AWS Cognito

AWS Cognito Skill

Analyze AWS Cognito user and identity pools with parallel execution and anti-hallucination guardrails.

Relationship to other AWS skills:

• aws-cognito/ → Cognito-specific analysis (user pools, identity pools, auth flows)
• aws/ → "How to execute" (parallel patterns, throttling, output format)

CRITICAL: Parallel Execution Requirement

ALL independent operations MUST run in parallel using background jobs (&) and wait.

#!/bin/bash
export AWS_PAGER=""

for pool_id in $pools; do
  describe_user_pool "$pool_id" &
done
wait

Helper Functions

#!/bin/bash
export AWS_PAGER=""

# List user pools
list_user_pools() {
  aws cognito-idp list-user-pools --max-results 60 \
    --output text \
    --query 'UserPools[].[Id,Name,Status,CreationDate,LastModifiedDate]'
}

# Get user pool details
describe_user_pool() {
  local pool_id=$1
  aws cognito-idp describe-user-pool --user-pool-id "$pool_id" \
    --output text \
    --query 'UserPool.[Id,Name,Status,EstimatedNumberOfUsers,MfaConfiguration,Policies.PasswordPolicy.[MinimumLength,RequireUppercase,RequireLowercase,RequireNumbers,RequireSymbols]]'
}

# List app clients for a user pool
list_app_clients() {
  local pool_id=$1
  aws cognito-idp list-user-pool-clients --user-pool-id "$pool_id" \
    --output text \
    --query 'UserPoolClients[].[ClientId,ClientName]'
}

# Get app client details
describe_app_client() {
  local pool_id=$1 client_id=$2
  aws cognito-idp describe-user-pool-client --user-pool-id "$pool_id" --client-id "$client_id" \
    --output text \
    --query 'UserPoolClient.[ClientName,ExplicitAuthFlows,AllowedOAuthFlows,AllowedOAuthScopes,SupportedIdentityProviders]'
}

# List identity pools
list_identity_pools() {
  aws cognito-identity list-identity-pools --max-results 60 \
    --output text \
    --query 'IdentityPools[].[IdentityPoolId,IdentityPoolName]'
}

# Get identity pool details
describe_identity_pool() {
  local pool_id=$1
  aws cognito-identity describe-identity-pool --identity-pool-id "$pool_id" \
    --output text \
    --query '[IdentityPoolId,IdentityPoolName,AllowUnauthenticatedIdentities,CognitoIdentityProviders[0].ProviderName]'
}

Common Operations

1. User Pool Inventory with Security Posture

#!/bin/bash
export AWS_PAGER=""
POOLS=$(aws cognito-idp list-user-pools --max-results 60 --output text --query 'UserPools[].Id')
for pool in $POOLS; do
  aws cognito-idp describe-user-pool --user-pool-id "$pool" \
    --output text \
    --query 'UserPool.[Id,Name,EstimatedNumberOfUsers,MfaConfiguration,Policies.PasswordPolicy.MinimumLength,AccountRecoverySetting.RecoveryMechanisms[0].Name]' &
done
wait

2. MFA Configuration Analysis

#!/bin/bash
export AWS_PAGER=""
POOLS=$(aws cognito-idp list-user-pools --max-results 60 --output text --query 'UserPools[].Id')
for pool in $POOLS; do
  {
    mfa=$(aws cognito-idp describe-user-pool --user-pool-id "$pool" \
      --output text \
      --query 'UserPool.[Name,MfaConfiguration]')
    printf "%s\tMFA:%s\n" "$pool" "$mfa"
  } &
done
wait

3. Auth Flow and App Client Audit

#!/bin/bash
export AWS_PAGER=""
POOL_ID=$1
CLIENTS=$(aws cognito-idp list-user-pool-clients --user-pool-id "$POOL_ID" \
  --output text --query 'UserPoolClients[].ClientId')
for client in $CLIENTS; do
  aws cognito-idp describe-user-pool-client --user-pool-id "$POOL_ID" --client-id "$client" \
    --output text \
    --query 'UserPoolClient.[ClientName,ExplicitAuthFlows[],AllowedOAuthFlows[],TokenValidityUnits.AccessToken]' &
done
wait

4. Lambda Trigger Configuration

#!/bin/bash
export AWS_PAGER=""
POOLS=$(aws cognito-idp list-user-pools --max-results 60 --output text --query 'UserPools[].Id')
for pool in $POOLS; do
  aws cognito-idp describe-user-pool --user-pool-id "$pool" \
    --output text \
    --query 'UserPool.[Name,LambdaConfig.[PreSignUp,PostConfirmation,PreAuthentication,PostAuthentication,CustomMessage,DefineAuthChallenge]]' &
done
wait

5. Identity Pool Federation Analysis

#!/bin/bash
export AWS_PAGER=""
ID_POOLS=$(aws cognito-identity list-identity-pools --max-results 60 --output text --query 'IdentityPools[].IdentityPoolId')
for pool in $ID_POOLS; do
  aws cognito-identity describe-identity-pool --identity-pool-id "$pool" \
    --output text \
    --query '[IdentityPoolName,AllowUnauthenticatedIdentities,CognitoIdentityProviders[].ProviderName,SupportedLoginProviders]' &
done
wait

Anti-Hallucination Rules

1. User Pool vs Identity Pool - User Pools handle authentication (sign-up/sign-in). Identity Pools handle authorization (AWS credentials). They are separate resources.
2. EstimatedNumberOfUsers is approximate - This is an estimate, not an exact count. For precise counts, use list-users with pagination (expensive for large pools).
3. MFA values - Valid MfaConfiguration values: OFF, ON, OPTIONAL. "ON" means required for all users. "OPTIONAL" means per-user choice.
4. Auth flow names - Valid ExplicitAuthFlows: ALLOW_USER_PASSWORD_AUTH, ALLOW_USER_SRP_AUTH, ALLOW_REFRESH_TOKEN_AUTH, ALLOW_CUSTOM_AUTH, ALLOW_ADMIN_USER_PASSWORD_AUTH. Do not invent others.
5. Client secret - Some app clients have secrets, some do not. Public clients (SPAs, mobile) should NOT have secrets.

Output Format

Present results as a structured report:

Aws Cognito Report
══════════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Counter-Rationalizations

Common Pitfalls

• list-users rate limit: list-users has aggressive throttling (5 requests/second). Use sparingly with --limit and --pagination-token.
• Regional service: Cognito is regional. User pools in us-east-1 are not visible in eu-west-1.
• Custom domains: Cognito custom domains require ACM certificates in us-east-1 (same as CloudFront).
• CloudWatch statistics syntax: Use spaces not commas: --statistics Average Maximum.
• Token validity: Default access token validity is 60 minutes. Refresh token validity defaults to 30 days. Check TokenValidityUnits for actual units.