Check ID: cognito_user_pool_blocks_potential_malicious_sign_in_attempts
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: threat-detection, identity-access
Resource type: Other

​
What this check verifies

Amazon Cognito user pool with threat protection in ENFORCED mode and adaptive authentication actions set to BLOCK for low, medium, and high account-takeover risk levels. Evaluates the user pool’s risk configuration to confirm risky sign-in attempts are blocked across all severities.

​
Risk

Permitting risky sign-ins degrades confidentiality and integrity. Attackers with stolen or guessed credentials can achieve account takeover, access data, change credentials, and escalate privileges, enabling lateral movement and persistence.

​
Recommendation

Enable threat protection in ENFORCED mode and configure adaptive authentication to BLOCK at all risk levels. Apply least privilege and defense in depth: require MFA, avoid broad Always-allow IPs, and monitor user event logs to tune responses and exceptions.

​
Remediation

# Enforce threat protection and block all risk levels
resource "aws_cognito_user_pool" "<example_resource_name>" {
  user_pool_add_ons {
    advanced_security_mode = "ENFORCED"  # Critical: Enables Full function threat protection (required for PASS)
  }
}

resource "aws_cognito_risk_configuration" "<example_resource_name>" {
  user_pool_id = aws_cognito_user_pool.<example_resource_name>.id

  account_takeover_risk_configuration {
    actions {
      low_action {
        event_action = "BLOCK"  # Critical: Block low-risk sign-ins
        notify       = false
      }
      medium_action {
        event_action = "BLOCK"  # Critical: Block medium-risk sign-ins
        notify       = false
      }
      high_action {
        event_action = "BLOCK"  # Critical: Block high-risk sign-ins
        notify       = false
      }
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_blocks_potential_malicious_sign_in_attempts. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks