aws-cognito-update-identity-provider
match (effective permission)
{
"action": "cognito-idp:UpdateIdentityProvider",
"resource_type": "AWS::Cognito::UserPool"
}
emit
| source type | Identity |
|---|---|
| target type | TrustPolicy |
| source | <principal with effective cognito-idp:UpdateIdentityProvider> |
| target | <TrustPolicy node representing the User Pool's IdP configuration> |
| permissions | cognito-idp:UpdateIdentityProvider |
| state logic | ACTIVE when the principal holds effective cognito-idp:UpdateIdentityProvider on the User Pool ARN and an EXISTING SAML or OIDC IdP is linked to the pool. CONDITIONAL(service_state) when no SAML/OIDC IdP is yet linked (UpdateIdentityProvider requires an existing IdP to modify; only CreateIdentityProvider creates new ones). |
Narrative
{principal.name} can call cognito-idp:UpdateIdentityProvider on User Pool {pool.name} to replace an existing linked identity provider with an attacker-controlled SAML or OIDC endpoint.
Raw rule rules/explicit/aws-cognito.yaml
id: aws-cognito-update-identity-provider
emits: CanModifyTrust
applies_to:
- aws
match_effective_permission:
action: cognito-idp:UpdateIdentityProvider
resource_type: AWS::Cognito::UserPool
emit:
source_type: Identity
target_type: TrustPolicy
source: <principal with effective cognito-idp:UpdateIdentityProvider>
target: <TrustPolicy node representing the User Pool's IdP configuration>
permissions:
- cognito-idp:UpdateIdentityProvider
state_logic: ACTIVE when the principal holds effective cognito-idp:UpdateIdentityProvider on the User
Pool ARN and an EXISTING SAML or OIDC IdP is linked to the pool. CONDITIONAL(service_state) when no
SAML/OIDC IdP is yet linked (UpdateIdentityProvider requires an existing IdP to modify; only CreateIdentityProvider
creates new ones).
confidence: 0.85
derived_from:
- cognito-idp:UpdateIdentityProvider (AWS Service Authorization Reference)
false_positive_note: UpdateIdentityProvider targets an EXISTING linked IdP; it does not create new IdPs.
If no SAML/OIDC IdP is linked yet, only CreateIdentityProvider is relevant and UpdateIdentityProvider
will fail with InvalidParameterException. The downstream CanFederateAs realization still requires
a valid User Pool JWT exchanged for Identity Pool IAM credentials.
narrative: '{principal.name} can call cognito-idp:UpdateIdentityProvider on User Pool {pool.name} to
replace an existing linked identity provider with an attacker-controlled SAML or OIDC endpoint.'