Back to Checks
aws

Amazon Cognito user pool has self registration disabled

cognito_user_pool_self_registration_disabled
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon Cognito user pools are evaluated for self-service sign-up. The expected configuration is AllowAdminCreateUserOnly=true so only administrators create accounts.

When self sign-up is allowed, the check also highlights any linked identity pools and the authenticated role(s) that new users could assume.

Prowler logoProwlerprowler-provider-aws

Risk

Open sign-up lets untrusted users gain authenticated identities, potentially assuming identity pool roles. This can expose data (confidentiality), enable unauthorized actions (integrity), and drive abuse or cost via resource use (availability). Mass registrations and token harvesting increase the chance of lateral access.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_self_registration_disabled

Recommendation

Enforce admin-only user creation. If self sign-up is necessary, require verification, MFA, and bot protections; restrict app clients. Apply least privilege to any roles for authenticated users and minimize scopes. Use approval/invite flows, add rate limits, monitor sign-ups, and audit access for defense in depth.

Remediation

CLI

aws cognito-idp update-user-pool --user-pool-id <USER_POOL_ID> --admin-create-user-config AllowAdminCreateUserOnly=true

Terraform

# Terraform: Disable self-registration in a Cognito User Pool
resource "aws_cognito_user_pool" "<example_resource_name>" {
  admin_create_user_config {
    allow_admin_create_user_only = true  # Critical: disables self sign-up; only admins can create users
  }
}

NativeIaC

# CloudFormation: Disable self-registration in a Cognito User Pool
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true  # Critical: disables self sign-up; only admins can create users

Other

1Open the AWS Console and go to Amazon Cognito > User pools
2Select the user pool
3Go to the Sign-up tab
4In Self-service sign-up, click Edit and disable (uncheck) Enable self-registration
5Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_identity_client import (
    cognito_identity_client,
)
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_self_registration_disabled(Check):
    def execute(self):
        findings = []
        for user_pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=user_pool)
            report.status = "PASS"
            report.status_extended = (
                f"User pool {user_pool.id} has self registration disabled."
            )
            if (
                user_pool.admin_create_user_config
                and not user_pool.admin_create_user_config.allow_admin_create_user_only
            ):
                report.status = "FAIL"
                report.status_extended = (
                    f"User pool {user_pool.id} has self registration enabled."
                )
                associated_identity_pool_authenticated_roles = []
                for identity_pool in cognito_identity_client.identity_pools.values():
                    for associated_pool in identity_pool.associated_pools:
                        if (
                            f"cognito-idp.{user_pool.region}.amazonaws.com/{user_pool.id}"
                            == associated_pool.get("ProviderName", "")
                        ):
                            if identity_pool.roles.authenticated:
                                associated_identity_pool_authenticated_roles.append(
                                    f"{identity_pool.name}({identity_pool.roles.authenticated})"
                                )
                            else:
                                associated_identity_pool_authenticated_roles.append(
                                    identity_pool.name
                                )
                if associated_identity_pool_authenticated_roles:
                    report.status_extended = f"User pool {user_pool.name} has self registration enabled assuming the role(s): {(', ').join(associated_identity_pool_authenticated_roles)}."
            findings.append(report)

        return findings

References