Internet-Scale Analysis of AWS Cognito Security

## Overview

In this presentation, security researcher Andres Riancho explores security vulnerabilities within AWS Cognito at an internet scale. The research originated from a cloud security assessment where Riancho received read-only credentials to an AWS account and discovered AWS Cognito—a service that allows developers to grant end users direct access to backend AWS resources such as Amazon S3, DynamoDB, and Lambda functions without intermediary servers.

Cognito relies on two primary components: **User Pools** (user directories for authentication) and **Identity Pools** (which issue temporary AWS credentials with IAM roles). Identity pools can configure distinct IAM roles for both authenticated and unauthenticated identities. During the initial assessment, Riancho used an extracted Identity Pool ID to retrieve AWS credentials, enumerate privileges, and perform privilege escalation to compromise the account. This prompted an empirical study to determine how widely AWS Cognito misconfigurations exist across the internet.

---

## Data Collection and Extraction Methodology

Because Identity Pool IDs are randomly generated, long unique strings that cannot be guessed or brute-forced, they must be extracted directly from client-side code:

- **Mobile Applications (Google Play):** Google Play hosts 2.6 million apps and limits bulk scraping. To target relevant targets, Riancho utilized a third-party service provider to identify apps embedding the AWS SDK, narrowing the field to 13,000 applications. These APKs were downloaded from alternative repositories (APKPure and APKMirror), decompiled, and searched via regular expressions to extract embedded Identity Pool IDs. - **Web Applications (Common Crawl):** Search engines like Google do not index script tag attributes or client-side JavaScript files such as `amazoncognitoidentity.min.js`. To scan web pages at scale, Riancho used **Common Crawl**, an open repository hosting 2.5 billion web pages. - **Custom Tooling (`CC Lambda`):** Existing processing frameworks (such as `CCMR Job` using Elastic MapReduce) suffered from poor error handling. Riancho created an open-source tool called **CC Lambda**, which leverages 1,000 concurrent AWS Lambda functions to parallelize downloading chunks of Common Crawl, unzipping web content, and matching regexes across pages. The run cost approximately $300 USD and completed chunk processing in roughly 3 minutes per batch. - **Additional Sources:** GitHub, Shodan, and Yandex APIs were also queried to locate additional exposed Identity Pool IDs.

Through these techniques, Riancho collected a total of **3,100 unique Identity Pool IDs**, with the vast majority discovered in Android applications from the Play Store.

---

## Permission Enumeration Techniques and Tooling

Once Identity Pool IDs were gathered, Riancho used the Cognito API to generate AWS credentials specifically for the **unauthenticated role**. Analyzing privileges presented distinct operational and ethical challenges:

1. **Brute-Force Privilege Enumeration:** Calling the IAM API to inspect attached policies directly was impossible because none of the extracted unauthenticated credentials possessed IAM inspection permissions. Enumeration required actively testing AWS API calls directly: receiving a "Forbidden" status indicated no permission, whereas an "OK" response confirmed an active privilege. 2. **Safe Enumeration Boundaries:** To avoid disruption or legal repercussions, destructive API actions (e.g., terminating EC2 instances) were excluded. Furthermore, calls were limited to read-only infrastructure metadata (such as listing S3 bucket names) rather than accessing customer data (such as reading object contents). 3. **Custom Tooling (`EnumerateIAM`):** Existing AWS enumeration tools were single-threaded and lacked coverage across all read-only API endpoints. Riancho developed and open-sourced **EnumerateIAM**, a multi-threaded Python utility designed to rapidly test AWS credentials against non-destructive read-only API calls.

---

## Scope and Impact

Riancho emphasized that all testing and statistics were strictly limited to **unauthenticated identity roles** (identities granted temporary AWS credentials without providing login credentials). Because most applications allow users to register an account and assume the authenticated role—which inherently grants equal or greater permissions than the unauthenticated role—the actual security exposure and risk for many of these AWS accounts is significantly more severe than the baseline findings reflect.