Cognito identity pool has guest access disabled

Check ID: cognito_identity_pool_guest_access_disabled
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito identity pools are evaluated for guest access to unauthenticated identities. The assessment considers the allow_unauthenticated_identities setting and whether an unauthenticated role can be assumed by guests.

Risk

With guest access, unauthenticated users receive temporary credentials, reducing confidentiality and integrity controls. Overly permissive unauthenticated roles enable data reads/writes, API abuse, and resource consumption, risking data exposure, unauthorized changes, and cost amplification.

Recommendation

Disable guest access by setting allow_unauthenticated_identities to false unless strictly required. If needed:

Enforce least privilege with tight resource scopes and conditions
Shorten session lifetimes and rate-limit usage
Prefer authenticated flows (user pools or federated IdPs)
Monitor access for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-identity update-identity-pool —identity-pool-id <example_resource_id> —identity-pool-name <example_resource_name> —no-allow-unauthenticated-identities

# Disable guest (unauthenticated) access in an Identity Pool
resource "aws_cognito_identity_pool" "<example_resource_name>" {
  identity_pool_name               = "<example_resource_name>"
  allow_unauthenticated_identities = false  # Critical: disables guest access
}

# CloudFormation: Disable guest (unauthenticated) access in an Identity Pool
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::IdentityPool
    Properties:
      AllowUnauthenticatedIdentities: false  # Critical: disables unauthenticated (guest) identities

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_identity_pool_guest_access_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CodePipeline source uses an authenticated private repo Cognito user pool advanced security is full-function

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires