Cognito user pool has deletion protection enabled

Check ID: cognito_user_pool_deletion_protection_enabled
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: resilience
Resource type: Other

What this check verifies

Amazon Cognito user pools have deletion protection set to ACTIVE. The evaluation inspects each user pool’s deletion protection status.

Risk

Without deletion protection, any principal with delete rights can remove a user pool in one action, causing immediate authentication outages. Identities and configurations are lost, breaking sign-ins and tokens, harming availability and integrity, and prolonging recovery if exports/backups are stale.

Recommendation

Enable deletion protection (ACTIVE) on all production user pools.

Enforce least privilege by restricting delete permissions
Require change control and multi-party approval to deactivate protection
Add monitoring and alerts for status changes as defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool —user-pool-id <example_resource_id> —deletion-protection ACTIVE

resource "aws_cognito_user_pool" "<example_resource_name>" {
  name                 = "<example_resource_name>"
  deletion_protection  = "ACTIVE" # Critical: Enables deletion protection to prevent accidental pool deletion
}

Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      DeletionProtection: ACTIVE  # Critical: Enables deletion protection to prevent accidental pool deletion

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_deletion_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Amazon Cognito user pool client has token revocation enabled Cognito user pool requires Multi-Factor Authentication (MFA)

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires