aws-cognito-admin-update-user-attributes
match (effective permission)
{
"action": "cognito-idp:AdminUpdateUserAttributes",
"resource_type": "AWS::Cognito::UserPool"
}
emit
| source type | Identity |
|---|---|
| target type | ApplicationIdentity |
| source | <principal with effective cognito-idp:AdminUpdateUserAttributes> |
| target | <User Pool (ApplicationIdentity) in the scoped ARN> |
| permissions | cognito-idp:AdminUpdateUserAttributes |
| state logic | ACTIVE when the principal holds effective cognito-idp:AdminUpdateUserAttributes on the User Pool ARN and can modify user profile attributes (claims). |
Narrative
{principal.name} can call cognito-idp:AdminUpdateUserAttributes on User Pool {pool.name} to modify any user's profile attributes (e.g., custom claims) without user consent; if those attributes drive Identity Pool role mapping via claim-based rules, this enables the admin to escalate the target user to elevated IAM role privileges on their next authentication (see aws-cognito-role-mapping-claim-override).
Raw rule rules/explicit/aws-cognito.yaml
id: aws-cognito-admin-update-user-attributes
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
action: cognito-idp:AdminUpdateUserAttributes
resource_type: AWS::Cognito::UserPool
emit:
source_type: Identity
target_type: ApplicationIdentity
source: <principal with effective cognito-idp:AdminUpdateUserAttributes>
target: <User Pool (ApplicationIdentity) in the scoped ARN>
permissions:
- cognito-idp:AdminUpdateUserAttributes
state_logic: ACTIVE when the principal holds effective cognito-idp:AdminUpdateUserAttributes on the
User Pool ARN and can modify user profile attributes (claims).
confidence: 0.8
derived_from:
- cognito-idp:AdminUpdateUserAttributes (AWS Service Authorization Reference)
condition_note: The security impact is realized only when modified attributes drive an Identity Pool
role-mapping rule (claim-to-role). If no claim-based role mapping is configured, this edge represents
configuration mutation but not direct privilege escalation. See aws-cognito-role-mapping-claim-override
for the downstream escalation path.
false_positive_note: This edge represents modification of user profile attributes (custom claims), not
IAM permission grants. The escalation impact is CONDITIONAL on identity-pool claim-based role mapping
being active. If the pool does not use RulesMappings or claim-based role selection, the attacker cannot
escalate privileges via this path alone.
narrative: '{principal.name} can call cognito-idp:AdminUpdateUserAttributes on User Pool {pool.name}
to modify any user''s profile attributes (e.g., custom claims) without user consent; if those attributes
drive Identity Pool role mapping via claim-based rules, this enables the admin to escalate the target
user to elevated IAM role privileges on their next authentication (see aws-cognito-role-mapping-claim-override).'