aws-cognito-user-pool-group-membership
match (record)
{
"api_source": "cognito-idp:ListUsersInGroup",
"field": "Users[*].Username + GroupName",
"resource_type": "AWS::Cognito::UserPool"
}
emit
| source type | Identity |
|---|---|
| target type | Group |
| source | <User Pool User (HumanIdentity or FederatedIdentity) node> |
| target | <User Pool Group (Group) node> |
| state logic | ACTIVE — this edge represents a collected membership fact (inventory). |
Narrative
User Pool user {user.name} is a member of group {group.name} in pool {pool.name}; this membership affects their cognito:groups claim and may drive privileged role assignment via Identity Pool claim-based role rules.
Raw rule rules/explicit/aws-cognito.yaml
id: aws-cognito-user-pool-group-membership
emits: MemberOf
applies_to:
- aws
match_record:
resource_type: AWS::Cognito::UserPool
api_source: cognito-idp:ListUsersInGroup
field: Users[*].Username + GroupName
emit:
source_type: Identity
target_type: Group
source: <User Pool User (HumanIdentity or FederatedIdentity) node>
target: <User Pool Group (Group) node>
permissions: []
evidence_field: ListUsersInGroup.Users[*].Username
state_logic: "ACTIVE \u2014 this edge represents a collected membership fact (inventory)."
confidence: 0.99
derived_from:
- cognito-idp:ListUsersInGroup (AWS Service Authorization Reference)
false_positive_note: This edge is a structural fact (membership), not an attack capability by itself.
It drives downstream escalation paths only when the group is mapped to a privileged Identity Pool
role via claim-based role selection (see aws-cognito-role-mapping-claim-override). Confirm the group
is actually used in an Identity Pool role rule before scoring escalation.
narrative: User Pool user {user.name} is a member of group {group.name} in pool {pool.name}; this membership
affects their cognito:groups claim and may drive privileged role assignment via Identity Pool claim-based
role rules.