Back to Checks
aws

Cognito user pool has temporary password expiration set to 7 days or less

cognito_user_pool_temporary_password_expiration
Service: cognitoSeverity: medium
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:Other

Amazon Cognito user pools use administrator-issued temporary passwords. This evaluates whether a user pool defines a password policy and sets the temporary password validity to 7 days or fewer.

Prowler logoProwlerprowler-provider-aws

Risk

Long-lived temporary passwords or an absent policy expand the window for credential reuse or interception. An attacker who obtains a temp password can complete first sign-in and set a new secret, enabling account takeover, unauthorized data access, and changes that impact confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks cognito_user_pool_temporary_password_expiration

Recommendation

Define a password policy with temporary password validity <= 7 days (use the shortest practical). Require change on first sign-in, enable MFA during enrollment, and deliver secrets via secure channels. Apply least privilege and revoke or reissue unused temporary credentials promptly.

Remediation

CLI

aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --policies "PasswordPolicy={TemporaryPasswordValidityDays=7}"

Terraform

# Terraform: Set Cognito temporary password expiration to 7 days or less
resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  password_policy {
    temporary_password_validity_days = 7  # Critical: 7 or less to pass the check
  }
}

NativeIaC

# CloudFormation: Set Cognito temporary password expiration to 7 days or less
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          TemporaryPasswordValidityDays: 7  # Critical: ensures temp passwords expire in 7 days (PASS)

Other

1Open the Amazon Cognito console and select **User pools**
2Choose your user pool
3Go to **Authentication** (or **Authentication methods**) > **Password policy**
4Set **Temporary passwords set by administrators expire in** to **7** (or fewer) days
5Click **Save changes**

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.cognito.cognito_idp_client import cognito_idp_client


class cognito_user_pool_temporary_password_expiration(Check):
    def execute(self):
        findings = []
        for pool in cognito_idp_client.user_pools.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=pool)
            if pool.password_policy:
                if pool.password_policy.temporary_password_validity_days <= 7:
                    report.status = "PASS"
                    report.status_extended = f"User pool {pool.name} has temporary password expiration set to {pool.password_policy.temporary_password_validity_days} days."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"User pool {pool.name} has temporary password expiration set to {pool.password_policy.temporary_password_validity_days} days."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"User pool {pool.name} has not password policy set."
                )
            findings.append(report)

        return findings

References