All checks
Medium
Cognito identity pools should not allow unauthenticated identities
Flags Cognito identity pools that allow unauthenticated (guest) identities by having AllowUnauthenticatedIdentities set to true.
- service
- Cognito
- severity
- Medium
- scope
- evaluated in every region
How to fix it
Disable unauthenticated identities for your Cognito identity pools to prevent anonymous access to AWS resources.
- Navigate to the Amazon Cognito console
- Go to the Identity pools section
- Select the identity pool that allows unauthenticated access
- Edit the identity pool configuration
- In the 'Authentication providers' section, uncheck 'Enable access to unauthenticated identities'
- Save the configuration changes
- Verify that unauthenticated access is now disabled
- If unauthenticated access is necessary, ensure proper IAM role restrictions are in place
See which of your accounts this check is failing on.
Book a demo