AWS cognito medium security documentation change
Summary
Updated instructions for obtaining CSV headers via UI template download and modified MFA requirements for imported users
Security assessment
The change modifies MFA enforcement rules for imported users, allowing blank values that inherit pool settings. This directly impacts security configuration by aligning imported users' MFA status with pool policies, preventing potential misconfigurations where MFA could be improperly disabled for required pools.
Diff
diff --git a/cognito/latest/developerguide/cognito-user-pools-using-import-tool.md b/cognito/latest/developerguide/cognito-user-pools-using-import-tool.md index 10266500f..8ec2ac9a5 100644 --- a//cognito/latest/developerguide/cognito-user-pools-using-import-tool.md +++ b//cognito/latest/developerguide/cognito-user-pools-using-import-tool.md @@ -167 +167,3 @@ Use the following procedure to download the CSV header file. -To get a list of the correct headers, run the following CLI command, where `USER_POOL_ID` is the user pool identifier for the user pool you'll import users into: +To get a list of the correct headers, from the **Users menu** under **Import users** , select **Create import job**. In the dialog that follows, select the `template.csv` link to download a template file with your user pool attributes. + +You can also run the following CLI command, where `USER_POOL_ID` is the user pool identifier for the user pool you'll import users into: @@ -227,2 +228,0 @@ For more information about attribute values, such as proper format for phone num - * **cognito:mfa_enabled** - @@ -257 +257 @@ For users to reset their passwords, they must have a verified email or phone num - * The **cognito:mfa_enabled** field is required. If you've set multi-factor authentication (MFA) to be required in your user pool, this field must be `true` for all users. If you've set MFA to be off, this field must be `false` for all users. If you've set MFA to be optional, this field can be either `true` or `false`, but it can't be empty. + * The **cognito:mfa_enabled** field must correspond to the MFA requirements of your user pool. If you've set multi-factor authentication (MFA) to be required in your user pool, this field must be `true` or blank for all users. If you've set MFA to be off, this field must be `false` or blank for all users. A blank value sets imported users' MFA-enabled status to the state required by the user pool. You can import users in an MFA-required user pool without a valid MFA factor, regardless of whether you set a `cognito:mfa_enabled` value. Users in this state have MFA active but can't sign in until they configure an email attribute, phone number attribute, or a TOTP, and that configuration is a valid MFA factor in your user pool.