Cognito user pool requires Multi-Factor Authentication (MFA)

Check ID: cognito_user_pool_mfa_enabled
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito user pools with MFA set to ON, indicating an additional factor is enforced during authentication

Risk

Without MFA, password-only sign-in increases account takeover via phishing, brute force, and credential stuffing. Compromised accounts yield valid tokens to access data and APIs, alter configurations, and move laterally, eroding confidentiality and integrity, and potentially affecting availability through abuse.

Recommendation

Enable MFA at the user pool level (Required or risk-based) as a defense-in-depth control. Prefer TOTP or phishing-resistant methods over SMS. Require factor enrollment during onboarding, and enforce least privilege on downstream permissions. Complement with anomaly detection and session hardening to prevent and contain ATO.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp set-user-pool-mfa-config --user-pool-id <example_resource_id> --software-token-mfa-configuration Enabled=true --mfa-configuration ON

# Terraform: Require MFA and enable TOTP
resource "aws_cognito_user_pool" "<example_resource_name>" {
  name              = "<example_resource_name>"
  mfa_configuration = "ON" # Critical: sets MFA to required

  software_token_mfa_configuration {
    enabled = true # Critical: enables TOTP so ON is valid
  }
}

# CloudFormation: Require MFA and enable TOTP
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      MfaConfiguration: ON  # Critical: sets MFA to required
      SoftwareTokenMfaConfiguration:
        Enabled: true       # Critical: enables TOTP so ON is valid

References

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_mfa_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito user pool has deletion protection enabled Cognito password policy requires one lowercase letter

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires