turbot/steampipe-mod-aws-compliance

Control: Cognito identity pools should not allow unauthenticated identities

Description

This control checks whether an Amazon Cognito identity pool is configured to allow unauthenticated identities. The control fails if guest access is activated (the AllowUnauthenticatedIdentities parameter is set to true) for the identity pool.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cognito_identity_pools_restrict_unauthenticated_identities

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cognito_identity_pools_restrict_unauthenticated_identities --share

SQL

This control uses a named query:

select
identity_pool_id as resource,
case
when not allow_unauthenticated_identities then 'ok'
else 'alarm'
end as status,
case
when not allow_unauthenticated_identities then title || ' restrict unauthenticated identities.'
else title || ' allow unauthenticated identities.'
end as reason
, region, account_id
from
aws_cognito_identity_pool;

Tags