skills.rest
aurainfosec
aurainfosecOFFICIAL
Explore all skills by this author →
WebsiteGitHub

cognito

Audits AWS Cognito user pool and identity configurations for security weaknesses.

Updated Feb 16, 2026
Search Tags:#authentication#oauth#security audit#mfa#token validation#aws cognito#hosted ui
One-click install
npx skills add https://github.com/aurainfosec/cloud-review-automation-poc --skill cognito-aurainfosec
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cognito
Source: https://github.com/aurainfosec/cloud-review-automation-poc/tree/main/skills/cognito
Command: npx skills add https://github.com/aurainfosec/cloud-review-automation-poc --skill cognito-aurainfosec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

AWS Cognito deployments often drift into insecure or misconfigured authentication and authorization settings that are hard to audit and validate quickly.

Core Features & Use Cases

  • User pool security configuration: Validate and improve MFA posture, password policy strength, advanced security modes, and refresh token lifetime policies to reduce account-takeover risk.
  • OAuth/OIDC and token management: Implement and verify authorization code, PKCE, and token validation behaviors so apps obtain the right tokens with the correct issuer/audience constraints.
  • Hosted UI external accessibility probing: Detect whether a Cognito hosted UI endpoint is reachable and assess TLS posture via an external probe to support evidence-based findings.

Quick Start

Ask the AI to audit your Cognito user pool configuration for MFA enforcement, advanced security mode, password policy strength, and refresh token validity, then validate the hosted UI endpoint reachability and TLS configuration.

Frequently Asked Questions about cognito

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit AWS Cognito user pool configurations for MFA and password policy weaknesses?▼

Auditing Cognito user pool security involves checking MFA posture, advanced security modes, password policy strength, and refresh token validity via AWS CLI queries to reduce account-takeover risk.

How can I verify OAuth and OIDC token validation behaviors in Cognito?▼

Verify Cognito OAuth/OIDC token validation by checking authorization code, PKCE implementation, and token issuer/audience constraints to ensure apps obtain correct tokens with proper validation expectations.

What is the best way to probe a Cognito hosted UI endpoint for reachability and TLS posture?▼

The best way to probe Cognito hosted UI reachability is performing an external probe with TLS assessment to detect endpoint accessibility and evaluate TLS configuration for evidence-based findings.

Does this Cognito security audit require specific AWS CLI permissions or identity pool integration?▼

The Cognito security audit requires AWS CLI access to query user pool and client properties, and it covers identity pool integration to validate authentication and authorization configurations during security reviews.

What Cognito misconfigurations should I look for during a security review?▼

During a Cognito security review, look for insecure MFA settings, weak password policies, disabled advanced security modes, excessive refresh token lifetimes, and OAuth/OIDC flow design weaknesses in user pool configurations.

Can I use this to validate PKCE and authorization code flow implementation in Cognito?▼

Yes, you can validate PKCE and authorization code flow implementation in Cognito by verifying token validation behaviors and ensuring apps obtain the right tokens with correct issuer and audience constraints.

Related Skills

Explore More Software Engineering Skills→
aws-samplesaws-samples
1

ipa-stack-cognito

Deploy an AWS Cognito User Pool with OAuth 2.0 Hosted UI endpoints.

Official
Intermediate
chatbotkitchatbotkit
13

hunt-ato

Identify and document account takeover vectors across authentication flows and settings.

Official
Advanced
aws-samplesaws-samples
1

ipa-stack-backend

Provision a serverless AWS backend with Lambda, API Gateway v2, and Cognito JWT authorization.

Official
Intermediate
DCx7C5DCx7C5

cloud-SKILL.md

Aggregate cloud misconfigurations from AWS Security Hub, Azure Defender, and open-source tools.

Community
Advanced