Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

For every Amazon Cognito directory that fronts non-organizational users: the user pool's multi-factor configuration, and every identity pool's guest-access flag together with the named external providers it will exchange a token for

JSON — GET /api/aws-evidenceMD — /collect/cognito-external-user-authentication.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementcliweeklyAmazon CognitoAWS IAM

Fetch

$ aws cognito-idp list-user-pools --max-results 60 --query 'UserPools[].{Id:Id,Name:Name,Status:Status}'
$ aws cognito-idp get-user-pool-mfa-config --user-pool-id <USER_POOL_ID>
$ aws cognito-identity list-identity-pools --max-results 60 --query 'IdentityPools[].{Id:IdentityPoolId,Name:IdentityPoolName}'
$ aws cognito-identity describe-identity-pool --identity-pool-id <IDENTITY_POOL_ID> --query '{Id:IdentityPoolId,AllowUnauthenticatedIdentities:AllowUnauthenticatedIdentities,AllowClassicFlow:AllowClassicFlow,Cognito:CognitoIdentityProviders,Login:SupportedLoginProviders,Saml:SamlProviderARNs,Oidc:OpenIdConnectProviderARNs}'

Expected output

One get-user-pool-mfa-config response per user pool under the projection root user-pool-mfa: MfaConfiguration (OFF | ON | OPTIONAL) plus whichever factor blocks are configured — SoftwareTokenMfaConfiguration.Enabled for TOTP, SmsMfaConfiguration for SMS, EmailMfaConfiguration for email OTP. One describe-identity-pool response per identity pool under the projection root identity-pool: AllowUnauthenticatedIdentities (TRUE if the pool supports unauthenticated logins), AllowClassicFlow, and the four trust fields — CognitoIdentityProviders, SupportedLoginProviders (provider name to app id), SamlProviderARNs and OpenIdConnectProviderARNs.

Assertions — what makes it a pass

Assertions for For every Amazon Cognito directory that fronts non-organizational users: the user pool's multi-factor configuration, and every identity pool's guest-access flag together with the named external providers it will exchange a token for: the field checked, the condition it must satisfy, the rows it applies to, and the controls a pass proves.
FieldMust beForProves
identity-pool.AllowUnauthenticatedIdentitieseq falseNo identity pool supports unauthenticated logins, so every non-organizational principal holding AWS credentials authenticated to get them.every rowIA-08
user-pool-mfa.MfaConfigurationeq "ON"Every user pool the assessor names as serving non-organizational users requires MFA, so an external identity authenticates with a second factor rather than a password alone. This is the authentication limb of IA-08 only — uniqueness is not in this output.every rowIA-08

Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.

Map — what it proves

  • recipe1
Key Security Indicators
KSI-IAM-APM
NIST 800-53 controls
recipe · 1 recipeIA-08
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:IA 6/30 →

GovCloud

Amazon Cognito user pools and identity pools are available in both GovCloud (US) Regions, with differences that change what this collection sees and how it is wired: Cognito in GovCloud uses FIPS endpoints only (cognito-idp-fips.us-gov-west-1.amazonaws.com and cognito-idp-fips.us-gov-east-1.amazonaws.com), custom domains for user pools are not available, and Amazon Cognito Sync is absent. Identity-pool role trust policies must grant AssumeRoleWithWebIdentity to the cognito-identity-us-gov.amazonaws.com service principal in GovCloud (US-West) and to cognito-identity.us-gov-east-1.amazonaws.com in GovCloud (US-East) — a trust policy copied from a commercial account names the wrong principal and the pool silently issues nothing. In GovCloud (US-East), role name plus role session name longer than 24 characters can stop an identity pool assuming the role at all. Pool and provider ARNs use partition arn:aws-us-gov.

Notes & assertions

Drive both loops from the list calls, not from whatever the describe calls happen to return, so a pool nobody configured is a visible failure rather than an absent row. AllowUnauthenticatedIdentities is the assertion that carries the control: an identity pool with guest access on hands AWS credentials to a caller who never authenticated, which is precisely the population IA-08 exists to exclude. It is the one setting here that can silently undo everything upstream, which is why the cadence is weekly rather than quarterly. MfaConfiguration is asserted against ON rather than merely not-OFF on purpose. OPTIONAL does not require anything — it delegates the decision to the client application, so a pool set to OPTIONAL and an application that never prompts is indistinguishable from OFF in this output. Scope the loop to the pools that actually serve non-organizational users: a pool used only as a directory for an internal service has no external population and asserting ON over it is a finding about the wrong thing. That scoping sentence is why this recipe is partial rather than full, and the reason is worth stating plainly. Both assertions range over lists, and no AWS call reports which directory serves the external population — or whether external users reach the system through Cognito at all rather than through an API Gateway authorizer or an ALB fronting an IdP. On an account with no user pools and no identity pools, both assertions are vacuously true and the control is unevidenced. The second gap is the control's first verb: MfaConfiguration decides how strongly an external identity authenticates, never that it is UNIQUE to one human, and a pool with MFA ON and self-service sign-up admits as many accounts per person as they care to open. Both gaps close with a human naming the external population and the registration path, which is the definition of partial. What this does not reach is the external identity provider's own registration and proofing — whether the SAML or OIDC provider behind SamlProviderARNs vetted the human before issuing them a subject. That is IA-08(1), (2) and (4) territory and is evidenced by the provider's assurance-level attestation, not by any AWS call.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Identity and Access Management run (16)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under IAM, in the order the plan works them. The mark says how much of the evidence the command produces on its own.