All checks

Medium Cognito · regional

MFA should be enabled for Cognito user pools

Flags Amazon Cognito user pools that authenticate users with passwords but do not require multi-factor authentication. The control is in scope when the pool's first-factor sign-in policy is password-only; pools that require alternative factors (EMAIL_OTP, SMS_OTP, WEB_AUTHN) are out of scope.

service: Cognito
severity: Medium
scope: evaluated in every region

How to fix it

Enable MFA on every password-only Cognito user pool.

Open the Amazon Cognito console and select the user pool.
Choose Sign-in experience, then Edit.
Under Multi-factor authentication, set MFA enforcement to Required (or Optional with at least one MFA method).
Configure at least one MFA method (TOTP or SMS) and save the changes.

See which of your accounts this check is failing on.

Book a demo