Back to Checks
aws

Cognito user pool has deletion protection enabled

cognito_user_pool_deletion_protection_enabled
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

Amazon Cognito user pools have deletion protection set to ACTIVE. The evaluation inspects each user pool's deletion protection status.

Prowler logoProwlerprowler-provider-aws

Risk

Without deletion protection, any principal with delete rights can remove a user pool in one action, causing immediate authentication outages. Identities and configurations are lost, breaking sign-ins and tokens, harming availability and integrity, and prolonging recovery if exports/backups are stale.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_deletion_protection_enabled

Recommendation

Enable deletion protection (ACTIVE) on all production user pools.

  • Enforce least privilege by restricting delete permissions
  • Require change control and multi-party approval to deactivate protection
  • Add monitoring and alerts for status changes as defense in depth

Remediation

CLI

aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --deletion-protection ACTIVE

Terraform

resource "aws_cognito_user_pool" "<example_resource_name>" {
  name                 = "<example_resource_name>"
  deletion_protection  = "ACTIVE" # Critical: Enables deletion protection to prevent accidental pool deletion
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      DeletionProtection: ACTIVE  # Critical: Enables deletion protection to prevent accidental pool deletion

Other

1Open the AWS Management Console and go to Amazon Cognito
2Click User pools and select your pool
3Go to Settings > Deletion protection
4Click Activate (or toggle On) and Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_deletion_protection_enabled(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=pool)
            if pool.deletion_protection == "ACTIVE":
                report.status = "PASS"
                report.status_extended = (
                    f"User pool {pool.name} has deletion protection enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"User pool {pool.name} has deletion protection disabled."
                )
            findings.append(report)

        return findings

References