aws-cognito-update-user-pool-idp-trust
match (effective permission)
{
"action": "cognito-idp:UpdateUserPool",
"resource_type": "AWS::Cognito::UserPool"
}
emit
| source type | Identity |
|---|---|
| target type | TrustPolicy |
| source | <principal with effective cognito-idp:UpdateUserPool> |
| target | <TrustPolicy node representing the User Pool's linked IdP configuration> |
| permissions | cognito-idp:UpdateUserPool |
| state logic | ACTIVE when the principal holds effective cognito-idp:UpdateUserPool on the User Pool ARN and the pool has linked SAML/OIDC providers configured. CONDITIONAL(service_state) when no SAML/OIDC IdP is linked to the pool. |
Narrative
{principal.name} can call cognito-idp:UpdateUserPool on User Pool {pool.name} to modify or remove linked SAML/OIDC identity providers, rewriting the authentication trust to accept tokens from attacker-controlled IdPs.
Raw rule rules/explicit/aws-cognito.yaml
id: aws-cognito-update-user-pool-idp-trust
emits: CanModifyTrust
applies_to:
- aws
match_effective_permission:
action: cognito-idp:UpdateUserPool
resource_type: AWS::Cognito::UserPool
match_condition: the pool has linked SAML/OIDC identity providers
emit:
source_type: Identity
target_type: TrustPolicy
source: <principal with effective cognito-idp:UpdateUserPool>
target: <TrustPolicy node representing the User Pool's linked IdP configuration>
permissions:
- cognito-idp:UpdateUserPool
state_logic: ACTIVE when the principal holds effective cognito-idp:UpdateUserPool on the User Pool ARN
and the pool has linked SAML/OIDC providers configured. CONDITIONAL(service_state) when no SAML/OIDC
IdP is linked to the pool.
confidence: 0.8
derived_from:
- cognito-idp:UpdateUserPool (AWS Service Authorization Reference)
- AWS Cognito User Pools Administrator Guide (UpdateUserPool enables IdP modification)
false_positive_note: UpdateUserPool can modify or remove linked SAML/OIDC identity providers, equivalent
to CreateIdentityProvider/UpdateIdentityProvider trust-rewrite. Verify the pool has linked SAML/OIDC
providers (via ListIdentityProviders) before emitting. If no IdP is linked, this edge represents general
pool configuration mutation only.
narrative: '{principal.name} can call cognito-idp:UpdateUserPool on User Pool {pool.name} to modify
or remove linked SAML/OIDC identity providers, rewriting the authentication trust to accept tokens
from attacker-controlled IdPs.'