rage.fail

aws-cognito-admin-add-user-to-group

explicit aws emits CanAddMember

match (effective permission)

{ "action": "cognito-idp:AdminAddUserToGroup", "resource_type": "AWS::Cognito::UserPool" }

emit

source type	`Identity`
target type	`Group`
source	`<principal with effective cognito-idp:AdminAddUserToGroup>`
target	`<User Pool Groups in the scoped User Pool ARN>`
permissions	`cognito-idp:AdminAddUserToGroup`
state logic	ACTIVE when the principal holds effective cognito-idp:AdminAddUserToGroup on the User Pool ARN and can add any user to any group.

Narrative

{principal.name} can call cognito-idp:AdminAddUserToGroup on User Pool {pool.name} to add any user to any group, potentially elevating their Identity Pool role mapping if the group maps to a privileged authenticated role.

Raw rule rules/explicit/aws-cognito.yaml

id: aws-cognito-admin-add-user-to-group
emits: CanAddMember
applies_to:
- aws
match_effective_permission:
  action: cognito-idp:AdminAddUserToGroup
  resource_type: AWS::Cognito::UserPool
emit:
  source_type: Identity
  target_type: Group
  source: <principal with effective cognito-idp:AdminAddUserToGroup>
  target: <User Pool Groups in the scoped User Pool ARN>
  permissions:
  - cognito-idp:AdminAddUserToGroup
  state_logic: ACTIVE when the principal holds effective cognito-idp:AdminAddUserToGroup on the User Pool
    ARN and can add any user to any group.
  confidence: 0.95
  derived_from:
  - cognito-idp:AdminAddUserToGroup (AWS Service Authorization Reference)
  false_positive_note: Confirm that the group membership update is not restricted by additional conditions
    (e.g., group-level access control). If the group maps to an Identity Pool role via claim-based or
    token-based rule, adding a user to that group enables the user to receive elevated IAM credentials
    on next authentication. The attacker must first control or compromise a User Pool user account before
    this escalation is realized.
  narrative: '{principal.name} can call cognito-idp:AdminAddUserToGroup on User Pool {pool.name} to add
    any user to any group, potentially elevating their Identity Pool role mapping if the group maps to
    a privileged authenticated role.'