Cognito user pool blocks compromised-credential sign-ins

Check ID: cognito_user_pool_blocks_compromised_credentials_sign_in_attempts
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access, threat-detection
Resource type: Other

What this check verifies

Amazon Cognito user pool threat protection blocks sign-ins when compromised credentials are detected. Advanced security is ENFORCED, and the compromised-credentials policy applies a BLOCK action to sign-in events.

Risk

Allowing sign-in with leaked or reused passwords enables account takeover, exposing tokens and profile data (confidentiality), permitting unauthorized changes (integrity), and enabling abuse of linked APIs and sessions (availability impacts via misuse or lockout).

Recommendation

Enable threat protection with advanced security ENFORCED and set compromised-credential responses to BLOCK for sign-ins. Combine with adaptive authentication and MFA for higher assurance, monitor risk logs, and enforce strong password policies to prevent reuse-applying defense in depth.

Remediation

Terraform
Native IaC
Dashboard steps

# Enable threat protection and block compromised credentials on sign-in
resource "aws_cognito_user_pool" "example" {
  name = "<example_resource_name>"
  user_pool_add_ons {
    advanced_security_mode = "ENFORCED" # Critical: enables full threat protection required for blocking actions
  }
}

resource "aws_cognito_risk_configuration" "example" {
  user_pool_id = aws_cognito_user_pool.example.id
  compromised_credentials_risk_configuration {
    actions {
      event_action = "BLOCK" # Critical: block sign-in with suspected compromised credentials
    }
    event_filter = ["SIGN_IN"] # Critical: apply the block action to sign-in events
  }
}

# Enable threat protection and block compromised credentials on sign-in
Resources:
  UserPool:
    Type: AWS::Cognito::UserPool
    Properties:
      UserPoolName: <example_resource_name>
      UserPoolAddOns:
        AdvancedSecurityMode: ENFORCED  # Critical: enables full threat protection required for blocking actions

  RiskConfig:
    Type: AWS::Cognito::UserPoolRiskConfigurationAttachment
    Properties:
      UserPoolId: !Ref UserPool
      CompromisedCredentialsRiskConfiguration:
        Actions:
          EventAction: BLOCK  # Critical: block sign-in with suspected compromised credentials
        EventFilter:
          - SIGN_IN  # Critical: apply the block action to sign-in events

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_blocks_compromised_credentials_sign_in_attempts. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito user pool advanced security is full-function Cognito user pool blocks malicious sign-in attempts

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires