Alert on destructive Cognito events.

[mrJTY]

Threat: Tampering, denial of service. Someone deletes the identity pool!

Solution:

• Explicitly deny developers access to delete identity pool
• Alert on events where a delete call occurred. (See cloudtrail events)

https://docs.aws.amazon.com/cognito/latest/developerguide/logging-using-cloudtrail.html

[nathand99]

https://forums.aws.amazon.com/thread.jspa?messageID=909916 There doesn't seem to be an easy way to back up cognito user pools