Cognito temporary passwords expire in 7 days or less

Check ID: cognito_user_pool_temporary_password_expiration
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: identity-access
Resource type: Other

What this check verifies

Amazon Cognito user pools use administrator-issued temporary passwords. This evaluates whether a user pool defines a password policy and sets the temporary password validity to 7 days or fewer.

Risk

Long-lived temporary passwords or an absent policy expand the window for credential reuse or interception. An attacker who obtains a temp password can complete first sign-in and set a new secret, enabling account takeover, unauthorized data access, and changes that impact confidentiality and integrity.

Recommendation

Define a password policy with temporary password validity <= 7 days (use the shortest practical). Require change on first sign-in, enable MFA during enrollment, and deliver secrets via secure channels. Apply least privilege and revoke or reissue unused temporary credentials promptly.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cognito-idp update-user-pool --user-pool-id <example_resource_id> --policies "PasswordPolicy={TemporaryPasswordValidityDays=7}"

# Terraform: Set Cognito temporary password expiration to 7 days or less
resource "aws_cognito_user_pool" "<example_resource_name>" {
  name = "<example_resource_name>"

  password_policy {
    temporary_password_validity_days = 7  # Critical: 7 or less to pass the check
  }
}

# CloudFormation: Set Cognito temporary password expiration to 7 days or less
Resources:
  <example_resource_name>:
    Type: AWS::Cognito::UserPool
    Properties:
      Policies:
        PasswordPolicy:
          TemporaryPasswordValidityDays: 7  # Critical: ensures temp passwords expire in 7 days (PASS)

References

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_temporary_password_expiration. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Amazon Cognito user pool has self registration disabled Amazon Cognito user pool is associated with a WAF Web ACL

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires