Super late to this thread but want to put an answer in for anyone who comes in later.
You can now use AdminUserGlobalSignOut via the Cognito API to revoke all active identity tokens for a specified user.