All checks
Medium
Cognito identity pools should not allow unauthenticated identities
Checks that a Cognito identity pool does not allow unauthenticated identities (guest access). With guest access, the pool gives temporary AWS credentials to users who have not signed in through any identity provider, which allows anonymous access to AWS resources. Where guest access must stay, keep the guest role's permissions narrow; the finding stays open.
- service
- Cognito
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: Users who have not signed in stop receiving AWS credentials, so any app feature that runs before sign-in loses its access.
In the console
Amazon Cognito → Identity pools → the pool → User access → Guest access
- Guest access
- Deactivate
With the AWS CLI
- Overwrites existing settings: update-identity-pool resets every parameter it is not given to its default, so read the pool with describe-identity-pool and resupply its identity providers in the same call.
aws cognito-identity update-identity-pool --identity-pool-id <identity-pool-id> --identity-pool-name <identity-pool-name> --no-allow-unauthenticated-identities --region <region>With Terraform
resource "aws_cognito_identity_pool" "this" {
identity_pool_name = var.identity_pool_name
allow_unauthenticated_identities = false
}See which of your accounts this check is failing on.
Book a live scan