Cognito client has Prevent User Existence Errors on

Check ID: cognito_user_pool_client_prevent_user_existence_errors
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito app clients use PreventUserExistenceErrors to suppress user-existence disclosures, keeping authentication, confirmation, and recovery responses generic rather than indicating whether a username exists.

Risk

If responses reveal user existence, adversaries can enumerate accounts, enabling targeted credential stuffing, brute force, and password-reset abuse. This facilitates account takeover, leaks PII, and can degrade availability through automated lockouts.

Recommendation

Enable user-existence suppression on all app clients (PreventUserExistenceErrors=ENABLED). Apply least disclosure with generic messages across all auth flows and aliases. Strengthen with MFA, rate limiting, and anomalous login detection for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool-client —user-pool-id <USER_POOL_ID> —client-id <APP_CLIENT_ID> —prevent-user-existence-errors ENABLED

resource "aws_cognito_user_pool_client" "<example_resource_name>" {
  name         = "<example_resource_name>"
  user_pool_id = "<example_resource_id>"

  prevent_user_existence_errors = "ENABLED"  # Critical: prevents revealing if a user exists
}

Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: <example_resource_id>
      PreventUserExistenceErrors: ENABLED  # Critical: enables suppression of user existence errors to pass the check
      ClientName: <example_resource_name>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_client_prevent_user_existence_errors. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito user pool blocks malicious sign-in attempts Amazon Cognito user pool client has token revocation enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires