aws-cognito-update-user-pool-lambda-trigger
match (effective permission)
{
"action": "cognito-idp:UpdateUserPool",
"resource_type": "AWS::Cognito::UserPool"
}
emit
| source type | Identity |
|---|---|
| target type | Compute |
| source | <principal with effective cognito-idp:UpdateUserPool> |
| target | <Lambda function targeted by LambdaConfig trigger> |
| permissions | cognito-idp:UpdateUserPool |
| state logic | ACTIVE when the principal holds effective cognito-idp:UpdateUserPool on the User Pool ARN and can direct the pool to invoke an attacker-controlled Lambda (via LambdaConfig.PreSignUp or other trigger hooks). |
Narrative
{principal.name} can call cognito-idp:UpdateUserPool on User Pool {pool.name} to set or modify LambdaConfig trigger hooks, directing authentication events to an attacker-controlled Lambda function that executes with the pool's configured role.
Raw rule rules/explicit/aws-cognito.yaml
id: aws-cognito-update-user-pool-lambda-trigger
emits: CanModifyConfiguration
applies_to:
- aws
match_effective_permission:
action: cognito-idp:UpdateUserPool
resource_type: AWS::Cognito::UserPool
match_condition: can set LambdaConfig trigger to an attacker-controlled Lambda ARN
emit:
source_type: Identity
target_type: Compute
source: <principal with effective cognito-idp:UpdateUserPool>
target: <Lambda function targeted by LambdaConfig trigger>
permissions:
- cognito-idp:UpdateUserPool
state_logic: ACTIVE when the principal holds effective cognito-idp:UpdateUserPool on the User Pool ARN
and can direct the pool to invoke an attacker-controlled Lambda (via LambdaConfig.PreSignUp or other
trigger hooks).
confidence: 0.85
derived_from:
- cognito-idp:UpdateUserPool (AWS Service Authorization Reference)
- AWS Cognito User Pools Developer Guide (LambdaConfig trigger setup)
false_positive_note: UpdateUserPool enables setting arbitrary Lambda function ARNs in LambdaConfig trigger
hooks (PreSignUp, PreAuthentication, etc.). Confirm the attacker can either control the Lambda function
or has sufficient permissions to modify it (CanModifyCode). This edge feeds downstream Lambda execution-as
chains.
narrative: '{principal.name} can call cognito-idp:UpdateUserPool on User Pool {pool.name} to set or
modify LambdaConfig trigger hooks, directing authentication events to an attacker-controlled Lambda
function that executes with the pool''s configured role.'