Control: Cognito identity pools should not allow unauthenticated identities

Description

This control checks whether an Amazon Cognito identity pool is configured to allow unauthenticated identities. The control fails if guest access is activated (the AllowUnauthenticatedIdentities parameter is set to true) for the identity pool.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cognito_identity_pools_restrict_unauthenticated_identities

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cognito_identity_pools_restrict_unauthenticated_identities --share

SQL

This control uses a named query:

select
  identity_pool_id as resource,
  case
    when not allow_unauthenticated_identities then 'ok'
    else 'alarm'
  end as status,
  case
    when not allow_unauthenticated_identities then title || ' restrict unauthenticated identities.'
    else title || ' allow unauthenticated identities.'
  end as reason
  
  , region, account_id
from
  aws_cognito_identity_pool;

Control: Cognito identity pools should not allow unauthenticated identities

Description

Usage

SQL

Tags