Medium Cognito Regional

Cognito identity pools should not allow unauthenticated identities

FSBP

Description

Flags Cognito identity pools that allow unauthenticated (guest) identities by having AllowUnauthenticatedIdentities set to true.

Disable unauthenticated identities for your Cognito identity pools to prevent anonymous access to AWS resources.

Navigate to the Amazon Cognito console
Go to the Identity pools section
Select the identity pool that allows unauthenticated access
Edit the identity pool configuration
In the 'Authentication providers' section, uncheck 'Enable access to unauthenticated identities'
Save the configuration changes
Verify that unauthenticated access is now disabled
If unauthenticated access is necessary, ensure proper IAM role restrictions are in place

FSBP