Cognito user pool advanced security is full-function

Check ID: cognito_user_pool_advanced_security_enabled
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access, threat-detection
Resource type: Other

What this check verifies

Amazon Cognito user pools are evaluated for Threat protection (advanced security) mode: ENFORCED (full-function) vs AUDIT or disabled. This indicates whether adaptive risk responses and compromised-credential checks are applied during authentication.

Risk

Without enforced threat protection, risky sign-ins aren’t blocked-only logged-enabling credential stuffing, brute force, and account takeover. This threatens confidentiality and integrity via unauthorized access and token misuse, and can degrade availability through automated abuse.

Recommendation

Set Threat protection to ENFORCED to apply automatic mitigations.

Require step-up MFA on risky events
Block compromised credentials
Use IP allow/deny lists and export logs for monitoring Baseline in AUDIT, then enforce. Apply defense in depth and least privilege across apps and clients.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --user-pool-add-ons AdvancedSecurityMode=ENFORCED

resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  # Critical: Enables full-function threat protection (advanced security)
  user_pool_add_ons {
    advanced_security_mode = "ENFORCED"  # Set to ENFORCED to pass the check
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      # Critical: Enables full-function threat protection (advanced security)
      UserPoolAddOns:
        AdvancedSecurityMode: ENFORCED  # Sets advanced security to ENFORCED

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_advanced_security_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito identity pool has guest access disabled Cognito user pool blocks compromised-credential sign-ins

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires