I am working on a react/aws amplify app. I want to implement an email-based MFA auth flow. From what I'm seeing on the aws docs, it seems that the only options are text-based MFA or TOTP.
Is there a way to configure the Sign in process to send a code to a user's email instead of a text message?
Cognito can be configured to validate a user's email when they first sign-up. Cognito will send a confirmation code over email and wait for the user to confirm receipt.
You're talking about multi-factor authentication for sign-in. I don't think Cognito has any prebuilt email authentication challenge for sign-in.
However, you can create your own custom challenges. See Custom Authentication Challenge Lambda Triggers.
A naive implementation would be to generate a random code, and save it to DynamoDB. Send the code to your user using Amazon SES. In your verification Lambda, retrieve the code from DynamoDB and check it against what the user provided. Return success from the Lambda if the two match.
