aws-cognito-admin-create-user
match (effective permission)
{
"action": "cognito-idp:AdminCreateUser",
"resource_type": "AWS::Cognito::UserPool"
}
emit
| source type | Identity |
|---|---|
| target type | HumanIdentity |
| source | <principal with effective cognito-idp:AdminCreateUser> |
| target | <newly created User Pool user (HumanIdentity)> |
| permissions | cognito-idp:AdminCreateUser |
| state logic | ACTIVE when the principal holds effective cognito-idp:AdminCreateUser on the User Pool ARN and can set an initial password for the created user. |
Narrative
{principal.name} can call cognito-idp:AdminCreateUser on User Pool {pool.name} to create a new user with a known temporary password; if the pool feeds an Identity Pool, the new user can immediately acquire authenticated-role IAM credentials.
Raw rule rules/explicit/aws-cognito.yaml
id: aws-cognito-admin-create-user
emits: CanCreateCredentialFor
applies_to:
- aws
match_effective_permission:
action: cognito-idp:AdminCreateUser
resource_type: AWS::Cognito::UserPool
emit:
source_type: Identity
target_type: HumanIdentity
source: <principal with effective cognito-idp:AdminCreateUser>
target: <newly created User Pool user (HumanIdentity)>
permissions:
- cognito-idp:AdminCreateUser
state_logic: ACTIVE when the principal holds effective cognito-idp:AdminCreateUser on the User Pool
ARN and can set an initial password for the created user.
confidence: 0.95
derived_from:
- cognito-idp:AdminCreateUser (AWS Service Authorization Reference)
false_positive_note: The target is the newly-created User Pool user (HumanIdentity), not the pool itself.
AdminCreateUser's Groups parameter allows setting initial group membership at creation time, which
feeds into group-to-role escalation if the group is mapped by an Identity Pool role rule.
narrative: '{principal.name} can call cognito-idp:AdminCreateUser on User Pool {pool.name} to create
a new user with a known temporary password; if the pool feeds an Identity Pool, the new user can immediately
acquire authenticated-role IAM credentials.'