AWS cognito medium security documentation change
Summary
Restructured rate limit documentation and added email MFA message rate limits
Security assessment
The added email MFA rate limit (5-20 messages/hour per IP) directly addresses security by preventing MFA code flooding attacks.
Diff
diff --git a/cognito/latest/developerguide/quotas.md b/cognito/latest/developerguide/quotas.md index 08c3ff96d..ffd3cc5a9 100644 --- a//cognito/latest/developerguide/quotas.md +++ b//cognito/latest/developerguide/quotas.md @@ -408,4 +408,3 @@ Operation | Description | Default quota (RPS) | Adjustable -Requests from source IP | Volume of requests from one IP address to one domain | 300 | No -Requests to app client | Volume of requests for one app client ID in one domain | 300 | No -Requests to domain | Overall volume of requests for the services of one user pool domain | 500 | No -Requests for JSON web key documents | Volume of requests for `jwks.json` in one AWS account in one AWS Region | 50,000 | No +Per IP | Volume of requests from one IP address | 300 | No +Per app client | Volume of requests for one app client ID | 300 | No +Per domain | Overall volume of requests for the services of one user pool domain | 500 | No @@ -458,0 +458 @@ Email messages sent daily per AWS account2 | 50 | No | N/A +Email MFA messages sent to one email address hourly per requester IP address | 5-20 | No | N/A