Attack Chain

1. Reconnaissance & Discovery: An adversary identifies a target AWS Cognito Identity Pool ID. This ID is often exposed in publicly accessible client-side code, such as mobile application binaries, web application JavaScript files, or inadvertently committed to public source code repositories.
2. Initial Guest Identity Acquisition: The adversary makes an unauthenticated API call to cognito-identity.amazonaws.com's GetId endpoint, passing the discovered Identity Pool ID to obtain a unique guest identity.
3. Temporary Credential Request: With the guest identity in hand, the adversary then makes a subsequent unauthenticated API call to the GetCredentialsForIdentity endpoint, providing the guest identity.
4. Credential Issuance: If the Cognito Identity Pool is configured with AllowUnauthenticatedIdentities enabled and has an associated unauthenticated IAM role, the AWS service successfully issues temporary AWS access keys, secret keys, and a session token to the adversary.
5. AWS API Access: The adversary uses these newly acquired temporary AWS credentials to authenticate and make further API calls to other AWS services, such as S3, EC2, or IAM.
6. Privilege Escalation / Data Exfiltration: Depending on the permissions granted to the Cognito Identity Pool's unauthenticated IAM role, the adversary may gain unauthorized access to sensitive data (e.g., S3 buckets), manipulate cloud resources (e.g., launch EC2 instances), or even attempt further privilege escalation within the AWS environment.
7. Impact: This unauthenticated access can lead to data exfiltration, service disruption, resource hijacking, or the establishment of persistent backdoors, ultimately compromising the confidentiality, integrity, or availability of the AWS cloud environment.

Impact

A successful exploitation of a misconfigured AWS Cognito Identity Pool can lead to severe consequences. Attackers gain unauthorized and unauthenticated access to AWS resources, potentially enabling data exfiltration from storage services like S3, unauthorized modifications to cloud infrastructure, or the deployment of malicious resources. The impact is particularly high when the unauthenticated IAM role is excessively permissive, allowing broad control over the AWS account. This misconfiguration creates a direct, public pathway for adversaries to obtain legitimate AWS credentials, bypassing traditional authentication and authorization controls, and placing the entire affected AWS environment at risk of compromise, including financial impact from resource abuse or regulatory penalties from data breaches.

Recommendation

• Enable AWS CloudTrail data events for AWS::Cognito::IdentityPool resources, specifically capturing GetCredentialsForIdentity, GetId, GetOpenIdToken, GetOpenIdTokenForDeveloperIdentity, and UnlinkIdentity actions.
• Deploy the "Detect AWS Cognito Unauthenticated Identity Pool Credentials Issued" Sigma rule to your SIEM to alert on the initial occurrence of unauthenticated credential issuance.
• Review the IAM policies attached to unauthenticated roles of all Cognito Identity Pools; ensure they adhere to the principle of least privilege, granting only the absolute minimum permissions required for legitimate anonymous use.
• If unauthenticated access is not required for an Identity Pool, immediately disable the AllowUnauthenticatedIdentities setting within its configuration.
• For any alerts from the Sigma rule, investigate the source.ip, user_agent.original, and source.geo fields in CloudTrail logs to determine the origin of the GetCredentialsForIdentity call and search for subsequent API calls made with the obtained credentials.