aws-cognito-admin-set-user-password
match (effective permission)
{
"action": "cognito-idp:AdminSetUserPassword",
"resource_type": "AWS::Cognito::UserPool"
}
emit
| source type | Identity |
|---|---|
| target type | HumanIdentity |
| source | <principal with effective cognito-idp:AdminSetUserPassword> |
| target | <User Pool users (HumanIdentity) in the scoped User Pool ARN> |
| permissions | cognito-idp:AdminSetUserPassword |
| state logic | ACTIVE when the principal holds effective cognito-idp:AdminSetUserPassword on the User Pool ARN and no SCP/permission boundary blocks the action. |
Narrative
{principal.name} can call cognito-idp:AdminSetUserPassword on User Pool {pool.name} to set an arbitrary password for any pool user without knowing the current credentials or MFA secret.
Raw rule rules/explicit/aws-cognito.yaml
id: aws-cognito-admin-set-user-password
emits: CanResetCredential
applies_to:
- aws
match_effective_permission:
action: cognito-idp:AdminSetUserPassword
resource_type: AWS::Cognito::UserPool
emit:
source_type: Identity
target_type: HumanIdentity
source: <principal with effective cognito-idp:AdminSetUserPassword>
target: <User Pool users (HumanIdentity) in the scoped User Pool ARN>
permissions:
- cognito-idp:AdminSetUserPassword
state_logic: ACTIVE when the principal holds effective cognito-idp:AdminSetUserPassword on the User
Pool ARN and no SCP/permission boundary blocks the action.
confidence: 0.95
derived_from:
- cognito-idp:AdminSetUserPassword (AWS Service Authorization Reference)
false_positive_note: Confirm the permission is scoped to the specific User Pool ARN, not a different
pool. MFA device reset is a separate action (AdminSetUserMFAPreference); this rule covers password-only
takeover. If the pool enforces AdminUserPasswordConstraints requiring admin confirmation, the target
user will receive a temporary password; downgrade to CONDITIONAL(service_state) to represent that
step.
narrative: '{principal.name} can call cognito-idp:AdminSetUserPassword on User Pool {pool.name} to set
an arbitrary password for any pool user without knowing the current credentials or MFA secret.'