How do I configure a Cognito User Pool to prevent sign ups? to require users to be created by other users.

This should disable self-signup:

const auth = new Auth(this, "Auth", {
  cognito: {
    userPool: { selfSignUpEnabled: false },
  },
});

Ah, that was easy. I'm surprised I missed it when going through the docks.