backend side unless I manually hit save in the console?

**Again, this template, settings and PostMan test do work BUT only after I go into Cognito and make an edit, save, undo my edit and save again.

Here's my CF template

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: Integration for webSvc1 and webSvc2

Parameters:
  StageName:
 ...

Globals:
  Function:
    Timeout: 20
  Api:
    OpenApiVersion: 3.0.1    

Resources:

  UserPool:
    Type: 'AWS::Cognito::UserPool'
    Properties:
        UserPoolName: !Sub ${CognitoUserPoolName}-${EnvironmentName}
  
  UserPoolResourceServer:
    Type: 'AWS::Cognito::UserPoolResourceServer'
    DependsOn:
    - UserPool    
    Properties: 
      Identifier: !Sub ${CognitoUserPoolName}-${EnvironmentName}
      Name: api-resource-server
      Scopes: 
        - ScopeName: "api.read"
          ScopeDescription: "Read access"
      UserPoolId: !Ref UserPool

  UserPoolDomain: 
    Type: AWS::Cognito::UserPoolDomain 
    DependsOn:
    - UserPool
    - UserPoolResourceServer    
    Properties:
      UserPoolId: !Ref UserPool
      Domain: !Sub id-${EnvironmentName}

  # Creates a User Pool Client to be used by the identity pool
  UserPoolClient:
    Type: 'AWS::Cognito::UserPoolClient'
    DependsOn:
    - UserPool
    - UserPoolResourceServer
    Properties:
      ClientName: !Sub ${CognitoUserPoolName}-client-${EnvironmentName}
      GenerateSecret: true
      UserPoolId: !Ref UserPool
      SupportedIdentityProviders:
        - COGNITO      
      AllowedOAuthFlows:
        - client_credentials
      AllowedOAuthScopes:
        - !Sub ${CognitoUserPoolName}-${EnvironmentName}/api.read