Amazon Cognito user pool is associated with a WAF Web ACL

Check ID: cognito_user_pool_waf_acl_attached
Provider: AWS
Service: cognito
Severity: MEDIUM
Categories: threat-detection, internet-exposed
Resource type: AwsWafv2WebAcl

What this check verifies

Amazon Cognito user pools are evaluated for an association with an AWS WAFv2 web ACL that filters and controls requests to the hosted UI and public user pool API endpoints.

Risk

Without a web ACL, Cognito endpoints lack layer-7 filtering, enabling:

Credential stuffing and account enumeration
Bot abuse and high-rate requests degrading service
Malicious payload probes

This threatens availability, risks unauthorized access to user data (confidentiality), and undermines session integrity.

Recommendation

Associate an AWS WAFv2 web ACL with each user pool to enforce layer-7 controls. Use defense-in-depth: managed rule groups, rate-based limits, IP reputation, and bot mitigation. Enable request logging and continuously tune rules to reduce false positives. Avoid rule sets incompatible with Cognito endpoints.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws wafv2 associate-web-acl —web-acl-arn <WEB_ACL_ARN> —resource-arn <COGNITO_USER_POOL_ARN>

resource "aws_wafv2_web_acl_association" "<example_resource_name>" {
  resource_arn = "<example_resource_arn>"  # Critical: Cognito User Pool ARN
  web_acl_arn  = "<example_web_acl_arn>"   # Critical: WAF Web ACL ARN
}

Resources:
  <example_resource_name>:
    Type: AWS::WAFv2::WebACLAssociation
    Properties:
      ResourceArn: <example_resource_arn>  # Critical: Cognito User Pool ARN to protect
      WebACLArn: <example_web_acl_arn>     # Critical: WAF Web ACL ARN to associate

References

https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-waf.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cognito_user_pool_waf_acl_attached. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Cognito temporary passwords expire in 7 days or less AWS Config recorder is enabled and not failing

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires