Is there a way to see the password within the Lambda triggers that can be fired off by a sign-up or password change on AWS Cognito User Pool?
I want to get the password and compare it to lists of previously compromised passwords (the haveibeenpwned lists) to ensure password strength at a much higher level than what is possible by the arbitrary complexity rules that can be defeated by garbage like "Password!23"
The answer is that it currently is not possible to do as simply as I had hoped.
What you would have to do is to turn on the USER_PASSWORD_AUTH type authentication flow which means the password is sent in the HTTP POST request and setup your own reverse proxy to take the request, check the password details and then forward the request onto Cognito, accept the response and then send it back to the browser.
Or just turn on the "Advanced Security Features" option that they give you and tick the box for checking passwords against compromised lists... which is what I imagine AWS is trying to force you to do.
If you are using Amazon Cognito than you should not take worry about passwords and its complexity. It is totally managed by Cognito.
Your authentication will be based on Tokens only :)
There is no way to retrieve the password from lambda trigger.
But yes, You can do one thing, Set status to FORCE CHANGE PASSWORD. So that user must have to reset password after first login.
After that, whenever your user try to change password, You can add your own constrains in your UI before calling ChangePassword API
I hope this helps!
