Authentication with Amazon Cognito
Optional TOTP MFA, password policy, advanced security mode, and long-lived auth logging in production.
Overview
End-user and API-key oriented authentication for Guard is built on Amazon Cognito user pools. The stack configures authentication policies and logging to support enterprise expectations for strong credentials, optional MFA, and audit retention.
Multi-factor authentication (MFA)
The user pool enables MFA as optional at the pool level and supports software token MFA (TOTP) via SOFTWARE_TOKEN_MFA. End users can register an authenticator app when your organization’s policies require second factors.
The schema also includes an mfa_required_by custom attribute (RFC3339 timestamp) so product logic can enforce MFA enrollment deadlines per user or per tenant policy without changing the core Cognito MFA mode.
Password policy
The deployed pool enforces a strong password policy, including minimum length 16 and requirements for uppercase, lowercase, numbers, and symbols.
Advanced security and tiering
In production, the user pool tier and Advanced Security Mode are elevated (for example PLUS tier with AUDIT-level advanced security in the default template) relative to non-production, improving risk-based signals and logging available to operators.
Authentication logging and retention
Production deployments configure Cognito log delivery to Amazon CloudWatch Logs for user notifications and user authentication events (production-only in the default template).
Associated CloudWatch log groups for Cognito use an extended retention period in production (approximately seven years, implemented as 2,557 days in the stack) versus a shorter default in non-production environments. This supports security investigations and compliance workflows that require long-lived authentication evidence.
Related topics
Data Isolation and Security Controls — logical tenant separation and encryption context.
Transport Security — TLS for client sessions.