Advanced security with threat protection
After you create your user pool, you have access to Threat protection in the navigation menu in the Amazon Cognito console. You can turn threat protection features on and customize the actions that are taken in response to different risks. Or you can use audit mode to gather metrics on detected risks without applying any security mitigations. In audit mode, threat protection publishes metrics to Amazon CloudWatch. You can see metrics after Amazon Cognito generates its first event. See Viewing threat protection metrics.
Threat protection, formerly called advanced security features, is a set of monitoring tools for unwanted activity in your user pool, and configuration tools to automatically shut down potentially malicious activity. Threat protection has different configuration options for standard and custom authentication operations. For example, you might want to send a notification to a user with a suspicious custom authentication sign-in, where you have set up additional security factors, but block a user at the same risk level with basic username-password authentication.
Threat protection is available in the Plus feature plan. For more information, see User pool feature plans.
The following user pool options are the components of threat protection.
- Compromised credentials
-
Users reuse passwords for multiple user accounts. The compromised credentials feature of Amazon Cognito compiles data from public leaks of user names and passwords, and compares your users' credentials to lists of leaked credentials. Compromised credentials detection also checks for commonly-guessed passwords. You can check for compromised credentials in username-and-password standard authentication flows in user pools. Amazon Cognito doesn't detect compromised credentials in secure remote password (SRP) or custom authentication.
You can choose the user actions that prompt a check for compromised credentials, and the action that you want Amazon Cognito to take in response. For sign-in, sign-up, and password-change events, Amazon Cognito can Block sign-in, or Allow sign-in. In both cases, Amazon Cognito generates a user activity log where you can find more information about the event.
- Adaptive authentication
-
Amazon Cognito can review location and device information from your users' sign-in requests and apply an automatic response to secure the user accounts in your user pool against suspicious activity. You can monitor user activity and automate responses to detected risk levels in username-password and SRP, and custom authentication.
When you activate threat protection, Amazon Cognito assigns a risk score to user activity. You can assign an automatic response to suspicious activity: you can Require MFA, Block sign-in, or just log the activity details and risk score. You can also automatically send email messages that notify your user of the suspicious activity so that they can reset their password or take other self-guided actions.
- IP address allowlist and denylist
-
With Amazon Cognito threat protection in Full function mode, you can create IP address Always block and Always allow exceptions. A session from an IP address on the Always block exception list isn't assigned a risk level by adaptive authentication, and can't sign in to your user pool.
- Log export
-
Threat protection logs granular details of users' authentication requests to your user pool. These logs feature threat assessments, user information, and session metadata like location and device. You can create external archives of these logs for retention and analysis. Amazon Cognito user pools export threat protection logs to Amazon S3, CloudWatch Logs, and Amazon Data Firehose. For more information, see Viewing and exporting user event history.
Topics
- Considerations and limitations for threat protection
- Turning on threat protection in user pools
- Threat protection enforcement concepts
- Threat protection for standard authentication and custom authentication
- Threat protection prerequisites
- Setting up threat protection
- Working with compromised-credentials detection
- Working with adaptive authentication
- Viewing threat protection metrics
- Collecting data for threat protection in applications
Considerations and limitations for threat protection
Threat protection options differ between authentication flows
Amazon Cognito supports both adaptive authentication and compromised-credentials detection with
the authentication flows USER_PASSWORD_AUTH and
ADMIN_USER_PASSWORD_AUTH. You can enable only adaptive authentication for
USER_SRP_AUTH.
You can't use threat protection with federated sign-in.
Always-block IPs contribute to request quotas
Blocked requests from IP addresses on an Always block exception list in your user pool contribute to the request rate quotas for your user pools.
Threat protection doesn't apply rate limits
Some malicious traffic has the characteristic of a high volume of requests, like distributed denial of service (DDoS) attacks. The risk ratings that Amazon Cognito applies to incoming traffic are per-request and don't take request volume into account. Individual requests in a high-volume event might receive a risk score and an automated response for application-layer reasons that aren't related to their role in a volumetric attack. To implement defenses against volumetric attacks in your user pools, add AWS WAF web ACLs. For more information, see Associating an AWS WAF web ACL with a user pool.
Threat protection doesn't affect M2M requests
Client credentials grants are intended for machine-to-machine (M2M) authorization with no connection to user accounts. Threat protection only monitors user accounts and passwords in your user pool. To implement security features with your M2M activity, consider the capabilities of AWS WAF for monitoring request rates and content. For more information, see Associating an AWS WAF web ACL with a user pool.
Turning on threat protection in user pools
Threat protection is the collective term for the features that monitor user operations for signs of account takeover and automatically respond to secure affected user accounts. You can apply threat protection settings to users when they sign in with standard and custom authentication flows.
Threat protection generates logs that detail users' sign-in, sign-out, and other activity. You can export these logs to a third-party system. For more information, see Viewing and exporting user event history.
Threat protection enforcement concepts
Threat protection starts out in an audit-only mode where your user pool monitors user activity, assigns risk levels, and generates logs. As a best practice, run in audit-only mode for two weeks or more before you enable full-function mode. Full-function mode includes a set of automatic reactions to detected risky activity and compromised passwords. With audit-only mode, you can monitor the threat assessments that Amazon Cognito is performing. You can also provide feedback that trains the feature on false positives and negatives.
You can configure threat protection enforcement at the user pool level to cover all app clients in the user pool, and at the level of individual app clients. App client threat-protection configurations override the user pool configuration. To configure threat protection for an app client, navigate to the app client settings from the App clients menu of your user pool in the Amazon Cognito console. There, you can Use client-level settings and configure enforcement exclusive to the app client.
Additionally, you can configure threat protection separately for standard and custom authentication types.
Threat protection for standard authentication and custom authentication
The ways that you can configure threat protection depend on the type of authentication you're doing in your user pool and app clients. Each of the following types of authentication can have their own enforcement mode and automated responses.
- Standard authentication
-
Standard authentication is user sign-in, sign-out and password management with username-password flows and in managed login. Amazon Cognito threat protection monitors operations for indicators of risk when they sign in with managed login or use the following API
AuthFlowparameters:- InitiateAuth
-
USER_PASSWORD_AUTH,USER_SRP_AUTH. The compromised credentials feature doesn't have access to passwords inUSER_SRP_AUTHsign-in, and doesn't monitor or act on events with this flow. - AdminInitiateAuth
-
ADMIN_USER_PASSWORD_AUTH,USER_SRP_AUTH. The compromised credentials feature doesn't have access to passwords inUSER_SRP_AUTHsign-in, and doesn't monitor or act on events with this flow.
You can set the Enforcement mode for standard authentication to Audit only or Full function. To disable threat monitoring for standard authentication, set threat protection to No enforcement.
- Custom authentication
-
Custom authentication is user sign-in with custom challenge Lambda triggers. You can't do custom authentication in managed login. Amazon Cognito threat protection monitors operations for indicators of risk when they sign in with the API
AuthFlowparameterCUSTOM_AUTHofInitiateAuthandAdminInitiateAuth.You can set the Enforcement mode for custom authentication to Audit only, Full function, or No enforcement. The No enforcement option disables threat monitoring for custom authentication without affecting other threat protection features.
Threat protection prerequisites
Before you begin, you need the following:
-
A user pool with an app client. For more information, see Getting started with user pools.
-
Set multi-factor authentication (MFA) to Optional in the Amazon Cognito console to use the risk-based adaptive authentication feature. For more information, see Adding MFA to a user pool.
-
If you're using email notifications, go to the Amazon SES console
to configure and verify an email address or domain to use with your email notifications. For more information about Amazon SES, see Verifying Identities in Amazon SES.
Setting up threat protection
Follow these instructions to set up user pool threat protection.
Note
To set up a different threat protection configuration for an app client in the Amazon Cognito user pools console, select the app client from the App clients menu and choose Use client-level settings.
