Can someone tell me if it's possible to create a userPool with MFA required, SMS MFA disabled but OTP MFA enabled.
On the AWS console, it doesn't seem to be an issue but for some reason through CDK, it isn't quite happy.
I have attempted to update an existing user pool as well as create one new.
new UserPool(this, 'foo-user-pool', {
userPoolName: 'foo',
selfSignUpEnabled: false,
passwordPolicy: {
minLength: 12,
requireDigits: true,
requireLowercase: true,
requireSymbols: true,
requireUppercase: true,
tempPasswordValidity: cdk.Duration.days(7)
},
accountRecovery: AccountRecovery.EMAIL_ONLY,
enableSmsRole: false,
mfa: Mfa.REQUIRED,
mfaSecondFactor: {
sms: false,
otp: true
},
signInAliases: {
email: true,
},
autoVerify: {
email: true,
},
})
Gives me the following error message and has been for some time now...
SMS configuration and Auto verification for phone_number are required when MFA is required/optional (Service: AWSCognitoIdentityProviderService; Status Code: 400; Error Code: InvalidParameterException; Request ID: bcc2143c-546a-439a-b7b5-6fcf3888cf9a; Proxy: null)
The link shows a PR that allows us to disabled the SMS role creation.
AWS CDK 1.77.0