Back to Checks
aws

Amazon Cognito user pool client has token revocation enabled

cognito_user_pool_client_token_revocation_enabled
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon Cognito user pool app clients are evaluated for token revocation being enabled via EnableTokenRevocation.

This identifies whether each client can invalidate refresh tokens and the access/ID tokens derived from them to end user sessions.

Prowler logoProwlerprowler-provider-aws

Risk

Without token revocation, stolen or residual refresh tokens remain valid until expiry, enabling continued access after sign-out or account disablement. This undermines confidentiality and integrity by permitting unauthorized API calls, data exfiltration, and session hijacking.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_client_token_revocation_enabled

Recommendation

Enable EnableTokenRevocation: true on all app clients.

Also:

  • Use refresh token rotation
  • Shorten token lifetimes
  • Apply least privilege to scopes
  • Enforce user/admin sign-out to terminate sessions
  • Monitor for anomalous token reuse

Remediation

CLI

aws cognito-idp update-user-pool-client --user-pool-id <USER_POOL_ID> --client-id <USER_POOL_CLIENT_ID> --enable-token-revocation

Terraform

resource "aws_cognito_user_pool_client" "<example_resource_name>" {
  name                    = "<example_resource_name>"
  user_pool_id            = "<example_resource_id>"
  enable_token_revocation = true  # Critical: Enables token revocation so the client passes the check
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: "<example_resource_id>"
      EnableTokenRevocation: true  # Critical: Enables token revocation so the client passes the check

Other

1In the AWS Console, go to Amazon Cognito > User pools
2Select your user pool, then open App integration > App clients
3Click the target app client and choose Edit
4Under Advanced configuration, enable Token revocation
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_client_token_revocation_enabled(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            for pool_client in pool.user_pool_clients.values():
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=pool_client
                )
                report.resource_tags = pool.tags
                if pool_client.enable_token_revocation:
                    report.status = "PASS"
                    report.status_extended = f"User pool client {pool_client.name} has token revocation enabled."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"User pool client {pool_client.name} has token revocation disabled."
                findings.append(report)

        return findings

References