AWS Cognito Access Token

Description

General

• Documentation: https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html
• Summary: Amazon Cognito is AWS's managed user directory and authentication service. A User Pool issues OAuth 2.0 / OIDC tokens to an application's end users; the access token (token_use=access) authorises calls to the app's protected APIs and to Cognito's own user endpoints.

Revoke the secret

Access tokens are short-lived (1 hour by default). They cannot be revoked individually, but signing the user out (GlobalSignOut / AdminUserGlobalSignOut) or lowering the token validity in the User Pool app client invalidates them.

Details for AWS Cognito Access Token

• Family: token

• Category: cloud_provider

• Company: Amazon Web Services

• High recall: False

• Validity check available: True

• Analyzer available: False

• Revoker available: False

• On-premise instances exist: False

• Only valid secrets raise an alert: False

• Occurrences found for one million commits: very rare

• Prefixed: False