Cognito user pool must enforce MFA

Critical AWS General aws-cognito-userpool-mfa

Applies to

AWS::Cognito::UserPool

What CGPulse checks

A resource passes this rule when mfaConfiguration must equal ON. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Set MFA to mandatory for all users to prevent account compromise from stolen credentials. In AWS Console: Cognito > User pools > select pool > Sign-in experience > MFA > Required. See: https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa.html

Terraform

resource "aws_cognito_user_pool" "{name}" {
  mfa_configuration = "ON"
}

Compliance frameworks

Cloud Security: AWS Foundations
GDPR: Data Protection Controls
HIPAA: Health Information Protection164.312(a)(1)
ISO 27001: Information SecurityA.9.4.2
NIST 800-53: Cloud Security ControlsIA-2
PCI DSS v4.08.3.1
SOC 2: Trust ServicesPI1.4

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan