How can I implementing rate limiting on the IAM Identity Center portal to restrict the number of failed login attempts within a certain time period?

Question

We are currently going through a certification process and one of the requirements says:
Invalid authentication attempts are limited by: () Blocking the user's ID after no more than 10 attempts. () Setting the lockout duration to a minimum of 30 minutes or until the user's identity is confirmed.
Now, I have been reviewing the documentation and I came across this answer, however, I have not been able to locate a solution in the documentation from the IAM identity center to achieve this
Is there any documentation or procedure that you can suggest to me to meet this requirement?

Riku_Kobayashi · Answer

Hello.

As far as I know, IAM Identity Center does not have a function to lock accounts due to authentication failure.  
Therefore, when signing in through IAM Identity Center, it is necessary to independently create a process that uses EventBridge to trigger a Lambda function (or other actions) based on events recorded in CloudTrail.  
This process should determine whether the authentication has failed, and if it has, revoke the permissions of the IAM Identity Center.  
The events recorded in CloudTrail when signing in with IAM Identity Center are described in the following document.  
https://docs.aws.amazon.com/singlesignon/latest/userguide/understanding-sign-in-events.html

The configuration image is as follows.  
![a](/media/postImages/original/IMEkJCIr5wSo2jQPPN0FpimA)

Or, if you are using another IdP for authentication, I think you could use the account lock settings on the IdP side.  
https://learn.microsoft.com/en-us/entra/identity/domain-services/troubleshoot-account-lockout

How can I implementing rate limiting on the IAM Identity Center portal to restrict the number of failed login attempts within a certain time period?

Add your answer

Relevant content