Amazon Cognito user pool client has token revocation enabled

Check ID: cognito_user_pool_client_token_revocation_enabled
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito user pool app clients are evaluated for token revocation being enabled via EnableTokenRevocation. This identifies whether each client can invalidate refresh tokens and the access/ID tokens derived from them to end user sessions.

Risk

Without token revocation, stolen or residual refresh tokens remain valid until expiry, enabling continued access after sign-out or account disablement. This undermines confidentiality and integrity by permitting unauthorized API calls, data exfiltration, and session hijacking.

Recommendation

Enable EnableTokenRevocation: true on all app clients. Also:

Use refresh token rotation
Shorten token lifetimes
Apply least privilege to scopes
Enforce user/admin sign-out to terminate sessions
Monitor for anomalous token reuse

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool-client —user-pool-id <USER_POOL_ID> —client-id <USER_POOL_CLIENT_ID> —enable-token-revocation

resource "aws_cognito_user_pool_client" "<example_resource_name>" {
  name                    = "<example_resource_name>"
  user_pool_id            = "<example_resource_id>"
  enable_token_revocation = true  # Critical: Enables token revocation so the client passes the check
}

Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: "<example_resource_id>"
      EnableTokenRevocation: true  # Critical: Enables token revocation so the client passes the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_client_token_revocation_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito client has Prevent User Existence Errors on Cognito user pool has deletion protection enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires