aws-cognito-authenticated-role-federate

A Cognito-authenticated federated identity presents a valid pool token to receive temporary IAM credentials for the authenticated role. When the role trust condition is broad (authenticated but any provider), any authenticated pool user - regardless of the provider used - receives the role.

derived aws emits CanFederateAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'federated': None} ExternalIdentityMapsTo {'auth_role': None} {'auth_role': None} TrustsExternalIdentity {'federated': None}

where

node_type(?federated) in [FederatedIdentity, ExternalIdentity] node_type(?auth_role) == Role ?auth_role trust policy Federated == cognito-identity.amazonaws.com trust condition includes cognito-identity:aud == ?pool.id trust condition cognito-identity:amr is absent OR is only 'authenticated' (no specific provider pin)

emit

source type	`FederatedIdentity`
target type	`Role`
source	`?federated`
target	`?auth_role`
permissions	`cognito-identity:GetId` `cognito-identity:GetCredentialsForIdentity`
conditions	`trust_condition`
state logic	ACTIVE when cognito-identity:amr is absent or only 'authenticated' (no specific provider sub-condition): any valid authentication for the pool (any linked IdP, social login, User Pool) earns the role. CONDITIONAL(trust_condition) when amr is pinned to a specific provider (e.g. 'accounts.google.com' or the User Pool issuer URL) that the attacker does not control — realizable only if the attacker can authenticate via that specific provider. BLOCKED if an SCP denies cognito-identity:GetCredentialsForIdentity.

Narrative

Federated identity {federated.name} holds a valid authentication token for Identity Pool {pool.name}; because the authenticated role {auth_role.name} trusts cognito-identity.amazonaws.com with condition {trust_condition_summary}, it can call GetCredentialsForIdentity to receive temporary IAM credentials for {auth_role.name}.

Raw rule rules/derived/aws/cognito.yaml

id: aws-cognito-authenticated-role-federate
emits: CanFederateAs
description: "A Cognito-authenticated federated identity presents a valid pool token to receive temporary\
  \ IAM credentials for the authenticated role. When the role trust condition is broad (authenticated\
  \ but any provider), any authenticated pool user \u2014 regardless of the provider used \u2014 receives\
  \ the role."
applies_to:
- aws
match:
- - federated: null
  - ExternalIdentityMapsTo
  - auth_role: null
- - auth_role: null
  - TrustsExternalIdentity
  - federated: null
where:
- node_type(?federated) in [FederatedIdentity, ExternalIdentity]
- node_type(?auth_role) == Role
- ?auth_role trust policy Federated == cognito-identity.amazonaws.com
- trust condition includes cognito-identity:aud == ?pool.id
- trust condition cognito-identity:amr is absent OR is only 'authenticated' (no specific provider pin)
emit:
  source_type: FederatedIdentity
  target_type: Role
  source: ?federated
  target: ?auth_role
  permissions:
  - cognito-identity:GetId
  - cognito-identity:GetCredentialsForIdentity
  conditions:
  - trust_condition
  state_logic: "ACTIVE when cognito-identity:amr is absent or only 'authenticated' (no specific provider\
    \ sub-condition): any valid authentication for the pool (any linked IdP, social login, User Pool)\
    \ earns the role. CONDITIONAL(trust_condition) when amr is pinned to a specific provider (e.g. 'accounts.google.com'\
    \ or the User Pool issuer URL) that the attacker does not control \u2014 realizable only if the attacker\
    \ can authenticate via that specific provider. BLOCKED if an SCP denies cognito-identity:GetCredentialsForIdentity."
  confidence: 0.9
  derived_from:
  - ?federated ExternalIdentityMapsTo ?auth_role
  - '?auth_role TrustsExternalIdentity ?federated (trust condition breadth: broad/unpinned amr)'
  - federation-chains.yaml federation-maps-to-identity (provider-agnostic collapse CITED)
  false_positive_note: "Evaluate the trust condition breadth carefully. ACTIVE requires the amr condition\
    \ to be absent or only 'authenticated' (not provider-specific). If amr is pinned to a specific sub-provider\
    \ (e.g. 'accounts.google.com', or a specific User Pool issuer URL like 'cognito-idp.us-east-1.amazonaws.com/<pool-id>'),\
    \ emit CONDITIONAL(trust_condition) \u2014 the attacker must obtain a valid token from that specific\
    \ provider to realize the path. Honor the aud condition: a role that specifies cognito-identity:aud\
    \ == <poolId> is correctly scoped to that pool. A role that omits the aud condition can be driven\
    \ by ANY pool in the account that has the service principal in its trust \u2014 widen the ExternalIdentityMapsTo\
    \ source accordingly. Do not emit for a well-pinned trust (specific provider + specific pool + MFA\
    \ required) as it is a legitimate, well-configured federation."
  narrative: Federated identity {federated.name} holds a valid authentication token for Identity Pool
    {pool.name}; because the authenticated role {auth_role.name} trusts cognito-identity.amazonaws.com
    with condition {trust_condition_summary}, it can call GetCredentialsForIdentity to receive temporary
    IAM credentials for {auth_role.name}.