aws-cognito-unauth-pool-federate

An Identity Pool with AllowUnauthenticatedIdentities=true lets any internet user call GetId + GetCredentialsForIdentity (no credentials required) to receive temporary IAM credentials for the unauthenticated role.

derived aws emits CanFederateAs

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'unauth_fed': None} ExternalIdentityMapsTo {'unauth_role': None}

where

node_type(?unauth_fed) in [FederatedIdentity, AnonymousIdentity] node_type(?unauth_role) == Role ?unauth_fed represents unauthenticated access to the source Identity Pool ?unauth_fed.source_pool.AllowUnauthenticatedIdentities == true ?unauth_role is the unauthenticated role of ?unauth_fed.source_pool (GetIdentityPoolRoles.Roles.unauthenticated) ?pool = ?unauth_fed.source_pool

emit

source type	`AnonymousIdentity`
target type	`Role`
source	`?unauth_fed`
target	`?unauth_role`
permissions	`cognito-identity:GetId` `cognito-identity:GetCredentialsForIdentity`
state logic	ACTIVE — AllowUnauthenticatedIdentities=true unconditionally admits any unauthenticated caller. No trust condition gates the GetId call; the only requirement is knowing the Identity Pool ID (publicly discoverable via the pool ARN in app bundles or CloudTrail). No MFA, no IAM auth on the caller. BLOCKED if an SCP denies cognito-identity:GetCredentialsForIdentity account-wide (uncommon but possible).

Narrative

Identity Pool {pool.name} (AllowUnauthenticatedIdentities=true) accepts unauthenticated callers: any internet user can call cognito-identity:GetId and cognito-identity:GetCredentialsForIdentity (no credentials required) to receive temporary IAM credentials for unauthenticated role {unauth_role.name}.

Raw rule rules/derived/aws/cognito.yaml

id: aws-cognito-unauth-pool-federate
emits: CanFederateAs
description: An Identity Pool with AllowUnauthenticatedIdentities=true lets any internet user call GetId
  + GetCredentialsForIdentity (no credentials required) to receive temporary IAM credentials for the unauthenticated
  role.
applies_to:
- aws
match:
- - unauth_fed: null
  - ExternalIdentityMapsTo
  - unauth_role: null
where:
- node_type(?unauth_fed) in [FederatedIdentity, AnonymousIdentity]
- node_type(?unauth_role) == Role
- ?unauth_fed represents unauthenticated access to the source Identity Pool
- ?unauth_fed.source_pool.AllowUnauthenticatedIdentities == true
- ?unauth_role is the unauthenticated role of ?unauth_fed.source_pool (GetIdentityPoolRoles.Roles.unauthenticated)
- ?pool = ?unauth_fed.source_pool
emit:
  source_type: AnonymousIdentity
  target_type: Role
  source: ?unauth_fed
  target: ?unauth_role
  permissions:
  - cognito-identity:GetId
  - cognito-identity:GetCredentialsForIdentity
  conditions: []
  state_logic: "ACTIVE \u2014 AllowUnauthenticatedIdentities=true unconditionally admits any unauthenticated\
    \ caller. No trust condition gates the GetId call; the only requirement is knowing the Identity Pool\
    \ ID (publicly discoverable via the pool ARN in app bundles or CloudTrail). No MFA, no IAM auth on\
    \ the caller. BLOCKED if an SCP denies cognito-identity:GetCredentialsForIdentity account-wide (uncommon\
    \ but possible)."
  confidence: 0.95
  derived_from:
  - ?unauth_fed ExternalIdentityMapsTo ?unauth_role
  - ?pool.AllowUnauthenticatedIdentities == true (cognito-identity:DescribeIdentityPool)
  - cognito-identity:GetIdentityPoolRoles.Roles.unauthenticated == ?unauth_role
  false_positive_note: "Confirm AllowUnauthenticatedIdentities=true via cognito-identity:DescribeIdentityPool\
    \ (field AllowUnauthenticatedIdentities). Confirm the unauthenticated role ARN via cognito-identity:GetIdentityPoolRoles\
    \ (field Roles.unauthenticated). Do not emit if the field is false or missing \u2014 GetCredentialsForIdentity\
    \ with no token returns NotAuthorizedException in that case. Do not conflate with the authenticated\
    \ role. If an SCP blocks cognito-identity:GetCredentialsForIdentity, emit state BLOCKED."
  narrative: 'Identity Pool {pool.name} (AllowUnauthenticatedIdentities=true) accepts unauthenticated
    callers: any internet user can call cognito-identity:GetId and cognito-identity:GetCredentialsForIdentity
    (no credentials required) to receive temporary IAM credentials for unauthenticated role {unauth_role.name}.'