How do I monitor user activity in an Amazon Cognito user pool?

Resolution

To monitor and analyze user activity, do the following:

1. Review the AWS CloudTrail Event history page.
2. Create Amazon Athena tables to search CloudTrail logs.
3. Turn on Amazon Cognito threat protection.

Review the CloudTrail Event history page

To review the CloudTrail Event history to analyze calls to your user pool, complete the following steps:

1. Open the CloudTrail console in the same AWS Region where your Amazon Cognito user pool is.
2. In the navigation pane, choose Event history.
3. On the Event history page, choose the settings icon.
4. For Select visible columns, select Event Name and Event Source, and then take the following actions:For Event Source, filter for cognito-idp.amazonaws.com to view user pool activity and cognito-identity.amazonaws.com to view identity pool activity.For Event Name, enter the name of the user pool event or API action, such as InitiateAuth or CreateUserPool.
   Note: CloudTrail logs show only UserSub and omit UserName for user specific requests. To find a username, call the ListUsers API and use the sub attribute filter.

The CloudTrail Event history page provides a record of the past 90 days of management events in an Region. You can create an event data store or a trail to access an ongoing record of activity and events past 90 days. For more information about event history, see Limitations of Event history.

Create Athena tables to search CloudTrail logs

You can create tables in Athena to search CloudTrail logs that CloudTrail stores in an Amazon Simple Storage Service (Amazon S3) bucket.

Note: In the following queries, replace your_athena_tablename with the name of your Athena table.

Run the following Athena query to retrieve Amazon Cognito user registration events from your CloudTrail logs:

SELECT eventTime, eventName, additionalEventData
FROM your_athena_tablename
WHERE eventsource = 'cognito-idp.amazonaws.com'
    AND eventname IN ('SignUp', 'signup_POST', 'signup_GET')
    AND eventtime >= '2025-07-15T09:00:00Z'  
    AND eventtime < '2025-07-15T10:00:00Z'
ORDER BY eventtime ASC; 

Run the following query to show all user activity for a specific Amazon Cognito user with a Universally Unique Identifier (UUID) sub value:

SELECT eventTime, eventName, additionalEventData
FROM your_athena_tablename
WHERE eventsource = 'cognito-idp.amazonaws.com' 
    AND json_extract_scalar(additionaleventdata, '$.sub') = '826bfee9-68d8-4046-b292-4f8cdd839bcd'
    AND eventtime >= '2025-06-17T00:00:00Z'
ORDER BY eventtime ASC; 

Note: In the preceding example, 826bfee9-68d8-4046-b292-4f8cdd839bcd is the UserSub value.

Turn on threat protection

To check detailed logs of user authentication events, take the following actions:

• Turn on threat protection for your user pool. For Enforcement mode, choose Full function or Audit only to locate user activity logs.Note: Amazon Cognito retains user event history for 2 years. For more information, see Viewing and exporting user event history.
• Configure your user pool to export threat protection user activity logs to an Amazon Data Firehose delivery stream, Amazon S3 bucket, or Amazon CloudWatch log groups.
• Use the CloudWatch console to view threat protection metrics.