AWS cognito: Cognito threat protection doc: grammar and wording cleanup
Summary
Editorial-only edits to the Amazon Cognito threat protection page: hyphenation of 'usernames and passwords' and 'commonly guessed', removal of duplicated 'or use or' phrasing, and changing future-tense 'will take/always require' to present tense. No new security guidance, settings, or behavior is introduced.
Security assessment
The changed line is a copyedit of an existing sentence about compromised-credential detection; the security meaning (checking leaked and commonly guessed passwords, and the SRP/custom-auth limitation) is unchanged. All other hunks are similarly grammatical (e.g., 'will always require' -> 'always requires', 'will always be allowed or blocked' -> 'are always allowed or blocked'), so no vulnerability, control, or best practice is added or altered.
Evidence
+Users reuse passwords for multiple user accounts. The compromised credentials feature of Amazon Cognito compiles data from public leaks of usernames and passwords, and compares your users' credentials to lists of leaked credentials. Compromised credentials detection also checks for commonly guessed passwords. You can check for compromised credentials in username-and-password standard authentication flows in user pools. Amazon Cognito doesn't detect compromised credentials in secure remote password (SRP) or custom authentication.
Diff
diff --git a/cognito/latest/developerguide/cognito-user-pool-settings-threat-protection.md b/cognito/latest/developerguide/cognito-user-pool-settings-threat-protection.md index 6adf748..fd600cc 100644 --- a//cognito/latest/developerguide/cognito-user-pool-settings-threat-protection.md +++ b//cognito/latest/developerguide/cognito-user-pool-settings-threat-protection.md @@ -22 +22 @@ The following user pool options are the components of threat protection. -Users reuse passwords for multiple user accounts. The compromised credentials feature of Amazon Cognito compiles data from public leaks of user names and passwords, and compares your users' credentials to lists of leaked credentials. Compromised credentials detection also checks for commonly-guessed passwords. You can check for compromised credentials in username-and-password standard authentication flows in user pools. Amazon Cognito doesn't detect compromised credentials in secure remote password (SRP) or custom authentication. +Users reuse passwords for multiple user accounts. The compromised credentials feature of Amazon Cognito compiles data from public leaks of usernames and passwords, and compares your users' credentials to lists of leaked credentials. Compromised credentials detection also checks for commonly guessed passwords. You can check for compromised credentials in username-and-password standard authentication flows in user pools. Amazon Cognito doesn't detect compromised credentials in secure remote password (SRP) or custom authentication. @@ -225 +225 @@ We recommend that you keep threat protection in audit mode for two weeks before - 1. Select whether you will take **Custom** action or use or **Cognito defaults** to respond to suspected **Compromised credentials**. **Cognito defaults** are: + 1. Select whether you will take **Custom** action or use **Cognito defaults** to respond to suspected **Compromised credentials**. **Cognito defaults** are: @@ -231 +231 @@ We recommend that you keep threat protection in audit mode for two weeks before - 2. If you selected **Custom** actions for **Compromised credentials** , choose the user pool actions that Amazon Cognito will use for **Event detection** and the **Compromised credentials responses** that you would like Amazon Cognito to take. You can **Block sign-in** or **Allow sign-in** with suspected compromised credentials. + 2. If you selected **Custom** actions for **Compromised credentials** , choose the user pool actions that Amazon Cognito uses for **Event detection** and the **Compromised credentials responses** that you would like Amazon Cognito to take. You can **Block sign-in** or **Allow sign-in** with suspected compromised credentials. @@ -233 +233 @@ We recommend that you keep threat protection in audit mode for two weeks before - 3. Choose how to respond to malicious sign-in attempts under **Adaptive authentication**. Select whether you will take **Custom** action or use or **Cognito defaults** to respond to suspected malicious activity. When you select**Cognito defaults** , Amazon Cognito blocks sign-in at all risk levels and does not notify the user. + 3. Choose how to respond to malicious sign-in attempts under **Adaptive authentication**. Select whether you will take **Custom** action or use **Cognito defaults** to respond to suspected malicious activity. When you select**Cognito defaults** , Amazon Cognito blocks sign-in at all risk levels and does not notify the user. @@ -235 +235 @@ We recommend that you keep threat protection in audit mode for two weeks before - 4. If you selected **Custom** actions for **Adaptive authentication** , choose the **Automatic risk response** actions that Amazon Cognito will take in response to detected risks based on severity level. When you assign a response to a level of risk, you can't assign a less-restrictive response to a higher level of risk. You can assign the following responses to risk levels: + 4. If you selected **Custom** actions for **Adaptive authentication** , choose the **Automatic risk response** actions that Amazon Cognito takes in response to detected risks based on severity level. When you assign a response to a level of risk, you can't assign a less restrictive response to a higher level of risk. You can assign the following responses to risk levels: @@ -239 +239 @@ We recommend that you keep threat protection in audit mode for two weeks before - 2. **Optional MFA** \- If the user has MFA configured, Amazon Cognito will always require the user to provide an additional SMS or time-based one-time password (TOTP) factor when they sign in. If the user does not have MFA configured, they can continue signing in normally. + 2. **Optional MFA** \- If the user has MFA configured, Amazon Cognito always requires the user to provide an additional SMS or time-based one-time password (TOTP) factor when they sign in. If the user does not have MFA configured, they can continue signing in normally. @@ -241 +241 @@ We recommend that you keep threat protection in audit mode for two weeks before - 3. **Require MFA** \- If the user has MFA configured, Amazon Cognito will always require the user to provide an additional SMS or TOTP factor when they sign in. If the user does not have MFA configured, Amazon Cognito will prompt them to set up MFA. Before you automatically require MFA for your users, configure a mechanism in your app to capture phone numbers for SMS MFA, or to register authenticator apps for TOTP MFA. + 3. **Require MFA** \- If the user has MFA configured, Amazon Cognito always requires the user to provide an additional SMS or TOTP factor when they sign in. If the user does not have MFA configured, Amazon Cognito prompts them to set up MFA. Before you automatically require MFA for your users, configure a mechanism in your app to capture phone numbers for SMS MFA, or to register authenticator apps for TOTP MFA. @@ -255 +255 @@ We recommend that you keep threat protection in audit mode for two weeks before - 10. Expand **IP address exceptions** to create an **Always-allow** or an **Always-block** list of IPv4 or IPv6 address ranges that will always be allowed or blocked, regardless of the threat protection risk assessment. Specify the IP address ranges in [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation) (such as 192.168.100.0/24). + 10. Expand **IP address exceptions** to create an **Always-allow** or an **Always-block** list of IPv4 or IPv6 address ranges that are always allowed or blocked, regardless of the threat protection risk assessment. Specify the IP address ranges in [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation) (such as 192.168.100.0/24).