Back to All Checks
Medium Cognito Regional

MFA should be enabled for Cognito user pools

Description

Flags Amazon Cognito user pools that authenticate users with passwords but do not require multi-factor authentication. The control is in scope when the pool's first-factor sign-in policy is password-only; pools that require alternative factors (EMAIL_OTP, SMS_OTP, WEB_AUTHN) are out of scope.

Remediation

Enable MFA on every password-only Cognito user pool.

Steps

  1. Open the Amazon Cognito console and select the user pool.
  2. Choose Sign-in experience, then Edit.
  3. Under Multi-factor authentication, set MFA enforcement to Required (or Optional with at least one MFA method).
  4. Configure at least one MFA method (TOTP or SMS) and save the changes.
Start Your Free Security Check