Back to Checks
aws

Amazon Cognito user pool requires Multi-Factor Authentication (MFA)

cognito_user_pool_mfa_enabled
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon Cognito user pools with MFA set to ON, indicating an additional factor is enforced during authentication

Prowler logoProwlerprowler-provider-aws

Risk

Without MFA, password-only sign-in increases account takeover via phishing, brute force, and credential stuffing. Compromised accounts yield valid tokens to access data and APIs, alter configurations, and move laterally, eroding confidentiality and integrity, and potentially affecting availability through abuse.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_mfa_enabled

Recommendation

Enable MFA at the user pool level (Required or risk-based) as a defense-in-depth control. Prefer TOTP or phishing-resistant methods over SMS. Require factor enrollment during onboarding, and enforce least privilege on downstream permissions. Complement with anomaly detection and session hardening to prevent and contain ATO.

Remediation

CLI

aws cognito-idp set-user-pool-mfa-config --user-pool-id <example_resource_id> --software-token-mfa-configuration Enabled=true --mfa-configuration ON

Terraform

# Terraform: Require MFA and enable TOTP
resource "aws_cognito_user_pool" "<example_resource_name>" {
  name              = "<example_resource_name>"
  mfa_configuration = "ON" # Critical: sets MFA to required

  software_token_mfa_configuration {
    enabled = true # Critical: enables TOTP so ON is valid
  }
}

NativeIaC

# CloudFormation: Require MFA and enable TOTP
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      MfaConfiguration: ON  # Critical: sets MFA to required
      SoftwareTokenMfaConfiguration:
        Enabled: true       # Critical: enables TOTP so ON is valid

Other

1In AWS Console, go to Amazon Cognito > User pools
2Select your user pool
3Open Sign-in > Multi-factor authentication > Edit
4Set MFA enforcement to Require MFA
5Enable Authenticator app (TOTP) under MFA methods
6Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_mfa_enabled(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=pool)
            if pool.mfa_config and pool.mfa_config.status == "ON":
                report.status = "PASS"
                report.status_extended = f"User pool {pool.name} has MFA enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"User pool {pool.name} has MFA disabled."
            findings.append(report)

        return findings

References