Back to Checks
aws

Cognito identity pool has guest access disabled

cognito_identity_pool_guest_access_disabled
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon Cognito identity pools are evaluated for guest access to unauthenticated identities. The assessment considers the allow_unauthenticated_identities setting and whether an unauthenticated role can be assumed by guests.

Prowler logoProwlerprowler-provider-aws

Risk

With guest access, unauthenticated users receive temporary credentials, reducing confidentiality and integrity controls. Overly permissive unauthenticated roles enable data reads/writes, API abuse, and resource consumption, risking data exposure, unauthorized changes, and cost amplification.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_identity_pool_guest_access_disabled

Recommendation

Disable guest access by setting allow_unauthenticated_identities to false unless strictly required.

If needed:

  • Enforce least privilege with tight resource scopes and conditions
  • Shorten session lifetimes and rate-limit usage
  • Prefer authenticated flows (user pools or federated IdPs)
  • Monitor access for defense in depth

Remediation

CLI

aws cognito-identity update-identity-pool --identity-pool-id <example_resource_id> --identity-pool-name <example_resource_name> --no-allow-unauthenticated-identities

Terraform

# Disable guest (unauthenticated) access in an Identity Pool
resource "aws_cognito_identity_pool" "<example_resource_name>" {
  identity_pool_name               = "<example_resource_name>"
  allow_unauthenticated_identities = false  # Critical: disables guest access
}

NativeIaC

# CloudFormation: Disable guest (unauthenticated) access in an Identity Pool
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::IdentityPool
    Properties:
      AllowUnauthenticatedIdentities: false  # Critical: disables unauthenticated (guest) identities

Other

1Open the Amazon Cognito console and go to Identity pools
2Select the identity pool <example_resource_name>
3Click Edit (or Settings) for Authentication settings
4Turn off/clear "Enable access to unauthenticated identities"
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_identity_client import (
    cognito_identity_client,
)


class cognito_identity_pool_guest_access_disabled(Check):
    def execute(self):
        findings = []
        for identity_pool in cognito_identity_client.identity_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=identity_pool)
            report.status = "PASS"
            report.status_extended = (
                f"Identity pool {identity_pool.id} has guest access disabled."
            )
            if identity_pool.allow_unauthenticated_identities:
                report.status = "FAIL"
                report.status_extended = (
                    f"Identity pool {identity_pool.name} has guest access enabled."
                )
                if identity_pool.roles.unauthenticated:
                    report.status_extended = f"Identity pool {identity_pool.name} has guest access enabled assuming the role {identity_pool.roles.unauthenticated}."
            findings.append(report)

        return findings

References