Amazon Cognito user pool has self registration disabled

Check ID: cognito_user_pool_self_registration_disabled
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito user pools are evaluated for self-service sign-up. The expected configuration is AllowAdminCreateUserOnly=true so only administrators create accounts. When self sign-up is allowed, the check also highlights any linked identity pools and the authenticated role(s) that new users could assume.

Risk

Open sign-up lets untrusted users gain authenticated identities, potentially assuming identity pool roles. This can expose data (confidentiality), enable unauthorized actions (integrity), and drive abuse or cost via resource use (availability). Mass registrations and token harvesting increase the chance of lateral access.

Recommendation

Enforce admin-only user creation. If self sign-up is necessary, require verification, MFA, and bot protections; restrict app clients. Apply least privilege to any roles for authenticated users and minimize scopes. Use approval/invite flows, add rate limits, monitor sign-ups, and audit access for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool --user-pool-id <USER_POOL_ID> --admin-create-user-config AllowAdminCreateUserOnly=true

# Terraform: Disable self-registration in a Cognito User Pool
resource "aws_cognito_user_pool" "<example_resource_name>" {
  admin_create_user_config {
    allow_admin_create_user_only = true  # Critical: disables self sign-up; only admins can create users
  }
}

# CloudFormation: Disable self-registration in a Cognito User Pool
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      AdminCreateUserConfig:
        AllowAdminCreateUserOnly: true  # Critical: disables self sign-up; only admins can create users

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_self_registration_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito password policy requires one uppercase letter Cognito temporary passwords expire in 7 days or less

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires