aws-cognito-create-identity-provider

id: aws-cognito-create-identity-provider
emits: CanModifyTrust
applies_to:
- aws
match_effective_permission:
  action: cognito-idp:CreateIdentityProvider
  resource_type: AWS::Cognito::UserPool
emit:
  source_type: Identity
  target_type: TrustPolicy
  source: <principal with effective cognito-idp:CreateIdentityProvider>
  target: <TrustPolicy node representing the User Pool's IdP configuration>
  permissions:
  - cognito-idp:CreateIdentityProvider
  state_logic: ACTIVE when the principal holds effective cognito-idp:CreateIdentityProvider on the User
    Pool ARN and no SCP blocks the action. The attacker can immediately register a SAML or OIDC IdP.
  confidence: 0.85
  derived_from:
  - cognito-idp:CreateIdentityProvider (AWS Service Authorization Reference)
  false_positive_note: "CreateIdentityProvider requires that at least one app client has the IdP enabled\
    \ in SupportedIdentityProviders for the IdP to be usable by end users. If no app client includes the\
    \ new IdP, end users cannot select it for sign-in \u2014 verify that at least one app client has SupportedIdentityProviders\
    \ configured to include the new IdP (or that cognito-idp:UpdateUserPoolClient permission allows the\
    \ attacker to add it). If both CreateIdentityProvider and UpdateUserPoolClient permissions are needed,\
    \ downgrade to CONDITIONAL(permission). This edge represents modification of the authentication trust\
    \ (User Pool IdP linkage), not direct IAM credential access. Downstream CanFederateAs edges on an\
    \ Identity Pool linked to the User Pool are the escalation path: even with a valid User Pool JWT from\
    \ the attacker's SAML IdP, a second step (GetCredentialsForIdentity on the Identity Pool) is required\
    \ to obtain IAM credentials."
  narrative: '{principal.name} can call cognito-idp:CreateIdentityProvider on User Pool {pool.name} to
    register an attacker-controlled SAML or OIDC identity provider, enabling sign-in as any pool user
    via forged assertions.'