AWS Security Hub · Cognito
Cognito.5: Cognito users can sign in without MFA
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub Cognito.5 check?
Cognito.5 checks whether a user pool configured with a password-only sign-in policy has MFA enabled. Backed by the AWS Config rule cognito-user-pool-mfa-enabled (COGNITO_USER_POOL_MFA_ENABLED), it fails only when MfaConfiguration is OFF; both OPTIONAL and ON count as enabled and pass. The control is not applicable for federated users (Cognito delegates authentication to the IdP) or users signing in with passwordless factors.
Why does Cognito.5 matter?
Credential-stuffing against consumer apps is continuous, automated, and cheap: a leaked password from any unrelated breach gets replayed against every Cognito login endpoint on the internet. With OPTIONAL MFA, the 85-95% of users who never enrol are protected by exactly one factor: a password they probably reused. PCI DSS 4.0 (effective March 2025) requires MFA for all access, not just admin access.
How do I fix Cognito.5?
- Set MfaConfiguration to OPTIONAL or REQUIRED. Either clears the finding, since the control only fails when MFA is OFF. Use SetUserPoolMfaConfig, or the user pool's Sign-in > Multi-factor authentication settings in the console.
- Enable at least one second factor (TOTP authenticator apps, SMS message, or email message) so users have a method to register.
- If you want MFA enforced for every sign-in, choose REQUIRED, and build MFA setup into onboarding so users can register a factor before they are locked out.
Remediation script · bash
# Root MFA has no CLI equivalent: register it in the console while signed in as root
# (Security credentials > Multi-factor authentication > Assign MFA device).
# Then verify a device is bound to the root ARN and the summary flag flips to 1.
aws iam list-virtual-mfa-devices --assignment-status Assigned \
--query 'VirtualMFADevices[?ends_with(SerialNumber, `:mfa/root-account-mfa-device`)].SerialNumber'
aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled'
# Enforce MFA on human IAM users with a conditional-deny policy keyed on the MFA flag.
aws iam attach-group-policy --group-name HumanUsers \
--policy-arn arn:aws:iam::123456789012:policy/RequireMFAForUsers
# Require MFA pool-wide on a customer-facing Cognito pool.
aws cognito-idp set-user-pool-mfa-config --user-pool-id eu-west-1_aB3cD4eFg \
--mfa-configuration ON --software-token-mfa-configuration Enabled=trueFull walkthrough (console steps, edge cases and verification) in the lesson Enable MFA for root and IAM users.
Is Cognito.5 a false positive?
An OPTIONAL setting passes the control even though users who never register a second factor still sign in with a password alone. The finding clears, but you may want REQUIRED for true enforcement. Pools that use only federated or passwordless sign-in are out of scope and do not generate this finding.