AWS Cognito identity pool allows unauthenticated guest access misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_366
Category - Subcategory	IAM - Overly Permissive
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	58b0f618-1fcf-415c-a72e-b92154e0602d

Impact

This rule checks whether AWS Cognito identity pools allows unauthenticated guest access. Guest access poses a security risk as it could enable unauthorized individuals to access sensitive data or functionality. Disabling guest access helps maintain system and data security.

How to Fix

CloudFormation

• Resource: AWS::Cognito::IdentityPool
• Arguments: Properties/AllowUnauthenticatedIdentities

To fix this issue:

Set the AllowUnauthenticatedIdentities property within the AWS::Cognito::IdentityPool resource to false in your CloudFormation template, as displayed in the example below. Resources: Pass: Type: AWS::Cognito::IdentityPool Properties: ...

• AllowUnauthenticatedIdentities: False

---