Cognito user pools should have threat protection activated with full function enforcement mode for standard authentication

How to fix it

• Can break clients: With Cognito defaults, Full function blocks sign-in at every detected risk level and on compromised credentials, so AWS advises two weeks in Audit only first.
• Affects another check: Cognito.4 also needs Full function for custom authentication, so it fails until both modes are Full function.

In the console

Amazon Cognito → User pools → the pool → Threat protection

Feature plan

Plus, set from the pool's Settings menu first

Threat protection

Activate

Enforcement mode

Full function, for standard authentication

Compromised credentials

Cognito defaults (block sign-in), or Custom actions

Adaptive authentication

Cognito defaults (block sign-in at every risk level), or Custom responses per risk level

With the AWS CLI

• Overwrites existing settings: update-user-pool resets every setting it is not given to its default, so read the pool with describe-user-pool and resupply its configuration in the same call.

aws cognito-idp update-user-pool --user-pool-id <user-pool-id> --user-pool-tier PLUS --user-pool-add-ons AdvancedSecurityMode=ENFORCED --region <region>

With Terraform

resource "aws_cognito_user_pool" "this" {
  name           = var.user_pool_name
  user_pool_tier = "PLUS"

  user_pool_add_ons {
    advanced_security_mode = "ENFORCED"
  }
}