Back to Checks
aws

Cognito user pool blocks sign-in attempts with suspected compromised credentials

cognito_user_pool_blocks_compromised_credentials_sign_in_attempts
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accessthreat-detection
Resource Type:Other

Amazon Cognito user pool threat protection blocks sign-ins when compromised credentials are detected. Advanced security is ENFORCED, and the compromised-credentials policy applies a BLOCK action to sign-in events.

Prowler logoProwlerprowler-provider-aws

Risk

Allowing sign-in with leaked or reused passwords enables account takeover, exposing tokens and profile data (confidentiality), permitting unauthorized changes (integrity), and enabling abuse of linked APIs and sessions (availability impacts via misuse or lockout).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_blocks_compromised_credentials_sign_in_attempts

Recommendation

Enable threat protection with advanced security ENFORCED and set compromised-credential responses to BLOCK for sign-ins. Combine with adaptive authentication and MFA for higher assurance, monitor risk logs, and enforce strong password policies to prevent reuse-applying defense in depth.

Remediation

Terraform

# Enable threat protection and block compromised credentials on sign-in
resource "aws_cognito_user_pool" "example" {
  name = "<example_resource_name>"
  user_pool_add_ons {
    advanced_security_mode = "ENFORCED" # Critical: enables full threat protection required for blocking actions
  }
}

resource "aws_cognito_risk_configuration" "example" {
  user_pool_id = aws_cognito_user_pool.example.id
  compromised_credentials_risk_configuration {
    actions {
      event_action = "BLOCK" # Critical: block sign-in with suspected compromised credentials
    }
    event_filter = ["SIGN_IN"] # Critical: apply the block action to sign-in events
  }
}

NativeIaC

# Enable threat protection and block compromised credentials on sign-in
Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: <example_resource_name>
      UserPoolAddOns:
        AdvancedSecurityMode: ENFORCED  # Critical: enables full threat protection required for blocking actions

  RiskConfig:
    Type: AWS::Cognito::UserPoolRiskConfigurationAttachment
    Properties:
      UserPoolId: !Ref UserPool
      CompromisedCredentialsRiskConfiguration:
        Actions:
          EventAction: BLOCK  # Critical: block sign-in with suspected compromised credentials
        EventFilter:
          - SIGN_IN  # Critical: apply the block action to sign-in events

Other

1In the AWS Console, go to Amazon Cognito > User pools and select <example_resource_name>
2Open Threat protection and click Activate (if not already active)
3Set Enforcement mode to Full function (this sets Advanced security to ENFORCED)
4Under Compromised credentials, ensure Event detection includes Sign-in and set Action to Block sign-in
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_blocks_compromised_credentials_sign_in_attempts(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=pool)
            if (
                pool.advanced_security_mode == "ENFORCED"
                and pool.risk_configuration
                and "SIGN_IN"
                in pool.risk_configuration.compromised_credentials_risk_configuration.event_filter
                and pool.risk_configuration.compromised_credentials_risk_configuration.actions
                == "BLOCK"
            ):
                report.status = "PASS"
                report.status_extended = f"User pool {pool.name} blocks sign-in attempts with suspected compromised credentials."
            else:
                report.status = "FAIL"
                report.status_extended = f"User pool {pool.name} does not block sign-in attempts with suspected compromised credentials."
            findings.append(report)

        return findings

References