-
Notifications
You must be signed in to change notification settings - Fork 54
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Cognito Userpool set-user-pool-mfa-config #1176
Comments
The CFN AWS::Cognito::UserPool resource should support modifying the MfaConfiguration on both Create and Update. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cognito-userpool.html If you have confirmed this behavior somehow, can you provide us with the template that you used and any other information you can provide? |
Test step:
|
the reason we encounter this scenario is that our developer are testing enforced MFA behaviour and OPTIONAL MFA behaviour with Cognito Advanced Security Feature, but to our surprise we can't turn MFA to ON after we move to OPTIONAL. (we work around this now with Custom resource with lambda, which is quite a ugly hack) |
Name of the resource
AWS::Cognito::UserPool
Resource name
No response
Description
Cognito UserPool's update-user-pool API seems to refuse to update the MFA configuration. If I want to update the MFA setting, I need to use a separate API call to handle it. This behavior seems to be inherited into the AWS::Cognito::UserPool as well. However, there is no CloudFormation resource that allows us to configure MFA besides using AWS::Cognito::UserPool. This ends up blocking CloudFormation to update the MFA setting if needed
The only workaround at this stage is to create Custom Resource to manually execute SetUserPoolMfaConfig.
I think the AWS::Cognito::UserPool internally either need to add logic to handle this odd behaviour, or we need new Cfn resource that support configure MFA
Other Details
No response
The text was updated successfully, but these errors were encountered: