AWS Cognito - Prevent Password Reuse

Question

I am curious if it is possible to prevent a user from re-using their password (or previous n passwords) in AWS Cognito. It seems like this would be a feature, but I don't see it in the documentation (https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-policies.html).

It is possible with IAM (https://docs.amazonaws.cn/en_us/IAM/latest/UserGuide/id_credentials_passwords_account-policy.html).

Balf

While not what you're looking for, be aware that Cognito supports a compromised credentials feature: docs.aws.amazon.com/cognito/latest/developerguide/…. You can also require MFA, of course, and configure various adaptive measures such as blocking high risk sign-in. – Kryska

Answer 1

First of all AWS Cognito UserPools Password policy and AWS IAM User Password Policy are two things. Although IAM User Password Policy allows configuring password change enforcement, it's not available with AWS Cognito yet.

Currently, you can only configure following attributes for the password.

• Minimum password length
• Password require numbers
• Password require special character
• Password require uppercase letters
• Password require lowercase letters

In addition, you can configure MFA.

Devisee

Thanks Ashan - I appreciate your answer – Balf

Is it available now? – Argenteuil

@Argenteuil Did a quick check. Cognito UserPools still don't have the support for the password expire. – Devisee

Answer 2

For now, Cognito supports the restriction of re-using the old passwords. Password reuse prevention

Lox