Cognito user pool should enable MFA

What it checks

Cognito user pool should enable MFA

Where it applies

Terraform: aws_cognito_user_pool

CloudFormation: AWS::Cognito::UserPool

How to fix it

1. Set mfa_configuration = "ON" (require MFA) or "OPTIONAL" (let users opt in), and configure a factor via software_token_mfa_configuration or sms_configuration. "OFF" — the default when unset — disables MFA entirely.

Frameworks

• SOC 2 CC6.1

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules