Admin set MFA preferences not working for Software Token MFA, defaults to SMS

Viewed 18

I am trying to configure Software Token MFA using an Authenticator app with my Cogntio userpool. However, I keep getting the following error message when selecting MFA option to authenticator app:

[InvalidParameterException] Errors were encountered during MFA configuration update for user "test-user". Please review the errors and retry.
InvalidParameterException (Request ID: 34f907d6-f499-4982-b0ee-453285698d1b)

I have setup the Cognito userpool so self-sign up is disabled and Admins create users so not sure if that is causing an issue.

I have tried using the boto3 SDK to use the admin_create_user followed by admin_set_user_mfa_preference and get an error saying the config is not set for the user:

botocore.errorfactory.InvalidParameterException: An error occurred (InvalidParameterException) when calling the AdminSetUserMFAPreference operation: User does not have delivery config set to turn on SOFTWARE_TOKEN_MFA

Python code:

import boto3
from botocore.config import Config
from time import sleep

my_config = Config(
    region_name='eu-west-1'
)

client = boto3.client('cognito-idp', config=my_config)

my_user = 'test-user'
pool_id = REDACTED


def create_user(user, pool_id):
    client.admin_create_user(
        UserPoolId=pool_id,
        Username=user,
        UserAttributes=[
            {
                'Name': 'email',
                'Value': REDACTED
            }
        ],
        TemporaryPassword='Password123456!!',
    )

    set_mfa_prefs(user, pool_id)


def set_mfa_prefs(user, pool_id):
    client.admin_set_user_mfa_preference(
        SoftwareTokenMfaSettings={
            'Enabled': True,
            'PreferredMfa': True
        },
        Username=user,
        UserPoolId=pool_id
    )


create_user(my_user, pool_id)

It seems like it just defaults to SMS and doesn't let me alter it in anyway.

0 Answers
Related