Back to Checks
aws

Amazon Cognito user pool client has Prevent User Existence Errors enabled

cognito_user_pool_client_prevent_user_existence_errors
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon Cognito app clients use PreventUserExistenceErrors to suppress user-existence disclosures, keeping authentication, confirmation, and recovery responses generic rather than indicating whether a username exists.

Prowler logoProwlerprowler-provider-aws

Risk

If responses reveal user existence, adversaries can enumerate accounts, enabling targeted credential stuffing, brute force, and password-reset abuse. This facilitates account takeover, leaks PII, and can degrade availability through automated lockouts.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_client_prevent_user_existence_errors

Recommendation

Enable user-existence suppression on all app clients (PreventUserExistenceErrors=ENABLED). Apply least disclosure with generic messages across all auth flows and aliases. Strengthen with MFA, rate limiting, and anomalous login detection for defense in depth.

Remediation

CLI

aws cognito-idp update-user-pool-client --user-pool-id <USER_POOL_ID> --client-id <APP_CLIENT_ID> --prevent-user-existence-errors ENABLED

Terraform

resource "aws_cognito_user_pool_client" "<example_resource_name>" {
  name         = "<example_resource_name>"
  user_pool_id = "<example_resource_id>"

  prevent_user_existence_errors = "ENABLED"  # Critical: prevents revealing if a user exists
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: <example_resource_id>
      PreventUserExistenceErrors: ENABLED  # Critical: enables suppression of user existence errors to pass the check
      ClientName: <example_resource_name>

Other

1Open the Amazon Cognito console and go to User pools
2Select your user pool, then go to App integration > App clients
3Choose the target app client and click Edit
4Set Prevent user existence errors to Enabled
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_client_prevent_user_existence_errors(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            for user_pool_client in pool.user_pool_clients.values():
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=user_pool_client
                )
                report.resource_tags = pool.tags
                if user_pool_client.prevent_user_existence_errors == "ENABLED":
                    report.status = "PASS"
                    report.status_extended = f"User pool client {user_pool_client.name} prevents revealing users in existence errors."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"User pool client {user_pool_client.name} does not prevent revealing users in existence errors."
                findings.append(report)

        return findings

References