Cognito user pool should have advanced security mode set to ENFORCED

What it checks

Cognito user pool: advanced security mode is not ENFORCED.

Where it applies

Terraform: aws_cognito_user_pool

CloudFormation: AWS::Cognito::UserPool

How to fix it

1. Set user_pool_add_ons { advanced_security_mode = "ENFORCED" }. This enables compromised credential detection, adaptive authentication, and risk-based challenges.
2. Note: Advanced Security adds a per-user charge. Consider starting with AUDIT mode to assess impact before switching to ENFORCED.

Frameworks

• AWS FSBP Cognito.1
• SOC 2 CC6.1
• HIPAA 164.312(d)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules