Control: Cognito identity pools should not allow unauthenticated identities
Description
This control checks whether an Amazon Cognito identity pool is configured to allow unauthenticated identities. The control fails if guest access is activated (the AllowUnauthenticatedIdentities parameter is set to true) for the identity pool.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.cognito_identity_pools_restrict_unauthenticated_identities
Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.cognito_identity_pools_restrict_unauthenticated_identities --share
SQL
This control uses a named query:
select identity_pool_id as resource, case when not allow_unauthenticated_identities then 'ok' else 'alarm' end as status, case when not allow_unauthenticated_identities then title || ' restrict unauthenticated identities.' else title || ' allow unauthenticated identities.' end as reason , region, account_idfrom aws_cognito_identity_pool;