Amazon Cognito User Pool Monitoring in ObserveOps
Overview
The Amazon Cognito User Pool integration with ObserveOps (formerly known as AIOps) collects configuration inventory and authentication activity telemetry from Amazon Cognito user pools. It monitors pool state, MFA and security configurations, user counts, sign-in and sign-up activity, token refresh rates, federated authentication, and risk-based security events.
These metrics help identity and security teams track authentication volumes, detect throttling and risk events, and verify that security controls such as MFA and advanced security mode are active and operating correctly.
Prerequisites
- Amazon Cognito is enabled in the target AWS account with at least one user pool configured.
- The IAM role or user used for integration has read access to Cognito resources (
cognito-idp:DescribeUserPool,cognito-idp:ListUserPools,cloudwatch:GetMetricData). - Required Cognito and CloudWatch API endpoints are reachable from ObserveOps.
- The AWS account is added in discovery with correct credentials and region configuration.
List of Supported KPIs
User Pool Configuration
| Metric | Description | Type |
|---|---|---|
| aws.cognito.userpool.state | Current state of the Cognito user pool. | String |
| aws.cognito.userpool.domain.state | State of the custom domain associated with the user pool. | String |
| aws.cognito.userpool.estimated.users | Estimated number of users in the user pool. | Count |
| aws.cognito.userpool.mfa.configuration | MFA configuration applied to the user pool. | String |
| aws.cognito.userpool.advanced.security.mode | Advanced security mode configured for the user pool. | String |
| aws.cognito.userpool.deletion.protection | Indicates whether deletion protection is enabled on the user pool. | Boolean |
| aws.cognito.userpool.clients | Number of app clients registered to the user pool. | Count |
| aws.cognito.userpool.groups | Number of groups defined in the user pool. | Count |
| aws.cognito.userpool.identity.providers | Number of identity providers federated with the user pool. | Count |
| aws.cognito.userpool.users | Total number of users in the user pool. | Count |
Authentication Activity
| Metric | Description | Type |
|---|---|---|
| aws.cognito.userpool.sign.in.successes | Number of successful sign-in attempts. | Count |
| aws.cognito.userpool.sign.in.throttles | Number of sign-in attempts throttled by Cognito. | Count |
| aws.cognito.userpool.sign.up.successes | Number of successful sign-up attempts. | Count |
| aws.cognito.userpool.sign.up.throttles | Number of sign-up attempts throttled by Cognito. | Count |
| aws.cognito.userpool.token.refresh.successes | Number of successful token refresh requests. | Count |
| aws.cognito.userpool.token.refresh.throttles | Number of token refresh requests throttled by Cognito. | Count |
| aws.cognito.userpool.federation.successes | Number of successful federated authentication attempts. | Count |
| aws.cognito.userpool.federation.throttles | Number of federated authentication attempts throttled. | Count |
Security
| Metric | Description | Type |
|---|---|---|
| aws.cognito.userpool.account.takeover.risks | Number of sign-in events flagged as account takeover risks. | Count |
| aws.cognito.userpool.compromised.credential.risks | Number of events flagged for compromised credentials. | Count |
| aws.cognito.userpool.risks | Total number of risk events detected in the user pool. | Count |
| aws.cognito.userpool.override.blocks | Number of risk-based authentication blocks overridden by users. | Count |