aws-cognito-user-attributes-data
Standard and custom user attributes are readable plaintext and applications may misuse them to store secrets.
Where it sits
| location | ListUsers.Users[].Attributes[].Value |
|---|---|
| location kind | data_record |
| data kinds | pii sensitive_data credential |
| emits edge | ContainsSecret |
| service | Cognito (aws:cognito) |
Collection recipe
| access mode | read_api |
|---|---|
| operation | ListUsers |
| response path | Users[].Attributes[].Value |
| encoding | string |
| params | {"UserPoolId": "\u003cpool-id\u003e"} |
Required permissions
cognito-idp:ListUsers