[AWS-COGNITO] AWS Cognito event detected (TagResource)

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-COGNITO] AWS Cognito event detected (TagResource) "; program:cognito*; content:"eventName
| 22 3a 20 22
| TagResource"; content:!"
| 22
| sourceIPAddress
| 22 3a 20 22
| config
| 2e
| amazonaws
| 2e
| com
| 22
| "; content:!"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; classtype:system-event; reference:url,docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_Operations.html; sid:5012057; rev:3;)