Back to Checks
aws

Cognito user pool has advanced security enforced with full-function mode

cognito_user_pool_advanced_security_enabled
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accessthreat-detection
Resource Type:Other

Amazon Cognito user pools are evaluated for Threat protection (advanced security) mode: ENFORCED (full-function) vs AUDIT or disabled. This indicates whether adaptive risk responses and compromised-credential checks are applied during authentication.

Prowler logoProwlerprowler-provider-aws

Risk

Without enforced threat protection, risky sign-ins aren't blocked-only logged-enabling credential stuffing, brute force, and account takeover. This threatens confidentiality and integrity via unauthorized access and token misuse, and can degrade availability through automated abuse.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_advanced_security_enabled

Recommendation

Set Threat protection to ENFORCED to apply automatic mitigations.

  • Require step-up MFA on risky events
  • Block compromised credentials
  • Use IP allow/deny lists and export logs for monitoring Baseline in AUDIT, then enforce. Apply defense in depth and least privilege across apps and clients.

Remediation

CLI

aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --user-pool-add-ons AdvancedSecurityMode=ENFORCED

Terraform

resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  # Critical: Enables full-function threat protection (advanced security)
  user_pool_add_ons {
    advanced_security_mode = "ENFORCED"  # Set to ENFORCED to pass the check
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      # Critical: Enables full-function threat protection (advanced security)
      UserPoolAddOns:
        AdvancedSecurityMode: ENFORCED  # Sets advanced security to ENFORCED

Other

1In the AWS Console, go to Cognito > User pools and select your pool
2Open Threat protection
3Click Activate (enable Plus feature plan if prompted)
4Set Enforcement mode to Full function (ENFORCED)
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_advanced_security_enabled(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=pool)
            if pool.advanced_security_mode == "ENFORCED":
                report.status = "PASS"
                report.status_extended = f"User pool {pool.name} has advanced security enforced with full-function mode."
            elif pool.advanced_security_mode == "AUDIT":
                report.status = "FAIL"
                report.status_extended = f"User pool {pool.name} has advanced security enabled but with audit-only mode."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"User pool {pool.name} has advanced security disabled."
                )
            findings.append(report)

        return findings

References