Back to Checks
aws

Amazon Cognito user pool blocks all potential malicious sign-in attempts

cognito_user_pool_blocks_potential_malicious_sign_in_attempts
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:threat-detectionidentity-access
Resource Type:Other

Amazon Cognito user pool with threat protection in ENFORCED mode and adaptive authentication actions set to BLOCK for low, medium, and high account-takeover risk levels.

Evaluates the user pool's risk configuration to confirm risky sign-in attempts are blocked across all severities.

Prowler logoProwlerprowler-provider-aws

Risk

Permitting risky sign-ins degrades confidentiality and integrity. Attackers with stolen or guessed credentials can achieve account takeover, access data, change credentials, and escalate privileges, enabling lateral movement and persistence.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_blocks_potential_malicious_sign_in_attempts

Recommendation

Enable threat protection in ENFORCED mode and configure adaptive authentication to BLOCK at all risk levels.

Apply least privilege and defense in depth: require MFA, avoid broad Always-allow IPs, and monitor user event logs to tune responses and exceptions.

Remediation

Terraform

# Enforce threat protection and block all risk levels
resource "aws_cognito_user_pool" "<example_resource_name>" {
  user_pool_add_ons {
    advanced_security_mode = "ENFORCED"  # Critical: Enables Full function threat protection (required for PASS)
  }
}

resource "aws_cognito_risk_configuration" "<example_resource_name>" {
  user_pool_id = aws_cognito_user_pool.<example_resource_name>.id

  account_takeover_risk_configuration {
    actions {
      low_action {
        event_action = "BLOCK"  # Critical: Block low-risk sign-ins
        notify       = false
      }
      medium_action {
        event_action = "BLOCK"  # Critical: Block medium-risk sign-ins
        notify       = false
      }
      high_action {
        event_action = "BLOCK"  # Critical: Block high-risk sign-ins
        notify       = false
      }
    }
  }
}

NativeIaC

# CloudFormation: Enforce threat protection and block all risk levels
Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolAddOns:
        AdvancedSecurityMode: ENFORCED  # Critical: Enables Full function threat protection (required for PASS)

  RiskConfig:
    Type: AWS::Cognito::UserPoolRiskConfigurationAttachment
    Properties:
      UserPoolId: !Ref UserPool
      AccountTakeoverRiskConfiguration:
        Actions:
          LowAction:
            EventAction: BLOCK  # Critical: Block low-risk sign-ins
            Notify: false
          MediumAction:
            EventAction: BLOCK  # Critical: Block medium-risk sign-ins
            Notify: false
          HighAction:
            EventAction: BLOCK  # Critical: Block high-risk sign-ins
            Notify: false

Other

1In the AWS Console, go to Cognito > User pools and select <example_resource_name>
2Open Threat protection
3Set Enforcement mode to Full function and Save (enables Advanced security)
4In Account takeover risk configuration, set Low, Medium, and High to Block sign-in
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_blocks_potential_malicious_sign_in_attempts(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=pool)
            if (
                pool.advanced_security_mode == "ENFORCED"
                and pool.risk_configuration
                and all(
                    [
                        pool.risk_configuration.account_takeover_risk_configuration.low_action
                        and pool.risk_configuration.account_takeover_risk_configuration.low_action
                        == "BLOCK",
                        pool.risk_configuration.account_takeover_risk_configuration.medium_action
                        and pool.risk_configuration.account_takeover_risk_configuration.medium_action
                        == "BLOCK",
                        pool.risk_configuration.account_takeover_risk_configuration.high_action
                        and pool.risk_configuration.account_takeover_risk_configuration.high_action
                        == "BLOCK",
                    ]
                )
            ):
                report.status = "PASS"
                report.status_extended = f"User pool {pool.name} blocks all potential malicious sign-in attempts."
            else:
                report.status = "FAIL"
                report.status_extended = f"User pool {pool.name} does not block all potential malicious sign-in attempts."
            findings.append(report)

        return findings

References