aws-cognito-identity-pool-unauth-role-mapping

id: aws-cognito-identity-pool-unauth-role-mapping
emits: ExternalIdentityMapsTo
applies_to:
- aws
match_record:
  resource_type: AWS::Cognito::IdentityPool
  api_source: cognito-identity:GetIdentityPoolRoles
  field: Roles.unauthenticated
match_condition: AllowUnauthenticatedIdentities == true on the same pool
emit:
  source_type: FederatedIdentity
  target_type: Role
  source: <FederatedIdentity node representing unauthenticated callers (AnonymousIdentity at runtime)>
  target: <IAM Role from Roles.unauthenticated ARN>
  permissions:
  - cognito-identity:GetId
  - cognito-identity:GetCredentialsForIdentity
  evidence_field: Roles.unauthenticated
  state_logic: "ACTIVE \u2014 this edge represents a collected role-mapping fact (inventory) when AllowUnauthenticatedIdentities=true\
    \ on the pool."
  confidence: 0.99
  derived_from:
  - cognito-identity:GetIdentityPoolRoles, cognito-identity:DescribeIdentityPool (AWS Service Authorization
    Reference)
  condition_note: Only emit when AllowUnauthenticatedIdentities=true on the same Identity Pool (confirmed
    via DescribeIdentityPool). Records trust condition as BROAD (no token required). The source is modeled
    as a FederatedIdentity (unauthenticated external caller) mapping to the unauthenticated role; at collection
    time this will be an AnonymousIdentity node.
  false_positive_note: "Only emit when AllowUnauthenticatedIdentities=true. If the field is false or missing,\
    \ do not emit this edge \u2014 GetCredentialsForIdentity with no token returns NotAuthorizedException.\
    \ Do not conflate with the authenticated role (Roles.authenticated). Confirm the field via DescribeIdentityPool\
    \ before emitting."
  narrative: Any unauthenticated internet user maps to IAM role {role.name} via Identity Pool {pool.name}
    (GetIdentityPoolRoles.Roles.unauthenticated); AllowUnauthenticatedIdentities=true.