AmazonCognitoUnAuthedIdentitiesSessionPolicy

Last Modified

May 1, 2026

May 1, 2026 at 08:03 PM UTC

Version

Total Versions

Created

May 1, 2026

Actions

Subscribe to updates

Risk

High

An unrestricted escalation path, identity administration, secret reads or the power to switch off security monitoring. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed

High
Can read secrets
Reads data encrypted with any KMS key whose key policy allows it, on any resource with no condition.
kms:Decrypt
Use with caution: Where the holder needs only some secrets, write your own policy scoped to their ARNs or tags, and limit decryption in the KMS key policies.
Medium
Full access to 8 services on every resource
Uses comprehend:*, firehose:*, mobiletargeting:*, personalize:*, polly:*, rekognition:*, transcribe:*, translate:* with Resource "*" and no condition, so every action AWS adds to those services later is granted too.
comprehend:*firehose:*mobiletargeting:*personalize:*polly:*rekognition:*transcribe:*translate:*
Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.

Policy Document

View on GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45{
  "PolicyVersion": {
    "Document": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Sid": "CognitoUnAuthedIdentitiesSessionPolicy",
          "Effect": "Allow",
          "Action": [
            "rum:PutRumEvents",
            "sagemaker:InvokeEndpoint",
            "polly:*",
            "comprehend:*",
            "translate:*",
            "transcribe:*",
            "rekognition:*",
            "mobiletargeting:*",
            "firehose:*",
            "personalize:*",
            "geo:GetMap*",
            "geo:ListMaps",
            "geo:SearchPlaceIndex*",
            "geo:GetPlace",
            "geo:CalculateRoute*",
            "geo:*Geofence",
            "geo:*Geofences",
            "geo:*DevicePosition*",
            "kms:Encrypt",
            "kms:Decrypt",
            "kms:ReEncryptTo",
            "kms:ReEncryptFrom",
            "kms:GenerateDataKey",
            "kms:GenerateDataKeyPair",
            "kms:GenerateDataKeyPairWithoutPlaintext",
            "kms:GenerateDataKeyWithoutPlaintext"
          ],
          "Resource": "*"
        }
      ]
    },
    "VersionId": "v4",
    "IsDefaultVersion": true,
    "CreateDate": "2026-05-01T19:57:11+00:00"
  }
}

Version History (8 recorded)

Raw history

v4updated

1 action added

May 1, 2026

b9d8f75

AmazonCognitoUnAuthedIdentitiesSessionPolicy - Policy Version v3