🛡️ AWS Cognito Identity Pool allows unauthenticated identities🟢

• Contextual name: 🛡️ Identity Pool allows unauthenticated identities🟢
• ID: /ce/ca/aws/cognito/identity-pool-unauthenticated-identities
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS Cognito Identity Pool
  • 🔌 AWS Cognito Identity Pool - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• AWS Security Hub: [Cognito.2] Cognito identity pools should not allow unauthenticated identities

Description

Open File

Description

This policy identifies Amazon Cognito identity pools that allow unauthenticated identities.

Rationale

When unauthenticated identities are enabled, Amazon Cognito can issue temporary AWS credentials to guest users without requiring sign-in through a trusted identity provider. This expands the attack surface and can expose downstream AWS resources if the unauthenticated role is broader than intended or if the application relies on guest sessions more widely than expected.

Even when guest access is used for low-friction onboarding or public-facing features, it weakens identity assurance and reduces accountability for actions performed with the issued credentials. Disabling unauthenticated identities by default helps enforce authenticated access paths and keeps IAM permissions aligned with known, trusted users.

Audit

This policy flags a Cognito Identity Pool as INCOMPLIANT when Allow Unauthenticated Identities is set to true.

Remediation

Open File

Remediation

Disable Unauthenticated Identities

Disable guest access for the identity pool after confirming that any application flows using unauthenticated sessions are no longer required:

From Command Line

aws cognito-identity update-identity-pool \
    --identity-pool-id {{identity-pool-id}} \
    --identity-pool-name {{identity-pool-name}} \
    --no-allow-unauthenticated-identities

After the change, review the application and associated IAM role mappings to ensure that only authenticated identities retain access to AWS resources through the identity pool.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [Cognito.2] Cognito identity pools should not allow unauthenticated identities			1		no data
💼 Cloudaware Framework → 💼 Secure Access			56		no data