AWS cognito high security documentation change
Summary
Added critical security warning about preventing privilege escalation when mapping user attributes to IAM principal tags.
Security assessment
Explicitly addresses privilege escalation risk where users could modify attributes used in security policies. Provides concrete mitigation steps (removing write permissions or using immutable attributes) and references Lambda validation. Directly prevents security boundary violations.
Diff
diff --git a/cognito/latest/developerguide/attributes-for-access-control.md b/cognito/latest/developerguide/attributes-for-access-control.md index c9455b861..8d12cb592 100644 --- a//cognito/latest/developerguide/attributes-for-access-control.md +++ b//cognito/latest/developerguide/attributes-for-access-control.md @@ -63,0 +64,13 @@ You must prepare IAM roles whose credentials you want to pass to your users. The +###### Important + +If you map custom attributes from a Amazon Cognito user pool to principal tags, ensure that end users cannot modify those attributes. An attribute that a user can change through `UpdateUserAttributes` should not serve as a security boundary in your IAM policies. To prevent user modification, do one of the following: + + * Remove the attribute from your app client's [WriteAttributes](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_CreateUserPoolClient.html#CognitoUserPools-CreateUserPoolClient-request-WriteAttributes). + + * Define the attribute as `Mutable: false` when you add it to your user pool schema. + + + + +If your application requires the attribute to remain user-writable for other purposes, use a [pre token generation Lambda trigger](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html) to validate or override the claim before it is included in the ID token. +