Medium
Cognito
Regional
Cognito user pools should have threat protection with full enforcement enabled
FSBP
Description
This control checks whether an Amazon Cognito user pool has advanced security enabled with full enforcement. The control fails if advanced security is not enabled or if it's set to audit mode instead of enforcement mode. Advanced security provides additional protection against compromised credentials and account takeover attacks by analyzing sign-in attempts and blocking suspicious activity.
Remediation
Enable advanced security with full enforcement for your Cognito user pools to protect against compromised credentials and account takeover attacks.
Steps
- Navigate to the Amazon Cognito console
- Go to the User pools section
- Select the user pool that needs advanced security
- Go to the 'Sign-in experience' tab
- Scroll down to 'Advanced security' section
- Enable 'Advanced security features'
- Set the mode to 'Enforce' (not just 'Audit')
- Configure the risk-based adaptive authentication settings
- Save the changes
- Verify that advanced security is now enforced
Compliance
FSBP