aws-cognito-admin-create-user

explicit aws emits CanCreateCredentialFor

match (effective permission)

{ "action": "cognito-idp:AdminCreateUser", "resource_type": "AWS::Cognito::UserPool" }

emit

source typeIdentity
target typeHumanIdentity
source<principal with effective cognito-idp:AdminCreateUser>
target<newly created User Pool user (HumanIdentity)>
permissionscognito-idp:AdminCreateUser
state logicACTIVE when the principal holds effective cognito-idp:AdminCreateUser on the User Pool ARN and can set an initial password for the created user.

Narrative

{principal.name} can call cognito-idp:AdminCreateUser on User Pool {pool.name} to create a new user with a known temporary password; if the pool feeds an Identity Pool, the new user can immediately acquire authenticated-role IAM credentials.

Raw rule rules/explicit/aws-cognito.yaml

id: aws-cognito-admin-create-user
emits: CanCreateCredentialFor
applies_to:
- aws
match_effective_permission:
  action: cognito-idp:AdminCreateUser
  resource_type: AWS::Cognito::UserPool
emit:
  source_type: Identity
  target_type: HumanIdentity
  source: <principal with effective cognito-idp:AdminCreateUser>
  target: <newly created User Pool user (HumanIdentity)>
  permissions:
  - cognito-idp:AdminCreateUser
  state_logic: ACTIVE when the principal holds effective cognito-idp:AdminCreateUser on the User Pool
    ARN and can set an initial password for the created user.
  confidence: 0.95
  derived_from:
  - cognito-idp:AdminCreateUser (AWS Service Authorization Reference)
  false_positive_note: The target is the newly-created User Pool user (HumanIdentity), not the pool itself.
    AdminCreateUser's Groups parameter allows setting initial group membership at creation time, which
    feeds into group-to-role escalation if the group is mapped by an Identity Pool role rule.
  narrative: '{principal.name} can call cognito-idp:AdminCreateUser on User Pool {pool.name} to create
    a new user with a known temporary password; if the pool feeds an Identity Pool, the new user can immediately
    acquire authenticated-role IAM credentials.'
move · open · esc close