Reduce risks of user sign-up fraud and SMS pumping with Amazon Cognito user pools

This article discusses ways to reduce the risks of user sign-up fraud and SMS pumping attacks on Amazon Cognito user pools. It covers various prevention, detection, and mitigation strategies.

Specifically, the article covers:

• Protecting the sign-up flow by implementing bot mitigation, validating phone numbers before sign-up, and using custom confirmation flows or alternative OTP delivery methods
• Detecting SMS pumping by monitoring service quotas, CloudTrail events, and excessive billing
• Applying AWS WAF rules for mitigation, such as blocking specific IP addresses, phone number area code patterns, and client fingerprints (JA3)
• Considerations for AWS WAF remediation approaches