Skip to content
HackIndex logo

HackIndex

ognito User Pool and Identity Pool Enumeration

2 min read May 24, 2026

Cognito manages user authentication (user pools) and AWS credential federation (identity pools). Misconfigurations in identity pools grant temporary AWS credentials — sometimes without any authentication at all.

User Pools

List all user pools:

┌──(kali㉿kali)-[~]
└─$ aws cognito-idp list-user-pools --max-results 60 --profile $PROFILE --region $REGION --query 'UserPools[*].{ID:Id,Name:Name,Created:CreationDate}' --output table
┌──(kali㉿kali)-[~]
└─$ aws cognito-idp describe-user-pool --user-pool-id $USER_POOL_ID --profile $PROFILE --region $REGION

Key fields:

  • MfaConfiguration — OFF, OPTIONAL, or ON

  • Policies.PasswordPolicy — minimum length and complexity requirements

  • UsernameAttributes — whether users log in with email or phone number

  • AliasAttributes — what aliases are allowed

App Clients

App clients define how applications authenticate users. Client secrets are optional:

┌──(kali㉿kali)-[~]
└─$ aws cognito-idp list-user-pool-clients --user-pool-id $USER_POOL_ID --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws cognito-idp describe-user-pool-client --user-pool-id $USER_POOL_ID --client-id $CLIENT_ID --profile $PROFILE --region $REGION

A client with ALLOW_USER_PASSWORD_AUTH enabled accepts direct username/password authentication — a spray target. App client secrets are returned in plaintext if you have cognito-idp:DescribeUserPoolClient.

List Users

With admin access, enumerate all registered users:

┌──(kali㉿kali)-[~]
└─$ aws cognito-idp list-users --user-pool-id $USER_POOL_ID --profile $PROFILE --region $REGION --query 'Users[*].{Username:Username,Status:UserStatus,Created:UserCreateDate,Enabled:Enabled}' --output table

Identity Pools (Federated Identities)

Identity pools issue temporary AWS credentials. Unauthenticated access grants credentials with no login required:

┌──(kali㉿kali)-[~]
└─$ aws cognito-identity list-identity-pools --max-results 60 --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws cognito-identity describe-identity-pool --identity-pool-id $IDENTITY_POOL_ID --profile $PROFILE --region $REGION

Key field: AllowUnauthenticatedIdentities. If true, anyone can get AWS credentials:

┌──(kali㉿kali)-[~]
└─$ aws cognito-identity get-id --identity-pool-id $IDENTITY_POOL_ID --account-id $ACCOUNT_ID --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws cognito-identity get-credentials-for-identity --identity-id $IDENTITY_ID --region $REGION

The returned credentials are scoped to the unauthenticated IAM role. Enumerate what that role can do — it is often overpermissioned.

Roles for Identity Pool

┌──(kali㉿kali)-[~]
└─$ aws cognito-identity get-identity-pool-roles --identity-pool-id $IDENTITY_POOL_ID --profile $PROFILE --region $REGION

Returns both authenticated and unauthenticated role ARNs. Enumerate both roles' policies via IAM Authenticated Enumeration.