# For every Amazon Cognito directory that fronts non-organizational users: the user pool's multi-factor configuration, and every identity pool's guest-access flag together with the named external providers it will exchange a token for

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/cognito-external-user-authentication

Recipe id: `cognito-external-user-authentication` · cadence weekly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-IAM-APM`
- control `ia-8`

## Collection

Kind: `cli`

```sh
# user-pools
aws cognito-idp list-user-pools --max-results 60 --query 'UserPools[].{Id:Id,Name:Name,Status:Status}'
# user-pool-mfa
aws cognito-idp get-user-pool-mfa-config --user-pool-id <USER_POOL_ID>
# identity-pools
aws cognito-identity list-identity-pools --max-results 60 --query 'IdentityPools[].{Id:IdentityPoolId,Name:IdentityPoolName}'
# identity-pool
aws cognito-identity describe-identity-pool --identity-pool-id <IDENTITY_POOL_ID> --query '{Id:IdentityPoolId,AllowUnauthenticatedIdentities:AllowUnauthenticatedIdentities,AllowClassicFlow:AllowClassicFlow,Cognito:CognitoIdentityProviders,Login:SupportedLoginProviders,Saml:SamlProviderARNs,Oidc:OpenIdConnectProviderARNs}'
```

## Expected output

One get-user-pool-mfa-config response per user pool under the projection root user-pool-mfa: MfaConfiguration (OFF | ON | OPTIONAL) plus whichever factor blocks are configured — SoftwareTokenMfaConfiguration.Enabled for TOTP, SmsMfaConfiguration for SMS, EmailMfaConfiguration for email OTP. One describe-identity-pool response per identity pool under the projection root identity-pool: AllowUnauthenticatedIdentities (TRUE if the pool supports unauthenticated logins), AllowClassicFlow, and the four trust fields — CognitoIdentityProviders, SupportedLoginProviders (provider name to app id), SamlProviderARNs and OpenIdConnectProviderARNs.

## Assertions

- {"field":"identity-pool.AllowUnauthenticatedIdentities","op":"eq","value":false,"controls":["ia-8"],"description":"No identity pool supports unauthenticated logins, so every non-organizational principal holding AWS credentials authenticated to get them."}
- {"field":"user-pool-mfa.MfaConfiguration","op":"eq","value":"ON","controls":["ia-8"],"description":"Every user pool the assessor names as serving non-organizational users requires MFA, so an external identity authenticates with a second factor rather than a password alone. This is the authentication limb of IA-08 only — uniqueness is not in this output."}

## GovCloud

Amazon Cognito user pools and identity pools are available in both GovCloud (US) Regions, with differences that change what this collection sees and how it is wired: Cognito in GovCloud uses FIPS endpoints only (cognito-idp-fips.us-gov-west-1.amazonaws.com and cognito-idp-fips.us-gov-east-1.amazonaws.com), custom domains for user pools are not available, and Amazon Cognito Sync is absent. Identity-pool role trust policies must grant AssumeRoleWithWebIdentity to the cognito-identity-us-gov.amazonaws.com service principal in GovCloud (US-West) and to cognito-identity.us-gov-east-1.amazonaws.com in GovCloud (US-East) — a trust policy copied from a commercial account names the wrong principal and the pool silently issues nothing. In GovCloud (US-East), role name plus role session name longer than 24 characters can stop an identity pool assuming the role at all. Pool and provider ARNs use partition arn:aws-us-gov.

## Notes

Drive both loops from the list calls, not from whatever the describe calls happen to return, so a pool nobody configured is a visible failure rather than an absent row.

AllowUnauthenticatedIdentities is the assertion that carries the control: an identity pool with guest access on hands AWS credentials to a caller who never authenticated, which is precisely the population IA-08 exists to exclude. It is the one setting here that can silently undo everything upstream, which is why the cadence is weekly rather than quarterly.

MfaConfiguration is asserted against ON rather than merely not-OFF on purpose. OPTIONAL does not require anything — it delegates the decision to the client application, so a pool set to OPTIONAL and an application that never prompts is indistinguishable from OFF in this output. Scope the loop to the pools that actually serve non-organizational users: a pool used only as a directory for an internal service has no external population and asserting ON over it is a finding about the wrong thing.

That scoping sentence is why this recipe is partial rather than full, and the reason is worth stating plainly. Both assertions range over lists, and no AWS call reports which directory serves the external population — or whether external users reach the system through Cognito at all rather than through an API Gateway authorizer or an ALB fronting an IdP. On an account with no user pools and no identity pools, both assertions are vacuously true and the control is unevidenced. The second gap is the control's first verb: MfaConfiguration decides how strongly an external identity authenticates, never that it is UNIQUE to one human, and a pool with MFA ON and self-service sign-up admits as many accounts per person as they care to open. Both gaps close with a human naming the external population and the registration path, which is the definition of partial.

What this does not reach is the external identity provider's own registration and proofing — whether the SAML or OIDC provider behind SamlProviderARNs vetted the human before issuing them a subject. That is IA-08(1), (2) and (4) territory and is evidenced by the provider's assurance-level attestation, not by any AWS call.

## References

- {"title":"AWS CLI: cognito-idp get-user-pool-mfa-config (MfaConfiguration OFF | ON | OPTIONAL; SoftwareTokenMfaConfiguration, SmsMfaConfiguration, EmailMfaConfiguration)","url":"https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/get-user-pool-mfa-config.html"}
- {"title":"AWS CLI: cognito-idp list-user-pools","url":"https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/list-user-pools.html"}
- {"title":"AWS CLI: cognito-identity describe-identity-pool (AllowUnauthenticatedIdentities — TRUE if the identity pool supports unauthenticated logins; SamlProviderARNs, OpenIdConnectProviderARNs, SupportedLoginProviders)","url":"https://docs.aws.amazon.com/cli/latest/reference/cognito-identity/describe-identity-pool.html"}
- {"title":"AWS CLI: cognito-identity list-identity-pools (IdentityPoolId, IdentityPoolName)","url":"https://docs.aws.amazon.com/cli/latest/reference/cognito-identity/list-identity-pools.html"}
- {"title":"Amazon Cognito in AWS GovCloud (US) — FIPS-only endpoints, no custom user pool domains, cognito-identity-us-gov.amazonaws.com trust principal, US-East role/session name length limit","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-cog.html"}